PHP2Shell: We Patched Every Site the Same Day the Fix Dropped
A critical PHP flaw put millions of websites at risk this week. Every site we host was patched the same day the fix came out.
This week, two critical security flaws turned up in PHP, the programming language that runs a huge share of the web, including every WordPress site on the planet. Security researchers are calling the pair PHP2Shell.
The short version for our customers: every site we host was patched the same day the fix was released. You don't need to do anything.
If you're not hosted with us, or you just want to understand what happened, read on.
What Happened
PHP2Shell is the nickname for two vulnerabilities, officially tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 for severity.
In plain English: an attacker on the internet, without logging in to anything, can send a specially crafted request to a website running PHP and potentially:
Run their own code on the server. That's the "shell" in PHP2Shell. Once someone can do that, they can change your site, plant malware, or use your server to attack others.
Read leftover memory from the server. That memory can contain passwords, login tokens, and API keys.
Two things made this one especially serious:
It's in PHP itself, not a plugin. Most website security news is about one plugin or theme. This flaw lives in the engine underneath them, so it affects nearly every PHP website: versions going all the way back to PHP 5.4, released in 2012.
The details leaked early. The PHP team planned to release the fix on October 22. When information about the flaws started circulating online on October 20, they moved the release up to October 21 at 10:00 AM Eastern. Within hours, Cloudflare and other security companies reported seeing attackers start probing for vulnerable sites.
Researchers have confirmed working attacks against popular PHP applications, including WordPress, Drupal, Joomla, and Magento.
What We Did
When the fixed versions of PHP came out, we got to work right away. By the end of the day, every website on Granite Cloud & Code hosting was running the patched version of PHP:
Custom websites we build and host
WordPress sites on our hosting plans
Laravel applications we maintain
We also confirmed each site was actually running the new version, not just that it was installed. That step matters more than it sounds: PHP keeps running the old code until it's restarted, so a server can have the patch sitting on disk and still be vulnerable.
You didn't get a scary email asking you to update something. You didn't have to log in, click a button, or call anyone. That's the point.
Why "Same Day" Matters
When a serious flaw goes public, a race starts. Attackers start scanning the internet for sites that haven't updated yet, and a lot of sites lose that race simply because nobody is watching.
On cheap shared hosting, you're usually waiting on a company with thousands of servers and a long patching queue. On a do-it-yourself server, you're waiting on yourself, and you may not even know there's a problem. For sites running an old version of PHP that no longer gets updates, there may be no fix at all until the site is upgraded.
Keeping the software under your website patched isn't glamorous work. It's the kind of thing nobody notices when it's done right. But it's a big part of what you're paying a hosting company for, and it's something we take personally.
Not Hosted With Us? Here's What to Do
If your website runs on WordPress, or anything else built with PHP, don't assume you're covered. Today, ask your host or web developer:
"Are our servers running PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 or newer?" Those are the patched versions. (Some hosts patch older versions in a different way, so the numbers can vary. Ask them to confirm.)
"Have the PHP services been restarted since the update?" Installed isn't the same as running.
"What version of PHP is our site on?" If the answer is PHP 7 or older, your site was already running software that no longer gets regular security updates. It's time to plan an upgrade.
If you don't get a clear answer, or you're not sure who to ask, get in touch. We're happy to take a look, and if your site needs a safer home, we can help with that too.
The Bottom Line
PHP2Shell is one of the most serious PHP security flaws in years. If you're a Granite Cloud & Code customer, you're already protected, and you didn't have to lift a finger.
If you're not, now is a good time to find out how quickly your host moves when it counts.
Comments
Sign in to leave a comment.