Two critical security vulnerabilities have been discovered in PHP. They are collectively known as PHP2Shell. Under certain conditions, attackers can exploit them to execute malicious code on a web server. This raises two important questions for website owners: Has the PHP version in use already been patched? And are there any signs of an attack?
ALL-INKL.COM customers can rest assured: All PHP versions we offer have already been patched. Nevertheless, it is a good idea to check your website for suspicious changes.
What is PHP2Shell?
Two serious PHP security vulnerabilities were disclosed on 21 October 2026. They are identified as CVE-2026-109618 and CVE-2026-109619. PHP is a programming language used on many web servers. It handles tasks such as contact forms, user logins and orders in online shops. Content management systems such as WordPress also use PHP.
Under certain conditions, the two vulnerabilities allow what is known as remote code execution (RCE). This means attackers can remotely run their own commands on an affected server. The extent of the potential damage depends on the server configuration and the access permissions in place. Full access to the server is not automatically possible.
Important: You may be affected even if you did not code your website yourself. What matters is whether the server’s PHP environment has been patched.
How did the vulnerabilities arise?
Both vulnerabilities are caused by errors in PHP’s memory management. In the case of CVE-2026-109618, PHP may continue processing invalid or incomplete data under certain circumstances. In the case of CVE-2026-109619, PHP may access memory that has already been freed. Such errors can cause applications to crash or, under suitable conditions, allow malicious code to run.
According to the PHP Foundation, there were indications of one of the issues as early as 2024. Technical difficulties, limited resources and delayed decisions initially prevented a fix. The scale of the problem became clearer in August 2026. After information became public ahead of schedule, the security updates were released early. The incident shows that even established software can contain undiscovered vulnerabilities. Regular maintenance and security updates therefore remain essential.
What risks do websites face?
If attackers successfully exploit the vulnerabilities, the damage may vary depending on the system:
- Altered content: Text, images or other website content could be changed.
- Stolen credentials: Passwords or confidential information could be exposed.
- Fraudulent redirects: Visitors could be sent to fraudulent websites.
- Tampered shop functions: Order processes or payment redirects could be altered.
- Injected malicious code: Attackers could run malicious programs on the server.
The presence of a vulnerability does not automatically mean an attack has succeeded. Whether unauthorised parties had access must be investigated based on concrete evidence, such as the possible damage described above.
An SSL certificate does not protect against PHP2Shell either. HTTPS encrypts data transmitted between the browser and the web server, whereas PHP2Shell affects processing on the server itself. Find out more in our article HTTP vs. HTTPS: What Is the Difference?.
Which PHP versions have been patched?
The following patched PHP versions were released to address the two vulnerabilities:
| PHP version | First patched version |
|---|---|
| 8.2 | 8.2.35 |
| 8.3 | 8.3.36 |
| 8.4 | 8.4.27 |
| 8.5 | 8.5.12 |
The table shows the first patched versions. Hosting providers can also backport security fixes to older PHP versions. An older version number therefore does not necessarily mean that an installation is insecure.
ALL-INKL.COM customers can check their PHP version in the customer administration system (KAS). Remember to include subdomains and test installations. After switching versions, test important functions such as forms, logins and order processes.
Also pay attention to subsequent security advisories: On 23 October, an issue affecting a rare session configuration was reported. On 26 October, new Windows releases followed because of a separate vulnerability in Brotli. Brotli is a method of compressing files to help websites load faster. Errors when processing this data can create security risks.
What should ALL-INKL.COM customers do now?
ALL-INKL.COM has patched every PHP version it offers, including older versions. So far, there is no concrete evidence that the vulnerabilities have been successfully exploited. However, earlier attacks cannot be ruled out entirely. We therefore recommend the following measures:
1. Check your website for changes
Check your website for unusual changes. Pay particular attention to unknown user accounts, unexpected redirects, modified files and suspicious content. Not every irregularity means an attack has occurred. Your agency or other authorised people may have made changes. Do not delete suspicious files hastily, as they may be important for an investigation. If you have reasonable grounds for suspicion, contact ALL-INKL.COM support.
2. Keep applications up to date
Regularly update your CMS and any installed plugins, extensions and themes. An update to WordPress, for example, does not replace a PHP security update. Both need to be secured independently.
3. Create backups
Regularly back up both your website files and the associated databases. Check that the backups can be restored. Our data backup guides can help you with this. Bear in mind that a backup may already contain tampered files. After an attack, use a backup that is known to be clean whenever possible.
4. Review access credentials
If unauthorised access has been confirmed, potentially affected passwords and access keys should be replaced after the system has been cleaned up. First eliminate the cause of the attack so that unauthorised parties cannot regain access.
Does AI make security vulnerabilities more dangerous?
Artificial intelligence can analyse code quickly and identify vulnerabilities. This helps security researchers but can also benefit attackers. Security company Wiz reports that AI made it considerably easier to develop and adapt working proof-of-concept exploits for PHP2Shell. However, AI did not cause the original PHP bugs.
In future, AI could lead to existing vulnerabilities being discovered and exploited more quickly. It is not possible to reliably predict how much this will increase the number of successful attacks. For website owners, the priorities remain installing security updates promptly, checking applications regularly and assigning clear responsibilities. AI-generated code should also be checked for security issues before use.
FAQ: Frequently asked questions about PHP2Shell
Is PHP2Shell a single vulnerability?
No. The name refers to two PHP vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619.
Does PHP2Shell mean my website has been hacked?
No. A vulnerability initially only means that an attack may be possible. Whether your website was actually affected needs to be checked.
Is a WordPress update enough?
No. WordPress and the underlying PHP environment need to be updated and secured separately.
Do I need to update PHP on my computer?
If you only browse websites, this is not necessary. If you run a local PHP environment yourself, you should check its security status.
Does an SSL certificate protect against PHP2Shell?
No. SSL, or HTTPS, protects the connection, not PHP processing on the server.
Do I need to switch to a new major PHP version immediately?
Not necessarily. What matters is having a PHP installation that is confirmed to be patched. Major version upgrades should be checked for compatibility beforehand.
Is an older PHP version automatically insecure?
No. Hosting providers can also provide security fixes for older versions. What matters is the actual security status.
Is a security scanner enough to check my website?
A scanner can flag potential problems, but it does not replace checking installed updates or conducting a targeted investigation if an attack is suspected.
Do I need to take my website offline?
Usually not, provided the PHP environment has been patched and there are no signs of a successful attack. If a breach has been confirmed, temporarily taking the website offline may be appropriate.
Will AI be able to handle all security checks in future?
No. AI can support analysis, but it does not replace technical checks and assessment by the professionals responsible.
Keep PHP up to date and check websites regularly
PHP2Shell shows that even fundamental website components can contain security vulnerabilities. At ALL-INKL.COM, all PHP versions we offer have already been patched. Website owners should nevertheless keep their applications up to date, create regular backups and watch for unusual changes. Installing security updates promptly and checking your website regularly can significantly reduce the risk of successful attacks.
Related topics
A simple one-page website can cost around €500 to €3,000. For a small business website with five to ten subpages, expect roughly €1,500 to €8,...
At ALL-INKL.COM, secure and reliable hosting is part of our commitment. Website operators need encrypted connections, dependable certificate handling,...
Sustainable web hosting refers to operating websites and the infrastructure required to support them in the most environmentally conscious way possibl...
