What Is Happening?
On October 20th, 2026, the PHP project announced an upcoming security patch intended to address two critical vulnerabilities in PHP. The vulnerabilities, known as PHP2Shell, allow malicious actors to run code through a website’s server remotely, potentially interfering with business operations and accessing critical data.
A critical vulnerability of this severity is considered a “Drop everything and do something about it NOW” issue, as leaving the vulnerability unpatched can allow malicious access to untold critical data.
What Is PHP?
PHP is a server-side language designed primarily for website development. As an robust and long-supported language, PHP makes up the backbone of the modern internet, comprising approximately 70% of all known websites. PHP connects the frontend web experience with the databases stored behind the scenes allowing for seamless web functionality.
How Does This Affect Me?
With PHP being utilized on the majority of known website infrastructures across the internet, if you have a website, there is a high likelihood that your website is at risk. Websites running on currently supported versions of PHP are actively being patched but many sites run on outdated versions of PHP. Sites that have not been brought up to date with the latest technology are often at higher risk, as the older sites present easier opportunities for malicious interference.
What Can I Do?
Speak to your web host right away. Potential exploits have already been found circulating the web, so early prevention is critical. If your site is not able to receive the critical security patches, your host may need to consider temporarily disabling the affected features or taking the site offline until the necessary updates can be applied and the vulnerability is resolved.