On Wednesday, a client forwarded me a note from a business advisor, and the instruction in it was to take the sites offline. A PHP vulnerability had just gone public.
I took the sites down first and read about it second. How much risk a business can carry isn’t my decision to make, and the person who gets to make it had made it.
What the bug is.
The pair is CVE-2026-109618 and CVE-2026-109619, and people are calling it PHP2Shell. Both are rated critical. One crafted request to a PHP page can let someone run their own code on the server without logging in to anything, and working exploit code was on GitHub within a day. PHP released fixed versions on Wednesday, October 21: 8.2.35, 8.3.36, 8.4.27, and 8.5.12. PHP 8.1 and older don’t get a release. The PHP team posted source patches for 7.4, 8.0, and 8.1, but someone has to build and install them, and on shared hosting that someone is the host.
When it got personal.
I host a handful of sites on my own server, most of them mine, and most of them low traffic. When I started digging into that server, the vulnerability stopped being somebody else’s emergency. I felt vulnerable, but not exposed. I turned off the setting most people were recommending as a stopgap on every PHP version the server runs, and then I went looking for the real fix.
Four servers, four answers.
By Thursday morning I had checked every server I could log in to, and no two of them were in the same state.
- My own server was patched Wednesday afternoon. The company that hosts it ran its own script and installed cPanel’s fixed builds, and
php -vshowed the new version numbers. - The same company’s shared servers, where several of my clients have their sites, looked unpatched that night. The version numbers were the old ones. They were patched anyway: the fix there comes from CloudLinux, which backports it into the old version number instead of moving to the new one. The company posted a status notice on Thursday that said so.
- A second host was still running PHP builds from 2025 when I checked Thursday morning. Those client sites are still offline.
- Two older sites have no release coming. One is a five-year-old staging copy on PHP 7.2, which nobody is patching, and we took it down. The other runs PHP 8.0, and unless its host builds the source patch, the fix is an upgrade.
The part that surprised me most is that PHP isn’t one product on a server. cPanel packages it one way and CloudLinux packages it another (think of the same app from the App Store and from Google Play), and each one ships a fix on its own schedule. cPanel’s fixed builds came out Wednesday. CloudLinux finished releasing its builds just after midnight UTC, which was Wednesday evening here. So the version number told me the truth on one server and misled me on the next.
It isn’t a WordPress problem.
A lot of what I’m reading on LinkedIn is about WordPress and Drupal. They both run on PHP, so they got the headlines, but the bug is in PHP itself. The PHP 8.0 site I mentioned isn’t WordPress at all. It’s a static site, plain HTML pages, and the only PHP on it is the script behind the contact form. That one file was enough to put it on the list.
If a site has a contact form, a login, or a shopping cart, there’s a good chance PHP is running somewhere behind it, whatever it was built with.
Who’s watching yours?
The question I’d ask after this week is who’s watching the server a site runs on, and whether they’re telling you what’s going on. The first host posted a notice that explained what it had done and why the version numbers looked wrong. A third host emailed me Thursday at lunchtime, without being asked, to say every site was patched, that its firewall had been blocking the exploit while it waited for the fix, and that anyone who had suspended a site could turn it back on. The second host, the one still on 2025 builds, told me in a support ticket that it would let me know once a patch was available. One client first heard about PHP2Shell on NPR.
If a host is the one watching, it should be easy to find out what it did this week. If nobody is, that’s part of what I do with Good Standing: every option, including the smallest, comes with an alert when something like this lands, and I check the server rather than the version number.
