This week the tech world is talking about nothing else: PHP2Shell. It is the name given to two critical vulnerabilities in PHP, the language that powers most of the world's websites, including every site built with WordPress, WooCommerce, PrestaShop or Joomla. Spanish media such as El Mundo describe it as a flaw that threatens seven in ten websites. We explain what it is, whether your website is at risk and what needs to be done.
What is PHP2Shell?
They are two flaws in the way PHP manages memory, identified as CVE-2026-109618 and CVE-2026-109619 and rated 9.2 out of 10 for severity. They allow an attacker, with no username or password and with a simple request to the website, to run their own code on the server. In practice, that can mean theft of customer data, malware installation, spam sent from your server or your website ending up redirecting to fraudulent pages.
The PHP team released emergency patches on 21 October 2026, and real attack attempts have already been detected on the internet, some even days before the flaw was made public.
Is my website at risk?
Practically any website running on PHP is vulnerable until it is updated. These are the patched:
- PHP 8.5.12 or later
- PHP 8.4.27 or later
- PHP 8.3.36 or later
- PHP 8.2.35 or later
If your website uses PHP 8.1, 8.0, 7.4 or earlier, the problem is bigger: those versions no longer receive official updates, so there is no patch to install. The safe solution is to move to a modern version and check that the website still works with it.
What we have done with our clients' websites
As soon as the patches were released, we updated the server where we host and maintain our clients' websites to the patched versions. We then reviewed, one by one, the websites still running old unsupported versions: those that could be upgraded now run on PHP 8.3, after checking that everything (forms, shops, carts) still works, and for those that need a deeper update we have applied the mitigation measures recommended by PHP while we update them.
What we recommend you do today
- Check your PHP version. In WordPress you will find it under Tools → Site Health → Info → Server, or in your hosting panel.
- Update PHP to one of the patched versions. If your hosting provider does not do it automatically, ask them today.
- Make a backup before changing anything and check the website afterwards: some plugins, themes or old installations may fail with new PHP versions.
- Update WordPress, plugins and theme. An outdated website is harder to move to a modern PHP version.
- If you cannot update yet, your provider can apply temporary mitigation measures in the PHP configuration, although the PHP maintainers themselves warn that no configuration offers full protection.
Can we help?
If you do not know which PHP version your website uses, your hosting provider does not respond or you are worried that the website will break when you update, at Master Informática we check it for you: we review your website, make a backup, update PHP and verify that everything still works. We serve businesses and professionals in Benalmádena, Marbella and across the Costa del Sol.
Sources: PHP project security advisories (CVE-2026-109618 and CVE-2026-109619), Tenable and El Mundo.
IT maintenance