PHP2Shell: What Business Leaders Need to Do This Week

What happened

On October 21, 2026, the PHP project released emergency security updates for two critical vulnerabilities nicknamed “PHP2Shell” (PHP security advisory). PHP is the engine behind roughly 7 in 10 websites whose technology can be identified (W3Techs), including every WordPress site. The flaws can let an attacker take over a web server with a crafted web request, without any password, and can also leak sensitive data held in the server’s memory (Wiz Research).

The flawed code had been in PHP for more than a decade. Researchers at Calif, working with OpenAI, and at Wiz each found it independently using AI models. Details leaked before the planned release, and Amazon recorded an exploit attempt as early as October 17 (AWS Security Blog). The US Cybersecurity and Infrastructure Security Agency (CISA) and the FBI have both urged immediate patching. Cloudflare’s CEO reported attack attempts in the millions shortly after the fixes were announced. Confirmed break-ins reported so far appear limited, but patching is urgent.

Does this affect you?

Assume yes if you have any of the following, until your web host or IT team confirms otherwise:

• A public website or blog (especially WordPress, Drupal, Joomla or Magento)
• A customer, patient, supplier or dealer portal
• A web application built with Laravel, Symfony or plain PHP
• Vendor appliances or software with a web-based admin page (PHP is often bundled inside other products)
• PHP websites hosted on Azure App Service, Azure virtual machines, AWS or another cloud

What isn’t affected: Microsoft Fabric, Power BI and other Microsoft-run cloud services. They don’t run your PHP code.

What to do this week

Forward this section to your IT team or web host.

1. Find every PHP site. List all websites, portals and web apps, and who hosts each one.

2. Confirm the fix is applied. Ask:

   Is every PHP runtime serving our sites on PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or on a vendor build that includes the October 21 fix?

   Copy question

   Linux distributions and hosts sometimes patch without changing the version number, so ask for confirmation, not just a number.

3. Update and restart. Update PHP itself, then restart PHP and the web server. Updating WordPress or plugins is not enough (Cloudflare). Rebuild any container images.

4. Handle old versions. PHP 8.1 and older no longer get regular releases. PHP published source-code backports, and some hosts and vendors ship patched builds. Ask your host for one, or upgrade to a supported version. Until then, CISA advises taking those sites offline.

5. Apply PHP’s extra precaution. Set session.upload_progress.enabled = 0 in php.ini or the server/PHP-FPM configuration, not in website code, and restart PHP. PHP suggests this until its next regular release closes a related, unlikely issue that also affects patched versions (PHP, October 23). Normal file uploads keep working; only upload progress bars that rely on this feature stop.

   php.ini or PHP-FPM settingsession.upload_progress.enabled = 0

   Copy

6. If you can’t patch today, put the site behind a web application firewall such as Cloudflare. Cloudflare’s protections are on by default for Free plans, and paid plans should confirm the Managed Ruleset is in block mode. If that isn’t possible, take the site offline. A firewall buys time; it isn’t a fix.

7. Check your backups. Make sure they work and are stored somewhere other than the web server.

How to know if you’ve already been hit

If a site was online and unpatched at any point since October 17, ask your IT team or host to check for:

• New admin or user accounts you don’t recognize
• New or modified .php files in the website folders
• New scheduled tasks (cron jobs)
• PHP processes launching command shells or downloading files
• Bursts of “memory limit” errors and repeated server (HTTP 500) errors
• Unusually large or garbled session cookies (PHPSESSID)

Patching stops new attacks but doesn’t remove an attacker who is already in. Because these flaws can leak passwords and API keys from memory, rotate credentials used by exposed sites. If you find signs of compromise, the FBI asks you to isolate the system, preserve web server and PHP logs, and report it to your local FBI field office or ic3.gov.

Notes for your sector

Manufacturing

Check supplier and dealer portals, product catalogs and vendor equipment with web dashboards. A compromised portal can expose credentials that connect to ERP or other business systems.

Healthcare

Check appointment and intake forms, patient portals and practice websites. If patient information may have been accessed, the HIPAA Breach Notification Rule may apply, with notice due no later than 60 days after discovery. Involve your privacy officer and counsel early, and preserve logs.

Public sector

CISA’s alert is the baseline for state and local agencies: patch immediately, and take unsupported PHP offline. As of October 23 the flaws aren’t on CISA’s Known Exploited Vulnerabilities list, so no federal patch deadline has been set. Watch for that to change.

What this tells us about AI and security

CNBC reports that some in the industry are calling this “Black October.” AI helped researchers find flaws that had sat in plain sight for years, and attackers have access to similar tools. The lesson isn’t panic; it’s pace. The window between discovery and attack is shrinking. Organizations that know what they run, have a named owner for every system and can patch within days will handle the next one far better.

The same AI that speeds up attackers also helps defenders inventory systems, triage alerts and automate routine fixes, and that’s work we help clients build responsibly.

Frequently asked questions

Official guidance

• php.netPHP security advisory (October 21, 2026)
• php.netPHP follow-up notice on session upload progress (October 23, 2026)
• cisa.govCISA alert: Critical vulnerabilities in PHP require immediate patching
• ic3.govFBI public service announcement I-102326-PSA
• blog.cloudflare.comCloudflare: WAF protections against PHP2Shell
• azure.github.ioMicrosoft Azure App Service: PHP critical security release

Disclaimer: This article is general information, not legal or security advice. It reflects publicly available guidance as of October 23, 2026, which may change. Follow official guidance from PHP, CISA, the FBI and your vendors.