PHP2Shell: the critical PHP vulnerability that put the web on alert
What happened, who is affected and how we are handling it at Adratech
On October 21, 2026, the PHP security team released an emergency update to fix two critical flaws known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). PHP powers WordPress, Laravel and a large share of the websites and web applications in the world, so the impact is huge. In this article we explain what is known, which versions fix the problem and how we are handling it for our clients' systems.
What is PHP2Shell?
What made this case especially sensitive is that the technical details leaked before a fix existed. PHP gave advance notice and shipped the update on the announced day, but for several hours website administrators around the world had to protect themselves without a patch.
Who is affected?
- ✓ Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on October 21, 2026.
- ✓ Versions without a fix: PHP 8.1 and older are no longer supported and will not get a patch. If your system runs one of them, the only way out is to migrate to a supported version.
- ✓ Shared hosting: if your site runs on shared hosting or cPanel, the update depends on your provider. Ask them directly whether they have already installed a fixed PHP version.
How we are handling it at Adratech
1. Full inventory
We reviewed every server and system we manage to know which ones use PHP, which version and how they are exposed to the internet. Without a clear inventory, it is impossible to know what to protect first.
2. Preventive protections before the patch
While PHP prepared the fix, we applied two layers of protection: we turned off the PHP feature that reports pointed to as the attack path and, at the web server level, we temporarily paused file uploads, which is the type of request the attack uses. Pages, logins and forms kept working normally, and file uploads were only kept on systems where they are critical to daily operations, limited to each client's known connections.
3. Monitoring attack attempts
We reviewed server logs throughout the day. We detected automated scanners testing this type of request against the sites we manage, and they were blocked by the protections before reaching PHP.
4. Controlled updates, one system at a time
We install the fixed PHP version one system at a time, checking before each change that the new version is the right one and afterwards that the site still responds the same way. If anything fails, the process stops before it affects the next one.
5. Communication with every client
We told our clients what was happening, what they might notice that day (the pause on file uploads) and how to ask for an exception if they needed to upload something urgently. Once finished, we remove the temporary measures and confirm the close.
What to do if your site uses PHP
- ✓ Find out your PHP version. Your hosting provider or developer can tell you in minutes.
- ✓ Update as soon as possible to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on the branch you use. It is the only definitive fix.
- ✓ Do not rely only on configuration changes. They help as a temporary measure, but PHP maintainers themselves warned they do not replace the patch.
- ✓ If you use PHP 8.1 or older, plan the migration: those versions were left without a fix and will remain vulnerable.
- ✓ Check your server logs for unusual requests since October 20, and if something looks odd, ask for a review.
The bigger lesson
If you are not sure who maintains your website or web application, or your PHP version is no longer supported, contact us and we will review it with you.
📚 Artículos Relacionados
Need help with your website's SEO?
We help make your website visible on Google with active SEO, not passive.
Let's talk about your project →