The critical PHP security flaws known as PHP2Shell could allow attackers to run malicious code on a vulnerable web server without a username or password. Security updates were released on 21 October 2026. Businesses with affected systems should apply them promptly. If you rely on a website to take orders, collect enquiries or give customers access to their accounts, ask your hosting company, web developer or IT provider to confirm whether your systems were affected and when they were secured.
That conversation should cover two separate questions. Has the security update been applied to the software your website is actually running? And could someone have gained access before it was applied? The second question matters because a successful update can close the vulnerability while leaving an earlier intrusion undiscovered. If you have cyber insurance, keep your policy’s incident contact details handy in case your technical team finds something suspicious.
What is PHP2Shell and why should businesses pay attention?
PHP is software that runs behind the scenes on many websites. On a WordPress site, for example, PHP helps turn content stored in a database into the pages visitors see. It can also power online shops, customer portals and internal business applications. You may use PHP every day without seeing it mentioned in your website dashboard or hosting bill.
PHP2Shell is the name given to two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The flaws can allow an attacker to execute code remotely on a vulnerable server without logging in. What an attacker could do next depends on the server’s configuration, the permissions available to the affected service and which other systems it can reach.
Consider a local business whose website mainly collects quote requests. The site may look like an online brochure, but those forms could hold names, contact details and information about customers’ jobs. If the website goes down, new enquiries may stop reaching the office. If someone gains access to stored submissions, the business may also have to investigate a possible personal data breach. An online retailer could face a different set of problems, including interrupted orders and uncertainty about which transactions went through before the site was taken offline.
How to find out whether your website is affected
Start with whoever controls the hosting. Your web designer may maintain WordPress and its plugins, while a separate hosting company manages PHP. On a self-managed server, responsibility may sit with your IT team. Ask who owns the update and who will verify it afterwards. If several suppliers are involved, give one person in your business responsibility for getting a clear answer from each of them.
Ask about your main website, online shop, customer portal and any staging or test sites that can be reached from the internet. Mention old domains or websites retained after a redesign. A forgotten copy can still run on a server and may contain customer information or share credentials with another service. Ask your IT team to include internal PHP applications in its checks and to prioritise internet-facing systems.
Which PHP versions contain the fix?
The following are the first upstream PHP releases in each branch that contained the fixes. Your provider should confirm that the version it runs is supported and includes the security updates. If it supplies its own patched package, ask it to confirm that the package addresses both CVEs.
| PHP branch | First upstream release containing the fixes |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
PHP 8.1 and older are unsupported by the PHP project. If your provider says an old website depends on one of those versions, ask for a timetable to move it to a supported release. Where an affected service cannot be patched immediately, ask the technical team to assess whether it should be taken offline until it can be secured.
What to ask your hosting company or web developer today
You can send your provider this message and ask for a written reply.
Please confirm whether any websites, staging sites or applications you manage for us were affected by PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. For each affected service, please confirm when the fix was applied, how you verified that the live service is running the patched PHP version and whether you reviewed logs for the period before it was secured. Please tell us promptly if anything remains exposed or if you find signs of unauthorised access.
The live version is worth checking because a server can have several PHP versions installed. A hosting company could update the software on the server while an individual site continues to use a different version. Your provider should verify the version serving each affected site after any necessary service restart. A WordPress, theme or plugin update is a separate maintenance task.
Once your provider confirms the patch, test the parts of the website that bring in business. Submit a test enquiry and check it reaches the right inbox. If you sell online, ask your team to check the order flow, payment confirmation and any links to stock or fulfilment systems. Record the date, the sites checked and the supplier’s response. If there is a problem later, those details give your technical team and insurer a clearer timeline.
What if the update was applied after the website had been exposed?
Ask your provider what it checked for the period before the fix and whether the relevant logs are still available. A website can look and behave normally even when someone has gained unauthorised access. Your provider may look for unexpected administrator accounts, changes to files, unusual server activity or connections to unfamiliar destinations. Ask it to distinguish between a review that found no suspicious activity and a review limited by missing records.
If your provider finds evidence of suspicious activity, activate your incident response process. Involve the people responsible for IT, data protection and insurance. Ask the technical team to preserve relevant logs and other evidence and decide how to contain the incident. Depending on what it finds, that could involve isolating the affected service, checking connected systems, investigating unauthorised access to a mailbox or replacing exposed credentials. Coordinate any restoration with the people investigating, as rebuilding a server or deleting files can remove evidence they need.
If personal data may have been affected, ask your data protection lead or adviser to assess your reporting obligations promptly. Where a breach is reportable to the Information Commissioner’s Office, notify it without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Keep a record of the assessment and the reasons for your decision. The insurer’s notification process and the ICO’s reporting requirements run separately.
Where cyber insurance fits if a PHP vulnerability is exploited
The cost of a website compromise can extend beyond repairing the site. You may need specialists to investigate how an attacker gained access, establish which systems were affected and help restore them safely. Meanwhile, employees may have to handle orders manually, answer customer questions or reconstruct records. If the incident affects personal data, the business may also need legal advice on its response.
Depending on the policy and circumstances, cyber insurance may help with eligible incident response, forensic investigation, data or systems restoration, business interruption and certain third-party liabilities. Each part of the cover can have its own conditions, exclusions and limits. You can find out more about arranging cover through West Craven Insurance’s cyber insurance service.
Check who you should call and when
If you suspect a compromise, use the incident reporting details in your policy and follow its notification requirements. Ask whether the insurer has a designated response team and whether it needs to approve external specialists or costs. Have the affected website address, the time the issue was discovered, the name of the hosting provider and a short summary of what is known to hand. Keep track of actions and costs as the response progresses.
Ask how the policy treats interrupted trading
Imagine your website is taken offline while the host investigates suspicious activity. Your staff can still answer the phone, but customers cannot place orders online. Check what triggers business interruption cover, whether a waiting period applies, what financial records the insurer would need and how the policy treats an incident affecting a third-party host. The answers can matter just as much to a small online shop as they do to a business running a larger customer portal.
Find out what the policy says about security updates
Check your policy and the information you supplied when arranging it for any requirements about patching, supported software, backups and access controls. If staff work remotely, check whether your security controls cover personal devices and remote access. If a supplier handles those tasks, ask what evidence it can give you that the work was done. If a legacy application prevents you from moving to a supported PHP version, discuss that specific dependency with your broker so you can understand how the policy wording applies to your setup.
What to do once your provider has confirmed the fix
Keep a short list of the websites and online services your business relies on, who maintains each one and how to reach that person urgently. Include the website host, the developer, whoever manages backups and the contact for reporting a cyber incident under your policy. Make sure more than one person can find the list if the usual contact is away or your normal systems are unavailable.
Ask your hosting provider to explain who monitors security advisories, how urgent patches are handled and how it confirms they are active on your site. If a provider handles several parts of your website, establish who will tell you about a suspected incident and how quickly. Those answers give you something concrete to check the next time a security alert appears.
If you are arranging or renewing cyber insurance, tell us which online services bring in revenue, what customer information you hold and which suppliers manage those systems. Think through what would happen if your main website were unavailable for a day or if your hosting provider reported suspicious access to a server. We can help you review how those scenarios relate to the cover you are considering. Speak to West Craven Insurance about cyber insurance.
