On 21st October 2026 the PHP project released an emergency fix for two critical flaws in PHP, the programming language that runs nearly every WordPress site, and the UK’s National Cyber Security Centre took the unusual step of telling organisations to update immediately, or to take affected systems offline until they can. If we host and manage your website, the most important sentence in this article is the next one: this has already been done for you, and there is nothing you need to do. The rest explains what happened and who does need to act.
What the flaw is
The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, are both rated 9.2 out of 10, which is about as serious as these ratings get. Together they allow what is called unauthenticated remote code execution: an attacker can run their own commands on a server without any password and without being logged in, simply by sending a web request. Because PHP sits underneath the website itself, the flaw can be triggered before your site’s own security has any say in the matter.[1]
The PHP project fixed it the same day, releasing patched versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and its advice is blunt and worth repeating exactly: there is no complete workaround, and updating is the only safe choice.[1] A proof of concept has already been published and the flaw is being probed in the wild, which is why the response this week has been faster and louder than usual.[3]
The NCSC does not often talk like this
The National Cyber Security Centre, the UK government’s authority on these matters, urged organisations to prepare for immediate updating of systems using PHP, and said that where immediate remediation is not feasible, they should consider taking the system offline until it can be fully mitigated.[2] Advising people to switch a system off rather than leave it running unpatched is strong language from the NCSC, and it is the clearest possible signal that this one should not wait for a convenient moment.
If we host and manage your site, this is already handled
Here is where that lands for most of the people reading this, which is calmly. Our platform and our managed services were updated as the fixes were released. Across our shared hosting and our managed cloud, the PHP your website runs on has been patched for you, and because we applied the fixes across every PHP version we offer, including backporting them to older versions, a site running an older PHP branch on our platform is covered too. You do not need to check anything, change anything or switch anything off. The work the NCSC is asking organisations to do is work we have already done on your behalf, which is rather the whole point of being managed.
If you run your own server, please act now
The exception is anyone running a server they manage themselves, such as an unmanaged or self-managed VPS, where keeping the software patched is yours to do rather than ours. If that is you, this is a today job, not a this-week job.
- Update PHP now to the patched version for your branch: 8.5.12, 8.4.27, 8.3.36 or 8.2.35, through your operating system’s or PHP provider’s usual update channel.
- If your server runs cPanel and WHM, cPanel is releasing updated PHP packages through its normal channels, so apply those as soon as they appear.
- If you are on PHP 8.1 or older, which the PHP project no longer supports, the answer is to move to a current, patched version rather than to stay where you are.
- If you genuinely cannot update straight away, follow the NCSC’s own advice and take the system offline until you can, because there is no safe way to leave it running unpatched.
The full technical detail, including the interim measures the PHP project lists for anyone who truly cannot patch immediately, is in its advisory, linked below. If you host a server with us and would like a hand applying this, that is exactly the sort of thing to get in touch about.
The quiet lesson underneath the loud week
A fortnight ago we wrote that a newer PHP version will not make your site faster, and that the real reason to keep PHP current is not speed but support: being on a version that still receives fixes when something like this happens. This week is that argument made real. The sites that will have the easiest few days are the ones already on a supported PHP version with someone whose job is to patch it, and the hardest days belong to the servers running an old version that nobody has touched in years.
Where we come in
If you are a customer and simply want to be sure, you can be: the platform and the sites we manage are patched, and if you would like that confirmed for your specific site, just ask and we will check it for you. If you run your own server with us and want help applying the update, or you are not certain whether a site you own is covered, get in touch and we will work it out with you. On a week when the official advice is to switch things off, the nicest position to be in is the one where someone has already switched the right thing on.
Related reading
- Your host will tell you a PHP upgrade makes your site faster, and the benchmarks disagree
- Two breaches came through the other thing on the server. Time to audit your VPS
Sources
- PHP security releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (CVE-2026-109618 and CVE-2026-109619), the PHP project, 21st October 2026.
- Critical security issue affecting PHP, National Cyber Security Centre, 21st October 2026.
- PHP2Shell: critical PHP vulnerabilities patched, update now, Help Net Security, 21st October 2026.
