php2shell PHP vulnerabilities: every site I host is patched

On 21 October 2026, the PHP project released urgent security updates fixing two critical vulnerabilities, nicknamed php2shell and tracked as CVE-2026-109618 and CVE-2026-109619. You may have seen them in the news, or had a worried email from a web designer. This article explains what happened in plain English, and what it means for you.

The short version

If your website or web service is hosted with Live IT, it has been patched. That applies whether I designed your site or someone else did. You do not need to do anything.

What is PHP, and why does this matter?

PHP is the software that quietly runs a huge share of the web, including most WordPress sites, online shops, booking systems and client portals. You will rarely see it, but if your site has a login, a contact form or a content editor, there is a good chance PHP is doing the work behind it.

The two flaws were rated critical (9.2 out of 10). In the wrong circumstances, they could let an attacker run their own code on a web server without needing a username or password. That could mean a defaced website, stolen data, or a server being used to attack others. Security agencies including CISA and ENISA urged everyone running PHP to update immediately.

What I have done

• Updated PHP on every server I host to the fixed releases (8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on the site), or the patched packages supplied for the server's operating system.
• Covered every hosted site, including ones built by other designers or agencies. Patching the server protects the site, regardless of who wrote it.
• Restarted the web services so the fix is actually in use, not just installed.
• Checked each site afterwards to make sure it loads and works as normal.
• Reviewed for signs of misuse, such as unexpected processes or files, and found nothing of concern.

Do I need to do anything?

If you host with me, no. It is still good practice to:

• Keep your website's own plugins and themes up to date, or let me know if you would like me to look after that.
• Use strong, unique passwords and two-factor sign-in for your website admin account.
• Tell me if you notice anything unusual, such as pages you did not create or unexpected admin users.

Hosted elsewhere?

If your website is hosted with another provider, check with them that the PHP updates from 21 October 2026 have been applied. If you are not sure who hosts your site, or you would like it moved somewhere that is looked after properly, get in touch and I will check it for you.

Official sources

• PHP Foundation: today's PHP security release
• CERT-EU advisory: critical vulnerabilities in PHP
• CISA alert: critical vulnerabilities in PHP require immediate patching