Briefing · 23 October 2026
PHP2Shell: what every small business should do this week
Two critical flaws in PHP leaked before a fix existed. Here is what happened, why it reaches businesses that have never heard of PHP, and the five things to do now.
What happened
On 20 October 2026 details of two critical vulnerabilities in PHP — CVE-2026-109618 and CVE-2026-109619, now known as PHP2Shell — leaked ahead of their planned disclosure. Both allow an attacker to run code on a web server without logging in. Both scored 9.2 on the CVSS 4.0 severity scale.
The PHP team brought its fixes forward and released them on 21 October: versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Attack traffic was observed before the fixes were available. Older PHP branches have received no official fix.
Why this reaches you even if you have never heard of PHP
PHP runs a very large share of the web, including WordPress and most hosting control panels. It is embedded in appliances, containers and third-party products. If your business has a website, a booking system, a customer portal or a network storage device, there is a reasonable chance PHP is somewhere in the chain — operated by a supplier, not by you.
National cyber authorities across the Gulf and worldwide told organisations to identify third-party products, appliances and containers that include vulnerable PHP. That instruction is aimed at you as much as at IT departments.
Five things to do this week
1. Ask your website host, in writing, whether the servers running your site have been updated to a fixed PHP version and restarted. A patched file on disk does not help while the old code is still running in memory.
2. Ask the same question of any supplier whose product you access through a web page — booking, accounts, CRM, practice management, remote support.
3. If you or your IT provider run anything yourselves, update PHP, restart the web service, and confirm the running version. Note that some Linux distributions keep the old version number after patching; check the package changelog.
4. If a system cannot be updated this week, ask your IT provider about the published interim mitigations — they reduce exposure but are not a fix.
5. Keep every reply. If anything was exposed to the internet and unpatched after 20 October, consider changing the passwords and keys that system could reach, and check its logs from that date.
Check your own website now — free
What "done" looks like
A short record: which of your systems and suppliers were in scope, who you asked, what they said, what was updated and when. That is what your insurer, your assessor and your customers will want to see — not this week, but when they next ask.
If you would rather someone did this for you — this time and every time — that is what the Cyber-Safe Emergency Desk is for. Start with the free PHP2Shell check for your website.
Sources
PHP release announcements, 21 October 2026 · Canadian Centre for Cyber Security, AL26-026 · BleepingComputer, 20 October 2026
Next time, hear about it before the news does
This check looks at one website, once. The Cyber-Safe Emergency Desk maps everything you rely on, watches the alerts, chases your suppliers and hands you the evidence — every time.