PHP2Shell: 5 questions for your hosting provider or IT lead
Emergency PHP patches are out for two critical flaws. Here are five practical questions to put to your hosting provider or IT lead today.
What happened and why it affects you too
On 21 October, emergency PHP patches were released for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619). They were covered by Help Net Security and Malwarebytes. These flaws allow a server to be attacked without logging in, and there are reports of the first attack attempts.
This is no reason to panic, but it is a reason to act today. If your website, online shop or company system runs on PHP, you need to know whether the server has the patched version. This article is not a news recap, but five questions you can put to your hosting company or IT lead.
The patched versions are:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
PHP 8.1 and older versions are no longer supported, so they will not receive a patch.
What this looks like in a company
A typical situation: the website was built a couple of years ago by an external developer, the hosting is paid for by the accounts department, and nobody thinks about the server. WordPress plugins are updated, and everything seems fine.
This is where the misunderstanding lies. Updating WordPress or its plugins does not update PHP. PHP is a server-level component, and it is updated by the hosting provider or the server administrator. If nobody has taken responsibility for it, the version can stay unchanged for years.
Old sites are also common: a campaign page, a test environment, an old version of the website. Nobody uses them any more, but they are still running and accessible online.
The solution: five questions
1. Which PHP version is running on my website?
This is the foundation for everything else. You can get the answer from the hosting control panel or from your IT lead. Ask for the exact version number, for example 8.3.35, rather than a vague answer such as "the latest". The more precise the number, the easier it is to compare with the patched versions.
2. Is the patch already installed (not just scheduled)?
The difference matters. "We plan to update this week" means the patch is not there yet. Ask for confirmation that the patched version is already running on the server, together with the exact version number.
If the hosting provider mentions Cloudflare WAF rules, keep in mind that this is only temporary protection, not a patch. It can reduce the risk while the update is being prepared, but it cannot replace it.
3. Does it cover all my sites, including old and forgotten ones?
Write down a list of all the domains and subdomains you own. Ask whether the patch applies to all of them. If the company has several hosting accounts or servers, check each one separately. Old sites that are no longer needed are a good candidate for switching off or deleting.
4. If my version has no patch - what is the plan and the deadline?
If you are on PHP 8.1 or older, the answer will be unwelcome: there will be no patch for that version. You will need to move to a supported version. You also need to check that the website and plugins will work with the new version, as older code sometimes needs adjusting.
Ask for a concrete plan: who will do it, on what date, whether it will be tested in a test environment first, and what happens if something stops working. "Soon" is not a plan.
5. Who is responsible for PHP updates - you or me?
This is the most important question in the long term. With some hosting services the provider updates PHP, with others the customer has to choose the version, and on unmanaged servers it is the administrator. Check the contract or the service description and get a clear written answer. If nobody can name who is responsible, most likely nobody is.
What you get out of it
After these five questions you will have:
- a known PHP version for each site;
- confirmation of whether the patch is installed or only scheduled;
- a complete list of sites, including the forgotten ones;
- a plan and deadline where no patch is available yet;
- clearly divided responsibility for future updates.
The last point is the most valuable. This incident will pass, but the next critical patch will appear sooner or later. If responsibility is already assigned, next time you will not have to look for someone to blame, only check that the work has been done.
Where to start
Use this short sequence:
- send an email to your hosting provider or IT lead with these five questions;
- prepare a list of all your domains so that nothing is forgotten;
- ask for the answer in writing, with version numbers and dates;
- if the version is PHP 8.1 or older, agree on a migration plan straight away;
- then record who is responsible for PHP updates going forward.
You do not need to be a technical specialist to ask these questions. It is enough to ask them and get clear answers.
Not sure what to ask or how to check? We will help - the first conversation is free.
Sources: Help Net Security, Malwarebytes.