For the past few days we keep hearing the same question: is my website affected by PHP2Shell? For most of our clients, the short answer is no. We want to take the time to write down the longer answer here, because PHP2Shell is serious and a lot of websites out there really are at risk right now. We'll explain what's behind the vulnerability, why our sites are built differently and what you should do if your website runs on PHP.
PHP is a programming language that a huge part of the internet runs on. WordPress, Joomla, Drupal, Shopware, Magento and countless custom built sites use it. When someone visits your website, PHP assembles the page on the server and sends it to the browser.
PHP2Shell is the nickname for two security flaws in PHP itself. Not in a plugin or a theme, but in the language underneath. Officially they're called CVE-2026-109618 and CVE-2026-109619. Both were rated 9.2 out of 10, which counts as critical. The name pretty much says it all: in the worst case an attacker can get a shell, meaning they can run their own commands on your server. And they don't need to log in anywhere first.
On top of that, researchers showed how parts of the server's memory can be read out. Sometimes that memory holds passwords, database credentials or API keys. So even if an attacker doesn't take over the whole server, they can get hold of data that should never leave it.
Normally these things follow an orderly process. Someone finds a flaw, reports it to the developers, they build an update in peace, and only then does the flaw go public. With PHP2Shell that went wrong. On 20 October, details leaked online before the updates had been rolled out. PHP then released emergency updates very quickly.
According to Cloudflare, the first attacks are already scanning for vulnerable servers. That means you can't push this to next week. Automated tools are crawling the web right now, and they don't care whether your website is big or small.
As things stand, practically every PHP installation that serves web pages is affected, whether it runs through Apache, PHP FPM, LiteSpeed or something else. How easy the flaws are to exploit depends on how the server is set up. But nobody should count on that.
Now for the part that should put a lot of our clients at ease. For some time now we've been building websites almost exclusively with JavaScript, specifically with Next.js and React. There simply is no PHP running on these sites. And where there's no PHP, there's no PHP vulnerability to exploit.
Then there's how these sites are delivered. Much of each site is built in advance and served as ready made files from a globally distributed network of servers. There's no classic web space where a program fires up on every visit, and no admin login at wp-admin for attackers to rattle. That makes the attack surface much smaller from the start.
That's no accident, by the way. Cases like this are one of the reasons we rely on Next.js rather than website builders or classic WordPress installations as our default.
To be honest, though: most doesn't mean all. There are a few older projects and sites we took over that still run on PHP. We're taking care of those right now. If you're a client of ours and aren't sure what technology your site runs on, just ask. We'll check and install the update if it's needed.
If your website wasn't built by us, a quick check is worth it. A few signs that PHP is involved:
Many people underestimate that last point. Often the main site has long been rebuilt with modern technology, but a forgotten installation from five years ago is still running somewhere. Corners like that are the most interesting for attackers, because nobody looks after them.
WordPress is the best known system that runs on PHP, and by far the most widespread. A large share of all websites worldwide are built on it, especially for small businesses, freelancers and clubs. That's why PHP2Shell hits WordPress sites particularly often, and it's exactly these site owners who are sending us the most questions right now.
It's important to understand that WordPress itself didn't make a mistake here. The flaw is in PHP, the foundation WordPress is built on. But that also means every WordPress website whose server still uses an old PHP version is affected, no matter how well maintained its theme and plugins are.
For WordPress users, that means in practice:
Many WordPress owners have been putting off the move away from old PHP versions for years, because they're worried something will break afterwards. That worry is understandable. But PHP2Shell is a pretty good reason to tackle it now, and with a bit of experience it's usually done faster than you'd think.
The good news: there are already updates that close both flaws. The safe versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything below those in each line should be updated as soon as possible. Here's the best way to go about it:
One point is causing a lot of confusion, so let's be very clear: updating WordPress or your plugins does not fix PHP2Shell. The problem sits one level deeper, in PHP itself. Of course WordPress and your plugins should still be up to date, but that's a separate job.
According to the security researchers, tweaking individual settings in php.ini isn't a real fix either. It can buy a little time until the update, but it doesn't replace it.
Because attacks started before many servers were updated, it's worth taking a second look after the update. Especially if your website was unprotected for a few days:
That sounds like a lot of work, but for a normal website it's usually done in an hour. And it gives you peace of mind that nobody left a back door that's still open after the update.
We don't want this article to come across as finger wagging. Working with Next.js doesn't make us smarter than anyone else. It's simply a decision that pays off in weeks like this one. WordPress and other PHP systems are perfectly fine for many projects, as long as someone looks after them regularly.
That's exactly where we want to help. Whether your website was built by us, by another agency or by a friend: if you're not sure whether you're affected, or don't know how to get to your PHP settings, just get in touch. For example, we can:
You don't have to sign or book anything for a first assessment. Just send us your website's address and we'll tell you honestly whether you need to act.
PHP2Shell is one of the more serious vulnerabilities of recent years, because it affects so many websites at once and is already being exploited. If you run a website built on PHP, don't put off the update, and take a look afterwards to make sure everything is clean.
For most of our clients, on the other hand, this is a quiet week, because there's simply no PHP running on their Next.js sites. And for everyone else: you don't have to sort this out alone. Get in touch and we'll help you check, update and answer any technical questions that come up along the way.
Unpaid invoice, suspended domain, full mailbox: IONOS customers regularly find forged emails in their inbox. How to recognise them and what to do if you've already clicked.
Read more
The llms.txt is popping up everywhere right now, often together with big promises. We created one ourselves and explain what's behind it, what it can do and where you shouldn't expect too much.
Read more
Since August 2026, the transparency obligations of the EU AI Act apply. Sounds like legal clauses and panic, but for most businesses it's very manageable. We explain what matters.
Read more