PHP Security Vulnerability PHP2Shell: How to Secure Your Website
What the PHP2Shell Security Vulnerability Means
PHP2Shell refers to two critical vulnerabilities in the PHP core, CVE-2026-109618 and CVE-2026-109619, rated 9.2 under CVSS v4.0. Attackers can execute code on the server without logging in and read memory contents, including passwords, session tokens, and API keys. The vulnerabilities were patched on October 21, 2026, in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
The BSI has issued a warning with a severity rating of three out of four. Cloudflare has already observed attack traffic, and CERT-EU has reported the first proof-of-concept exploits. There are no reliable workarounds; only the update closes the vulnerability.
Why Even a Well-Maintained Website Can Be Affected
The PHP vulnerability is not located in the content management system, but in the layer below it. An up-to-date version of WordPress, well-maintained plugins, and a clean theme do not provide protection in this case. Every installation that processes web requests is affected, from WordPress and WooCommerce to Drupal, Magento, and Shopware.
With Apache and mod_php, the attack demonstrated here occurs before your application code even starts. No plugin or firewall in the CMS can prevent this. The vulnerability can only be patched at the server level by updating PHP.
These steps will secure your website right now
Four steps will get you there: Check the PHP version via the web server, install the update, restart PHP-FPM or the web server, and check the version again. Restarting is crucial because otherwise, running processes will continue to use the old, vulnerable code. Afterward, it’s worth taking a look at the access logs for the time period since October 20.
With traditional shared hosting, the provider installs the updates. Still, be sure to ask if and when this has been done. With your own servers, the responsibility lies entirely with you.
How to Tell How Secure Your Website Is
An incident like PHP2Shell is a stress test for your operational organization.
Four questions reveal your level of maturity:
- Who installs security updates at the server level—you or your hosting provider?
- How quickly does that happen—in hours or in weeks?
- Who would notice if a PHP process suddenly started running programs that have no business being there?
- What happens if there is suspicion of a successful attack?
Anyone who doesn't have a clear answer to these four questions doesn't have a PHP problem, but rather a gap in their operational strategy—one that could prove disastrous as soon as the next critical vulnerability emerges.
Why Website Security Needs a Dedicated Point of Contact
Security isn't established on the day a news story breaks, but in the weeks leading up to it. If you know which PHP version is running where, how quickly each hosting provider responds, and which systems are special cases, you can act within hours—rather than days—in the event of an incident like PHP2Shell. This overview can't be created overnight; it grows as you manage the systems.
This is exactly where Partner & Söhne comes in: We monitor the security situation for the websites we manage, triage reports for you, and coordinate with hosting providers and IT teams to determine who is responsible for what and when. For hosting, we partner with Mittwald, a German hosting provider with its own data center in Germany. This ensures that your data remains in the country and is subject to German data protection laws. You likely don’t even notice much of this in your day-to-day life—and that’s the whole point.
PHP2Shell is a good example of this: Less than 24 hours passed between the leak on Tuesday evening and the patch on Wednesday afternoon. Anyone who had to first figure out who was responsible during that time lost hours while the first attacks were already underway.
What Ongoing Support Specifically Covers
An overview of all PHP versions and systems in use, including the ones that have been forgotten
Classifying security alerts before they reach you
Coordination with hosting providers and existing service providers
Verify that an update is actually active, not just installed
Procedure in Cases of Suspected Incidents: From Log Analysis to Resolution
Do you have any questions?
Together, we’ll determine how well your website is protected against PHP2Shell and future security vulnerabilities: We’ll check which version of PHP is actually running on your server, confirm with your hosting provider whether and when the update was installed, and verify that it’s actually active after the server restarts. During a no-obligation consultation, we’ll show you where your website needs improvement and where it’s already well-protected. Simply get in touch with us.
Frequently Asked Questions About the PHP2Shell Security Vulnerability
Further contributions
Updates on our work and our perspectives on the issues that concern us.
We look forward to hearing from you.
Katrin, Maximilian, and Max-Raphael
Managing Partners