If you saw the headlines about PHP2Shell and wondered whether it affects you, you are not alone. The short answer: it might, and the fix is already available. What matters now is that someone checks.
This post explains what happened, what it means for a business like yours, and the one conversation worth having today.
What happened
On October 21, 2026, a patch was released for two serious flaws in PHP (CVE-2026-109618 and CVE-2026-109619). PHP is the software behind a large share of the internet’s websites and web tools. Both flaws are rated 9.2 out of 10 for severity. In plain terms, an attacker who can reach a vulnerable system over the internet may be able to run their own commands on it, without logging in.
National cyber authorities, including CISA, the Canadian Centre for Cyber Security and the UK NCSC, have issued alerts, and security vendors have reported exploitation attempts. That is a good reason to act promptly. It is not a reason to panic.
Why you might be affected without knowing it
You do not need to employ a developer to use PHP. It often sits quietly behind things like:
- Your company website, especially if it runs on WordPress or WooCommerce
- Your online shop or the admin side of your checkout
- Appointment booking or event registration
- Customer portals or software built for you by a local provider
If your customers can book, buy or log in on your website, there is a fair chance PHP is part of how it works.
What it could mean for your customers
A business website is often where customer names, orders and appointments are handled. If an attacker gets control of the system behind it, that information, and your customers’ trust, can be at risk. This is why a flaw in a technical component becomes a business question, not only an IT one.
Who needs to do what
The good news is that you probably do not need to fix this yourself. Who acts depends on who looks after the system:
- Your IT provider (MSP) manages it. They apply the update. Ask them to confirm when it is done.
- A software vendor hosts it for you. The vendor applies the update. Ask them for a date.
- You or a colleague run it. The update is yours to apply, or to hand to someone who can.
Older systems need extra attention. Official fixes cover PHP 8.2 and later, so a website or application built on an older version may take more than a quick update. Some devices, such as firewalls, include PHP too, and their vendors may release updates later.
What to do this week
You do not need to understand the technical details. You need to ask one clear question of whoever looks after your IT:
“Do we run PHP anywhere, and has it been updated?”
A good provider answers with specifics: which systems, which versions, what is done and what is still open. If you get a vague answer, ask for a short written summary. It is a fair request, and a useful one before the next incident, not during it.
The bigger picture
There will be another flaw like this one. Next time it may not be PHP. What protects a business is not guessing which software is affected, but having a provider who already knows what you run and can tell you quickly. That is what good IT support looks like, and it is worth asking for.
