Dark green graphic from digital jumpstart. A small label reads "security update", above the headline "php2shell vulnerability: patched and protected". A faint PHP code window sits to the right.

php2shell vulnerability: our managed sites are patched

4 min read

On 21 October, PHP released emergency fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619, known together as the PHP2Shell vulnerability. If your website runs on WordPress, it runs on PHP. Here’s what happened in plain words, what it means for your business, and why every site on our managed Cloudways platform is already patched and protected.

the news

what happened, in plain words

PHP is the language that runs behind most websites. BleepingComputer puts it at 75% to 80% of all sites, including those built on WordPress.

The two flaws could let an attacker run commands on a web server without logging in. No password, no account, just a request to the site. Anyone who can run commands on your server can change your website, so this one matters.

Both flaws are rated 9.2 out of 10 for severity, according to the PHP Foundation. They affect every PHP setup that serves web pages, including the common ones: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

the detail

CVE-2026-109618 and CVE-2026-109619: why it’s a big deal

This PHP vulnerability is serious for three reasons.

  • There’s no full workaround. PHP’s own release announcement says there are no complete mitigations, and updating is the only safe choice.
  • Attacks started early. BleepingComputer reported that Cloudflare was already seeing early attacks before the fix came out, and had put temporary firewall rules in place. It was clear those rules were a stopgap, not a fix.
  • Official bodies say act now. The UK’s National Cyber Security Centre told organisations to update to the latest version of PHP. If they can’t update or apply PHP’s temporary measures, it says they should consider taking the system offline. CERT-EU also noted that test exploits had begun to circulate.

The full technical detail is in PHP’s security advisory.

what we did

our sites: patched and checked

Every site on our managed Cloudways platform now runs PHP 8.3.36, the patched release.

Our host patched our servers overnight, the day after the fix was released. On 22 October, we checked the PHP version on every site and confirmed they were all patched for the php2shell vulnerability. If we look after your site on that platform, you don’t need to do anything.

how we protect sites

website security: layers, not luck

Patching is the fix. Everything else is there so problems get spotted early and sorted quickly. Here’s what’s standard on DJ-managed sites:

  • Cloudflare in front of the sites where we manage DNS, filtering traffic before it reaches the server
  • Server-level bot protection from Cloudways
  • Wordfence security on every site
  • Jetpack downtime monitoring, so we know if a site goes down
  • Weekday morning health checks
  • Regular backups, plus a fresh backup before every change
  • Let’s Encrypt SSL for secure connections

None of this replaces updates. But it’s why we can move quickly: we’re watching, we checked this fix the same day it went on, and the protections are already in place when something like PHP2Shell lands.

your site

not sure about yours? ask one question

Good WordPress security starts with knowing what your site runs on. If someone else hosts or manages your site, ask them:

“Which PHP version is my site on, and has it been updated for PHP2Shell?”

The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or later. If your site runs PHP 8.1 or older, the PHP project no longer updates it, so it’s time to move to a supported version.

Don’t know who to ask, or not getting a straight answer? Get in touch and we’ll help you work out where you stand. You can also see how we build and look after websites on our web design page.

sources

sources

Related Posts