We’re patched for PHP2Shell
We take hosting infrastructure, security, updates and patching more seriously than most and we’re pleased to confirm we updated everything yesterday, so our clients are safe from the latest threat
As you may have already seen in the news, the internet has been rocked in the last 24 hours by new vulnerabilities in the underlying language powering around 70% of the entire internet, PHP.
AI-driven agents identified two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) a couple of months ago, and those involved in the disclosure have been working behind the scenes to ready updates which were due to be released today, 22nd October 2026.
Unfortunately, details of the situation began to leak on Tuesday 20th which forced a timetable revision, and patches were released yesterday around 3pm GMT.
Thankfully we saw the advisories late on Tuesday evening and we were ready and waiting for new builds to become available in real-time yesterday, with our first server being patched less than 5 minutes after release.
The rest of our digital estate was updated over the following couple of hours. Some repositories took longer to update, no doubt a result of the shifting disclosure timetable, but we had it all sorted by dinner time. Our webservers and market data-driven investor tools platform are all patched.
Thankfully, our multi-server setup meant we could run on the patched servers while we applied updates to others, and we were able to complete the process without disruption or downtime.
What is PHP2Shell?
PHP is the underlying programming language supporting around 70% of the web.
Many website content management systems (CMS’s), applications and platforms – like Laravel, which we use for our tools platform – are built on PHP and powered by Linux webservers. It’s everywhere and ubiquitous with website development. Think of it like English is to global language, PHP is the same for the internet.
There are a few different versions of PHP, from old and unsupported versions like 5.4 and 7.3 which are now ‘end of life’ and may not receive updates, to the most recent 8.5.
Thankfully we were already running 8.5.11 – the latest until 3pm yesterday – and now we’re running 8.5.12 across our entire estate. We also checked logs and servers for signs of intrusion before the patches were applied.
We’re not going to provide an in-depth look at the specific vulnerabilities and how they work, but they have apparently been there since PHP 5.4 – released a decade ago – and when combined, they can allow an attacker to remotely execute code on a vulnerable machine. That’s the “Shell” part of the moniker. It gives the attacker control.
Is my WordPress site affected? What about the investor tools?
It’s important to understand the nuance of the exploits in this context.
When an attacker sends a carefully crafted payload, it hits the PHP runtime before it even reaches the website application – be it WordPress, Drupal, Magento or a hundred other similar applications. It might also be possible to circumnavigate the WAF, or things like Cloudflare, to target the servers directly.
It’s an important distinction, because it means the website can be up-to-date, patched and secured with various hardening techniques, protections and firewalls, but the server these applications sit on are the target of the vulnerabilities, not the applications themselves.
Put simply, if you run a PHP application and you haven’t updated it in the last 24 hours, yes your unpatched servers mean your website is vulnerable.
This isn’t ‘a WordPress or Laravel thing’, it’s an issue affecting three quarters of the webservers that combine to make up the internet as we know it.
Which is why many government agencies, security consultants and advisories were recommending websites were taken offline until patches became available.
We kept a close eye on traffic within our Web Application Firewall (WAF) and made the decision to keep hosting while we waited for the patch. Not least because we host websites for public companies listed on various stock exchanges who have regulatory and legislative requirements to consider. But it would have been a nightmare to communicate, especially at short notice, and I doubt we’d have received much thanks for it either.
So we’re good now, right?
In short, yes.
Our first couple of servers were patched within minutes of the update becoming available in the repository, and we updated the others an hour or two later. We were already running the latest version at the time, so updating to another minor version was a fairly trivial process – it’s the sort of thing we do regularly.
But this situation does highlight the world we live in today. Hosting websites in 2026 isn’t for the faint hearted and it requires a lot more attention and resource than just a couple of years ago.
We’re big advocates of keeping WordPress and infrastructure up-to-date, and we’re constantly making iterative improvements to our platform – it’s a constant process, but one that increases in frequency as time goes on.
Historically, we might have applied updates once or twice a month. Now it can be once or twice a day!
We also don’t have the luxury of being cautious or thoroughly testing updates before they go into production.
As one leading security analyst commented yesterday, they expected to see in-the-wild exploits within 15 minutes of the updates – and accompanying details – becoming available. AI tooling made this possible and the window between release and exploit has shrunk to nothing. Often we have to just apply the update and check to ensure everything works after the fact.
EDIT – Update: 4pm on 22nd October – It seems there are now proof-of-concept repositories available, which means the next few days, weeks and months could get interesting. We’re not going to link here, but it looks credible. The exploit is now available to download and run by anyone with a basic understanding.
What about the other 69.999% of the internet?
Well, that’s a really good question.
Initial signs are positive – we noted repositories were slow to offer the update because they were completely overwhelmed with requests, suggesting many took this seriously and applied the updates as soon as possible.
Sadly, that’s not the case everywhere.
We’ve seen comments on Reddit and other forums about large hosting providers like Cloudways (owned by Digital Ocean) and WPEngine who took an uncomfortably long time to patch their fleet, with a few angry customers voicing their frustrations. Perhaps they were caught out by the shifting timeline, or maybe they had so many servers to update it just took some time to rollout.
Looking ahead, the real victims will be those still running older, end-of-life and unsupported versions of PHP.
Official patches won’t be coming for 5.x or 7.x, although some maintainers may well ‘back port’ the fix over time. If they are unable to or simply refuse, the only option is to update the major PHP version to a supported one and, well, that can be a fair bit of work depending on the age of the applications running on them. Functions become deprecated, and code that worked on an older PHP version might not work on a newer one, meaning it’s a fairly involved process and requires proper testing.
Is there anything I need to do?
If your website is hosted with us, nope. We have you covered.
If your website runs on PHP (Umbraco clients don’t have to be concerned here, but they do have their own advisories and updates to consider) and is managed by someone else, reach out to them and ask if they’ve applied the patches.
If you’re a public company with a WordPress website, you can always contact us to discuss a migration to our platform – we love welcoming new clients and we’d be more than happy to look after your existing site!