PHP2Shell: Five Questions to Ask About Your Website Today

Update, October 30, 2026, 8:00 PM ET: Palo Alto Networks has now released fixed versions for every affected PAN-OS release, and it has raised its rating of the issue to critical, with its highest urgency. There is no longer any reason to wait: if you use these firewalls, ask your IT provider to confirm the update is installed and the management page is not reachable from the internet.

Update, October 29, 2026, 8:00 PM ET: Attackers are pairing PHP2Shell with a second flaw. On October 28, CISA added a Linux kernel flaw known as Fragnesia (CVE-2026-46300) to its catalog of known exploited vulnerabilities, noting it “can be chained with” the two PHP2Shell flaws to plant malicious files on a web server and run commands with full administrator (root) control. It gave US federal agencies until October 31 to fix it. For Linux servers that run PHP, updating PHP is no longer enough on its own: ask your provider to confirm the operating system’s latest kernel security update is installed as well.

Update, October 28, 2026, 8:00 PM ET: Firewalls are now a confirmed target. Palo Alto Networks’ advisory now says “active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet”. Fixed PAN-OS versions are available for most releases, with the last due by October 30. Separately, security firm Dream reported that an attacker used PHP2Shell, combined with a second flaw, to take over 25 firewalls from an unnamed large vendor in the US and Asia, including systems in a US government-affiliated network. Whatever brand you use, ask your IT provider today to confirm that firewall and appliance management pages are not reachable from the internet, that vendor fixes are installed, and that devices have been checked for compromise.

Update, October 26, 2026, 8:00 PM ET: CISA has now added both PHP2Shell flaws to its catalog of known exploited vulnerabilities, meaning it has evidence they are being exploited. It gave US federal agencies until October 29 to act and flagged the flaws for forensic triage, which in plain terms means checking affected systems for signs of compromise, not just patching them. Separately, security researchers confirmed a successful attack on a test server set up to attract attackers, running PHP 8.4.26 in a favorable configuration. For appliances, Palo Alto Networks has released its first fixed PAN-OS versions, with the rest due by October 30. If any site or appliance is still not updated, treat it as urgent, and ask for the compromise check in step 5.

Update, October 23, 2026, 8:00 PM ET: Attack attempts continue, but as of October 23, SecurityWeek reported that no successful compromise in the wild had been confirmed, and several security firms say the exploits circulating publicly fail against default PHP settings. That could change. Operators of a well-known botnet have tried to use PHP2Shell to install their malware, and one security firm says it has built an exploit that works on multiple PHP versions in typical production setups, though it has shared it only with its customers. The advice is unchanged: update, and check for compromise. The flaws are still not in CISA’s catalog of known exploited vulnerabilities.

Update, October 23, 2026, 12:00 PM ET: The PHP project has disclosed a related, much narrower issue, CVE-2026-115560, that the October 21 versions do not yet fix. It says the issue can only occur under an unusual combination of configuration and application code and is handling it in its regular release cycle. Until the next release, PHP suggests turning off a feature called session upload progress (session.upload_progress.enabled=0). That setting was already one of the October 21 temporary measures, so if your provider applied it then, PHP says no further action is needed. Ask your provider to confirm. Updating to the fixed versions below is still essential.

Update, October 23, 2026, 8:00 AM ET: The Netherlands’ National Cyber Security Centre told Dutch public broadcaster NOS on October 22 that, alongside attack attempts, it is “receiving the first signals that this is succeeding” (our translation from Dutch). It did not describe those signals, and earlier the same day it had said it was seeing only attack attempts. This is the first government agency we have seen report signs of successful attacks. If any of your sites were not updated quickly, treat the compromise check in step 5 below as urgent. The flaws are still not in CISA’s catalog of known exploited vulnerabilities.

Update, October 23, 2026, 4:00 AM ET: PHP2Shell also reaches some network and security equipment that has PHP built in. Palo Alto Networks lists its PAN-OS firewall software and Panorama management product as affected, with fixes for most PAN-OS versions expected between October 26 and 30 (updated October 24; the first estimate was October 26 to 28) and no date yet for Panorama. It says it is not aware of any malicious exploitation against its products and recommends limiting management access to trusted internal IP addresses. Fortinet and Cisco are still investigating parts of their product lines. Whatever brand you use, ask your IT provider to confirm that firewall and appliance management pages cannot be reached from the internet, and to check each vendor’s advisory.

Update, October 23, 2026, 12:00 AM ET: Some organizations chose to take websites offline rather than wait. In the UK, a government minister told Parliament on October 22 that 32 government services were unavailable and four partially unavailable, largely as a precaution while updates were applied, and that she was not aware of any confirmed compromise of central government systems. On October 21, several governments and large companies, including Nintendo, took services offline as they addressed the flaws. Taking an unpatched site down temporarily is a reasonable choice if it cannot be updated today. The flaws are still not in CISA’s catalog of known exploited vulnerabilities.

Update, October 22, 2026, 8:00 PM ET: The US Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert, “Critical Vulnerabilities in PHP Require Immediate Patching”. It urges organizations to patch immediately, starting with internet-facing systems, and says systems that cannot be updated right away, or that run PHP 8.1 or earlier, should be taken offline until they are patched or upgraded. CISA said it had not observed exploitation when it published the alert, and the flaws are still not in its catalog of known exploited vulnerabilities.

Update, October 22, 2026, 8:05 AM ET: Amazon’s security team reports that PHP2Shell is “now being broadly exploited in the wild”, and that it saw an exploitation attempt dated October 17, four days before the flaws were made public. That means attackers may have targeted sites before any fix existed. If you have not updated, do it now, and ask for a compromise check even on sites that were updated on October 21. As of this update, the flaws are not yet in CISA’s catalog of known exploited vulnerabilities.

You may never have heard of PHP, but there is a good chance your company website runs on it. So might your customer portal, your intranet or that old marketing microsite nobody has touched in years. PHP is the programming language underneath WordPress, Drupal and Joomla, among many others.

On October 21, the people who maintain PHP told everyone who runs it to update immediately.

What happened

On October 21, 2026, the PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities that can allow unauthenticated remote code execution. In plain terms, an attacker may be able to run their own code on your web server without a password or account. The project rated both flaws 9.2 out of 10 on the standard severity scale and was blunt about the fix: “There are no complete mitigations, updating is the only safe choice.”

The flaws, nicknamed PHP2Shell, were found by the security firm Wiz. Wiz says PHP powers about 70% of the world’s websites and that it demonstrated the attack against WordPress, Drupal and Joomla. Because the weakness is in PHP itself, applications with secure code can still be affected. A well-built website is not protected by being well built.

Details leaked a day early, and the PHP project moved its release up to October 21 in response. By the afternoon of October 21, a security research firm had reported active exploitation attempts. Amazon’s security team now says the flaws are being broadly exploited in the wild, though it notes it is unclear whether those attempts would have succeeded on real systems. Assume attackers are trying.

In the US, CISA strongly urges organizations to patch immediately, prioritizing internet-facing systems. The UK’s National Cyber Security Centre has urged organizations to update to the latest fixed version, and says that if updating and the temporary workarounds are not possible, consider taking the system offline.

Old versions are the bigger problem

PHP 8.1 and older no longer receive updates from the PHP project. Some hosting companies and software vendors provide their own fixes for older versions, but you will need to ask. If your site runs an unsupported version and nobody is providing fixes, the honest answer is to upgrade or take it down. CISA says the same: systems running PHP 8.1 or earlier should be taken offline until they are updated.

Even PHP 8.2, which did get today’s fix, reaches end of life on December 31, 2026. After that it gets no security fixes at all.

Who is responsible for fixing it

In a mid-sized company, the answer is rarely “us.” It is usually one of these:

• Your web host, if you use managed WordPress or shared hosting. Your host may update PHP for you, but confirm it.
• Your web agency or developer, if they built the site on their own server or a cloud account.
• Your managed service provider, for anything running on your own servers.
• Your software vendors, for products that include PHP inside them. The NCSC specifically advises watching for updates from vendors of appliances and services that may bundle PHP.

The risk is in the gaps: the site built by an agency you no longer use, or the server everyone assumed someone else was patching.

What to do this week

1. List every website and web application you own. Include the old ones: campaign microsites, event registration pages, a test site an agency set up years ago.
2. For each one, name who patches it. If the answer is “not sure,” that is your highest priority.
3. Ask for written confirmation that each site is on a fixed version (8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor version that includes the fix), and the date it was updated.
4. Retire what you do not need. An unused site cannot be breached if it is gone.
5. Ask for a compromise check. The NCSC advises checking for signs of compromise, such as backdoors, on any system that could not be updated quickly. Because Amazon saw attempts before the fix was released, ask for this check on every site, including ones updated on October 21. If there are signs of compromise, the investigation should also cover possible exposure of credentials, such as database passwords and API keys stored on the server, and any exposed credentials should be changed.
6. Plan the move off PHP 8.2 before the end of the year.

Warning signs to pass to your IT provider

You do not need to read server logs yourself, but it helps to know what your provider should be looking for. Wiz lists these signs of attempted exploitation:

• unusual upload-style web requests followed by memory-limit errors
• repeated server error responses (HTTP 500)
• unusually large or malformed session cookies
• PHP processes restarting more often than normal for no clear reason

Any of these on a site that was not updated quickly is a reason to ask for a closer look.

Questions to ask your web host, agency or IT provider

• Which PHP version is each of our sites running today?
• Has each one been updated to a fixed version, and when?
• Are any of our sites on PHP 8.1 or older, and if so, who is providing security fixes?
• Did you check for signs that anyone exploited these flaws before the update?
• What is your plan for sites still on PHP 8.2 when it reaches end of life on December 31?

Request a vulnerability scan

Not sure whether every site and server is patched? DLG Services can run a vulnerability scan of your internet-facing websites, servers and network equipment, show you anything still exposed to PHP2Shell or other known flaws, and help you work out who needs to fix what.

To ask about a scan, contact us or email robert@dlgservicesinc.com.