Cybersecurity
PHP2Shell, Made Clear
What It Is, Who It Affects, and What to Do
In this article
The short version
What it is: A serious flaw in PHP, the behind-the-scenes software that powers millions of websites and web portals.
Why it matters: An attacker could take over an unpatched site without a password, and attackers are already trying.
What to do: Make sure PHP gets updated on every website you run. A fix is available today, and Trebron can help.
If you only read one thing, read the checklist under Are you affected? Below.
Are you affected?
Three quick questions
Do you run any website, portal or online store?
Think about your public site, a parent or student portal, a payment or permit portal, a learning management system, an intranet, or a vendor portal.
Do you know who maintains it?
It might be your own IT staff, a web agency, a hosting company, or a volunteer who built it years ago.
Has that person confirmed PHP has been updated since October 21?
Yes, that was only a day ago, and many organizations are quickly delploying patches.
If you answered yes to the first question and no or “not sure” to either of the others, treat it as unpatched until someone confirms otherwise.
Check Yourself – Or contact us
Use a public PHP test website to see if you are running a vulnerable version. There are also tools for checking your internal websites. Short-term risk is the public facing website, long-term risk is the never patched internal website. Both need to be checked and patched.
External Site Check – https://php-check.cybelangel.com/
Internal Site Check – Contact us or look at this GitHub – https://github.com/openai/php2shell-checker
What happened, in plain English
Think of a website as a building. Your pages and content are the rooms people see. PHP is the engine room in the basement that keeps everything running, and you rarely think about it.
On October 21, 2026, the people who maintain PHP announced they had found two faulty locks on that engine room door. They are tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell. Someone who knows about the faulty locks can walk in without a key, take control of the server, and read sensitive information stored there, such as passwords.
The PHP team rated the flaws critical, 9.2 out of 10. Security firms including Amazon and Cloudflare have already seen attackers testing them. The good news: new locks (software updates) are available now.
What to do
If you’re a leader, administrator or business owner
You don’t need to touch any code. Your job is to make sure someone owns this and closes it out.
- List your websites and portals, including ones run by outside vendors.
- Ask whoever runs each one: “Have you updated PHP for PHP2Shell, and when?” Get a yes and a date in writing.
- Follow up on anything without a clear answer by the end of the week, or call Trebron and we’ll help chase it down.
If you’re on the IT team or a web host
Updating PHP is the only complete fix. Forward this section to whoever manages your servers.
| If you run PHP… | Update to |
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 (8.2 reaches end of life December 31, 2026) |
| 8.1 or older | No longer supported. Get a fixed build from your OS vendor or upgrade |
- Find every PHP install, including containers, hosting panels and appliances. The version php -v reports may not be the one serving your site.
- Patch through your OS vendor if PHP came from Ubuntu, Red Hat or similar; their fixed package may keep an older version number.
- Restart PHP (PHP-FPM, Apache or the relevant service) so the fix actually takes effect, then confirm the running version.
- Check for compromise on internet-facing servers, since attack attempts began before the flaws were public. Rotate passwords, API keys and tokens stored on exposed servers.
Can’t patch today?
As a stopgap, set session.upload_progress.enabled=0 (and fatal_error_backtraces=0 on PHP 8.5), restart every PHP worker, and limit public access to the system. These reduce risk but don’t replace the update.
What this doesn’t mean
Headlines like this can sound alarming, so here is the problem in proportion:
- It’s about servers that run websites, not the laptops, phones and email your staff use every day.
- A fix already exists. This is a known problem with a known solution, not a mystery.
- Being affected isn’t the same as being breached. Unpatched means exposed. It doesn’t mean someone has gotten in, and patching quickly closes the door.
The risk comes from waiting. Organizations that patch this week are in good shape.
The bigger picture: attackers now have AI too
PHP2Shell is part of a larger pattern. Attackers are using AI to find weaknesses and turn them into working attacks faster than ever, and that shrinks the time organizations have to respond.
Microsoft’s 2026 Digital Defense Report puts numbers on it:
- Less than a day. The median time from a flaw being discovered in the wild to attackers weaponizing it is now well under 24 hours.
- Easier than ever. Work that once took skilled experts can, in many cases, now start with a simple AI prompt.
- Websites are a top target. Attacks on public-facing applications, like the websites and portals PHP2Shell affects, rose from 15% to 24% of the intrusions Microsoft investigated in a year.
You can see the same pattern with PHP2Shell. Amazon spotted an attempt to exploit it four days before the flaw was even announced. We don’t know whether AI played a role in this case. Either way, the old rhythm of patching once a month no longer keeps up.
Why testing yourself matters more than ever
If attackers use AI to probe your systems, the most reliable way to stay ahead is to do the same thing first. This is often called offensive security: testing your own environment the way an attacker would, so you find the open doors before someone else does. AI now lets defenders run those tests more often and more broadly than a once-a-year assessment.
In practice, that comes down to three habits:
- Know what’s exposed. Keep an up-to-date list of every website, portal and system reachable from the internet.
- Patch in days, not weeks, especially for anything internet-facing.
- Test regularly, not just after a headline, so new gaps surface on your schedule instead of an attacker’s.
How Trebron can help
At Trebron, we believe in bringing clarity to cybersecurity, and that matters most in moments like this. We can help you find where PHP is running, apply the updates, put stopgaps in place where needed, and check for signs of trouble. When the urgent work is done, we’re also glad to talk through what regular testing could look like for your environment.
Using Sophos products? Sophos hasn’t named any affected products yet. Its October 21 advisory says it is still investigating. As a Sophos Titanium Partner, we’re watching that advisory and will contact affected customers directly if anything changes.
