The SMB nightmare that ran on PHP

On October 21, 2026, a patch landed for PHP2Shell (CVE-2026-109618 and CVE-2026-109619), a critical flaw that lets an unauthenticated attacker run code remotely on PHP installations that serve web requests. Both carry an official CVSS v4.0 score of 9.2. Because the flaws are in PHP itself, a site can be exposed even when its own code is secure. National cyber authorities, including CISA, the Canadian Centre for Cyber Security and the UK NCSC, have issued alerts, and security vendors have reported exploitation attempts.

For most small and mid-sized businesses, the interesting question is not the score. It is this: do we even run PHP?

Probably, yes. You just would not call it that.

PHP hides in everyday tools

Nobody writes „PHP“ on the org chart. But it powers a lot of what a small business relies on:

• The company website, especially WordPress and WooCommerce
• Web shops and the admin panels behind point-of-sale systems
• Appointment booking and event registration
• Time tracking and lightweight CRM
• Customer portals and custom SaaS built by a local software house

Your team knows „we have a website and online booking.“ The PHP underneath is invisible, until it is the thing everyone is asking about.

Three owners, three timelines

Who fixes it depends on who runs it:

1. You run the server. The patch is yours to apply.
2. Your MSP manages it. They patch, once they know it is there.
3. A third party hosts it as SaaS. You wait for the vendor, and ask for a date.

Each path has a different owner and a different update rhythm. That is normal. It just needs to be known.

The older-version trap

Official fixes shipped only for PHP 8.2 and later. PHP 8.1 and earlier are no longer supported; the PHP security team released minimal source backports for 7.4, 8.0 and 8.1, aimed at teams that build from source, and some distributions and LTS vendors offer fixes. So a custom application on an old version is rarely a quick fix. Appliances are a related worry: many embed PHP, and the vendor update may arrive later, or sit waiting to be installed. As of October 22, one major network-security vendor had confirmed all versions of its firewall OS affected, with fixed releases still pending.

What to do next

Ask your service provider one question: „Do you know what is running for us?“

A good partner answers with a list, not a promise. If yours cannot, that is useful to learn before the next incident, not during it.

We work with MSPs every day to make that list fast and complete.