On 21st October 2026, the PHP project released emergency security updates for two critical vulnerabilities, now widely known as PHP2Shell.
The same day, the UK's National Cyber Security Centre (NCSC) asked organisations to act immediately, warning that the flaws “may allow attackers to execute commands on any web server running PHP”.
WordPress, Magento (Adobe Commerce), Drupal and Joomla all run on PHP, as do many custom sites, integrations and internal tools. Below, we explain what has happened and how we are responding for the brands we work with. If you manage your own PHP systems and need assistance, contact our team today.
What has happened
Both bugs are in PHP itself, in the way it handles memory between web requests. An attacker does not need to log in: under the right conditions, one crafted request lets them run their own commands on the server.
PHP rates both flaws at 9.2 on the CVSS v4.0 scale and says every installation that serves web requests is at risk.
- CVE-2026-109618: an out-of-memory error can interrupt PHP while request data is only partly set up. The clean-up step then treats that invalid data as valid.
- CVE-2026-109619: data belonging to one request can outlive its memory, and a later request on the same worker can pick it up. PHP also lists memory disclosure as a confirmed impact of this flaw.
Details leaked online on the 20th October, a day before the planned release, and PHP brought its fix forward in response. Amazon Threat Intelligence reports an exploitation attempt against its honeypot network on 17th October, four days before a fix existed, and watchTowr, Cloudflare and Amazon have all reported further attempts since.
At the time of writing, no confirmed compromise of a real system had been reported publicly.
Researchers at Wiz showed the attack working against WordPress, Drupal and Joomla, and security firm Calif reports the same against Magento. Wiz also found that an attacker can read server memory without running any code and that this memory may hold passwords, authentication tokens, API keys and certificates.
How we are responding
We became aware of the vulnerability on Wednesday 21st October. Our team assessed the risk across every platform and application we support straight away, agreed a response plan and began rolling out patches from 10am on Thursday 22nd October to protect our clients as quickly as possible.
If we look after your Peracto site, our enterprise-level eCommerce platform, or you use Shopify apps built by Velstar, there is nothing you need to do. We have reviewed these applications and, where needed, updated them.
Shopify itself is not built on PHP, so the core Shopify platform is not affected. Apps that extend a Shopify store are hosted separately and can be built in PHP.
If another supplier looks after your development, apps, integrations or hosting, now is the right time to check your position. Ask them whether they have assessed this vulnerability, when they patched it and how they monitor for the next one.
If you would like to talk through what this means for your site, your account manager or delivery manager can help.
If you manage your own PHP systems
If your site is not supported by Velstar, the NCSC's advice is to act now. In short:
- Find every PHP installation, starting with internet-facing systems and including any software or hosting control panel that bundles PHP. Updating your CMS does not update the PHP version underneath it.
- Update PHP and restart it. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older have no official fix, so plan an upgrade to a supported version.
- If you cannot update straight away, apply the temporary mitigations in PHP's advisory, or consider taking the system offline until it is fixed. PHP is clear that the mitigations are partial and that updating is the only safe choice.
- Check for signs of compromise, going back to 17th October. Because memory can leak without leaving much trace, consider rotating the passwords, API keys and tokens held on any internet-facing server that ran a vulnerable version.
- Ask your hosting provider, app developers and other suppliers whether they have patched.
Full technical detail is in the NCSC alert and PHP's security advisories, linked below. If you would like help assessing your exposure or planning the fix, talk to us.
Security incidents are becoming more common
In the 12 months to August 2025, the NCSC handled 204 nationally significant cyber incidents, up from 89 the year before. The flaw at the centre of PHP2Shell had been in PHP's code for more than a decade, and Wiz credits AI models with helping both to find it and to turn it into a working exploit.
In May 2026 the NCSC warned organisations to prepare for a “vulnerability patch wave”, as AI makes it faster and cheaper to find and exploit long-standing weaknesses in software. Its advice for getting ready includes:
- Reducing what is exposed to the internet and patching those systems first
- Replacing or upgrading technology that no longer receives security updates
- Applying updates by default and as quickly as possible, automatically where you can
- Getting assurance from suppliers, including open source, that they can respond quickly
- Getting the basics in place, such as Cyber Essentials
For an eCommerce business, the useful questions are what you run, who maintains it and how quickly an update can reach your live site. The answers decide whether an issue like this takes hours to close or weeks.
At Velstar, we help eCommerce businesses answer those questions, from platform and hosting decisions to how updates are tested and released. If you are not a Velstar client and want to talk about your site's security, get in touch.
Sources and further reading
- NCSC: Critical security issue affecting PHP
- PHP: security release and mitigation guidance
- PHP security advisories: CVE-2026-109618 and CVE-2026-109619
- NCSC: Preparing for a ‘vulnerability patch wave’
- NCSC: UK experiencing four ‘nationally significant’ cyber attacks every week
- Wiz: PHP2Shell research
- Tenable: PHP2Shell FAQ