A serious security problem has been identified in PHP, a technology used behind many websites and online business systems.
The issue needs prompt attention, but businesses should not panic. Security fixes are available, and a capable IT support provider should be able to establish whether your organisation is exposed and take the appropriate action.
What Is PHP?
PHP (Hypertext Preprocessor) is a programming language used to make websites and browser-based applications work.
When you log in to an online account, submit a form, place an order or view information pulled from a database, code running on the website’s server may be carrying out that work. In many cases, that code is written in PHP.
Visitors do not usually see PHP because it operates on the server rather than in their browser. However, it is widely used in content management systems, e-commerce platforms, customer portals and applications built specifically for individual businesses.
If your business has a WordPress website, for example, PHP forms part of the technology that helps it run.
That does not mean WordPress itself is the cause of this security issue. The vulnerabilities affect PHP, but because PHP sits underneath websites and applications that businesses use every day, it is important to check whether your systems could be affected.
This means your organisation may depend on PHP even if nobody in the business recognises the name.
What Is the Issue?
On 21st October 2026, two serious PHP security flaws became the focus of urgent attention. They are identified as:
- CVE-2026-109618
- CVE-2026-109619
Both have been associated with a reported severity score of 9.2, which places them in the critical category.
The vulnerabilities have also been referred to by researchers as PHP2Shell.
If the necessary conditions are present, an attacker could potentially send instructions to an affected server without first signing in. In security terminology, this type of problem is called unauthenticated remote code execution.
In everyday terms, it could provide a criminal with a route to make a vulnerable server carry out commands that it should not accept.
The exact level of risk will depend on how PHP has been installed, configured and exposed. It is therefore important to investigate rather than assume that every PHP-based website has already been compromised.
Why Is This PHP Vulnerability Significant?
PHP sits behind many important systems
PHP is used in websites, online shops, client portals and other web-based services. It is also associated with well-known platforms such as WordPress, WooCommerce, Drupal, Joomla, Magento and Adobe Commerce.
Businesses can therefore have PHP in several places, including systems managed by a web developer, hosting company, software supplier or external IT provider.
Attackers may be able to act without an account
The reported flaws are not limited to the theft of a user’s password.
Their seriousness comes from the possibility that an attacker could interact directly with an exposed server without having an authorised account. If an attack succeeds, the consequences will depend on the affected system and the access available to it.
Information emerged before the planned announcement
Details about the vulnerabilities reportedly became public before the intended disclosure. This caused concern because technical information may give attackers an opportunity to begin looking for exposed systems before every organisation has completed its security work.
An exploit tool called “php2shell” has also reportedly been circulating. Reports about exploitation should be assessed carefully against confirmed technical information, but they are another reason not to postpone checking affected systems.
How Could This Affect My Business?
The immediate question is not simply whether your organisation has a website. It is whether PHP is running anywhere within a website, application or hosted service for which your organisation is responsible.
An exposed and vulnerable system could create several business risks.
Disruption to websites and online services
An incident could affect the availability or reliability of a website, online shop, customer portal or internal web application.
For a business that takes orders, handles enquiries or delivers services online, an interruption can quickly affect customers and employees.
Unauthorised access to systems or information
If someone gains control of a vulnerable server, they may attempt to reach information or connected resources that should be restricted.
The possible impact will depend on what the server contains, what it can communicate with and how the wider environment has been configured.
Hidden changes to the server
An attacker may try to alter files or create another route into an affected system. This means applying an update is not always the end of the investigation if there is evidence that an attack may already have taken place.
Reputational and commercial consequences
Customers expect organisations to look after the systems that hold their information and provide essential services.
A security incident can result in downtime, recovery costs and difficult conversations with customers, suppliers and other stakeholders. The sooner an organisation understands its position, the more effectively it can manage these risks.
What Is Happening Now?
Last updated: 21st October 2026.
The situation developed quickly during 21st October 2026.
The PHP security team announced plans for an additional security release outside its usual schedule. That release was intended to address two critical flaws assessed at 9.2 under CVSS v4.0.
Information about the vulnerabilities reportedly appeared before the planned publication time. Since then, there have been reports of an exploit tool and attempts to use the flaws against vulnerable systems.
Official PHP fixes are now the central part of the response. Businesses should establish how updates are supplied to their systems, as this may be through an operating system vendor, hosting control panel, software supplier or another repository.
Additional protection for Cloudflare users
Cloudflare has released an emergency managed Web Application Firewall rule intended to block exploitation of a critical remote code execution issue.
A Web Application Firewall, commonly shortened to WAF, examines traffic before it reaches a website or application and can reject requests that match known attack behaviour.
This may provide another layer of defence for appropriately configured Cloudflare customers. It should not, however, be treated as a reason to leave affected PHP installations uncorrected.
A temporary configuration change has been discussed
A temporary measure involving the following PHP setting has also been circulated:
session.upload_progress.enabled = Off
After changing the setting in php.ini, the relevant PHP-FPM service or web server would need to be restarted for the change to take effect.
This setting controls PHP’s ability to report the progress of file uploads. Disabling it could therefore affect applications that rely on that function.
It should not be changed without testing and technical review. It is an interim risk-reduction measure, not a replacement for installing the official security fix.
Taking systems offline should be a considered decision
Some organisations may be considering whether to disconnect affected systems from the internet.
That might be necessary where a vulnerable system cannot be protected in another way, but taking an important website or business application offline can create significant disruption of its own.
Before making that decision, speak to your IT provider. They should consider how exposed the system is, whether an update can be applied, whether access can be restricted and whether temporary protections are suitable.
Neither work around has been confirmed by the PHP project, so treat them as interim measures and still apply the official patch. Test the setting change first, as it disables upload progress tracking, which some applications rely on.
What We Know and What We Do Not Know
What we know
Two serious PHP vulnerabilities are being tracked as CVE-2026-109618 and CVE-2026-109619.
They have been associated with the possibility of remote code execution without authentication. In practical terms, that means a request from outside the organisation may be able to trigger commands on a vulnerable server.
Security updates have been released, so organisations have a route to correct affected installations.
Businesses should also remember that PHP may be included within a wider product. It may not appear as a separately managed item on an obvious server list.
What still needs to be established
A general security notice cannot tell you whether your own systems are exposed.
That requires someone to review your organisation’s websites, servers, containers, applications and externally hosted services. They must then identify the PHP versions in use and examine how each system is configured and accessed.
It may also be necessary to wait for individual hosting companies, software developers and product vendors to explain how they are distributing their updates.
The key point is that uncertainty should lead to investigation, not assumption.
What Should My Business Do Now?
- Find out where your business uses PHP.
Ask your IT team or IT provider to check everywhere PHP could be running. This includes your live website, other servers, test systems and anything hosted or managed for you by another supplier. They should also check which version of PHP each system is using. - Check whether your version of PHP is still supported.
PHP versions 8.2 to 8.5 are currently supported. PHP 8.1 and earlier are no longer supported and may not receive an official security fix. If your business is still using one of these older versions, upgrading should be treated as a priority. - Install the security update as soon as it is available.
Before making any changes, make sure there is a recent backup. Your IT provider should then install the appropriate security update and restart the relevant services so that the updated version is actually running. How and when the update becomes available may depend on your hosting company or software provider. - If you cannot update immediately, take steps to reduce the risk.
Your IT provider can look at temporary measures to help protect affected systems until the proper update can be installed. This could include limiting access to vulnerable systems that are connected to the internet. Speak to an IT professional before making these changes yourself. - Check with companies that manage systems for you.
If another company hosts or manages your website or application, ask them whether your systems are affected and when they plan to apply the necessary update. It is a good idea to ask for their response in writing. - Keep an eye out for anything unusual.
Your IT team or provider should monitor affected systems for unexpected activity or changes that could indicate someone has tried to exploit the vulnerability, particularly while the situation is developing.
What Can Citadel Technology Do to Help?
Citadel Technology is an IT support provider. We help businesses manage, maintain and protect the technology they depend on, without expecting clients to interpret complex security alerts themselves.
In this situation, we can help organisations understand whether PHP is present, identify the systems that require attention and decide on the most appropriate next steps.
Support for existing Citadel clients
For the environments we manage, our work includes identifying relevant PHP installations and assessing the action required for each system.
This may include co-ordinating security updates, reviewing appropriate temporary protections and working with other suppliers where they control part of the service.
Help if another provider manages your IT
If you already have an IT support company, ask it to explain your current position.
You should receive a clear response covering which systems have been checked, what has been updated and whether there is any remaining risk that requires attention.
If the answer is unclear, Citadel can offer a separate conversation to help you understand the situation. Speaking to us does not commit you to changing providers.
Help with unsupported or difficult systems
Some organisations will find that an important application depends on an old PHP version or cannot be updated without affecting other software.
These situations need careful planning. Citadel can help assess the immediate risk, consider practical short-term controls and support the work required to move towards a maintained system.
A conversation about your wider IT support
Security incidents often reveal gaps in ownership. A business may discover that nobody has a complete record of its systems, different suppliers believe someone else is responsible, or updates are not being managed consistently.
If this issue has raised concerns about your current support arrangements, we can explain how Citadel provides managed IT support and what would be involved in moving to us.
For help with this PHP security issue, or for an informal conversation about your IT support, contact the Citadel Technology team at [email protected].