PHP2Shell: The PHP Security Scare and What You Should Do About It

PHP is cooked. We're all cooked. What do we do?!

Well, we relax. We massage our earlobes while repeating, "woosah", which helps with neither the PHP issue nor your stress levels. Allegedly.

Don't get me wrong, this is quite a critical security vulnerability and we need to act fast, but it doesn't mean your website is already in trouble. Think of it like keeping your front door closed and locked but the bolt is fragile.

Let's update your locks. This isn't Brisbane in the 90s.

Now, I could do what many tech people are doing, fearmongering you into paying me to fix your site because digital jargon makes everyone need a change of underwear. I will state again, this is a serious security problem that needs a fix pronto, but I'm not going to make this into something it's not.

What the LLM happened?

Ok, that jargon slipped out. In plain words:

• On 20 October 2026, the people behind a programming language that many websites use (PHP) warned the world about two critical security flaws and released an official fix the next day. These flaws were nicknamed, "PHP2Shell", which you may have heard thrown around online.

• The flaws are quite serious and were rated 9.2/10 for their risk. An attacker aware of this vulnerability, which is now everyone and their grandma, could take control of a website's server without logging in. They just need to know how to do it.

• The first known attack was spotted by Amazon and it took place on 17 October.

• Some government services took their websites offline until the fix (referred to as a "patch") was released.

• Attackers are using AI to exploit these vulnerabilities.

How can you exploit this vulnerability?

It's not easy but it's also not difficult. What you do is...

You thought you could trick me, didn't you? Good thing I'm not AI. Move to the next section, please.

It's not just PHP

You will see some tech people shaking their heads at PHP saying, "WordPress is the problem." Some will then try to sell you their other services which have their own security flaws. The reason you don't hear about much of it is that platforms like Wix and Squarespace are private, unlike WordPress and the language it runs on, PHP. This means that when security flaws are exploited and dealt with however long after, you may never hear about it and you’re relying entirely on them to fix it, on their timeline.

This week alone, other than PHP, the following were also hit:

• Node

• Next.js

• GitLab

• QUIC

• Oracle

• LiteLLM

If your site is built on a modern framework like Next.js, it runs on Node, so you weren’t spared either.

I cast fireball! I mean, I have a firewall!

Unfortunately, a firewall will not stop this sort of a vulnerability. Firewalls have to let certain requests through, otherwise no one can visit your website. That's one reason why this vulnerability is rated so high for its risk.

Warning: some jargon will come up, but I will try to explain as best as I can.

A firewall generally allows two ports: 80 and 443. In your URL, you will notice that every website starts with what's called a protocol: either http:// (which generally runs on port 80) or https:// (which typically runs on port 443).

To make sure that people can access your website, those two ports are left open. They're like a front gate to your property. It's left open so anyone can walk up to your front door. That’s the point of a website.

Your server still has a front door security measure. Like I said earlier though, the bolt on that door was fragile. Apply enough pressure on it and it'll crack open.

Here's what you should do right now

Get in touch with whoever looks after your website and ask them the following:

1. Has my hosting been patched for the October PHP flaws?
2. What version of PHP is my site on?
3. When were my plugins, theme and page builder last updated?
4. Does my site use UpdraftPlus? If so, have the UpdraftCentral keys been removed?
5. Has anyone checked my site for signs of tampering, like unknown admin users or unfamiliar plugins and files?
6. Is there a recent backup stored off the server, and has anyone tested restoring it?
7. Probably stop massaging your earlobes if you're still doing that.

What's the solution?

An amazing developer who can fly kick attackers and keep you safe. Digitally speaking, not physically. I tried a karate kick yesterday and almost pulled my glutes.

Here's what I did for my clients:

1. All my clients' websites are cloud hosted on servers that are managed at two levels. The provider and myself.
2. Interim protections were put in place while we waited for a patch.
3. The patch was rolled out across every server the same day it was released.
4. I then checked every website, personally, for any unknown users and unfamiliar plugins or files. Nothing found.
5. Emailed every client to let them know of the measures taken.

If you're not sure if your website is safe and would like someone to give you that assurance, get in touch with me for a quick check. You're welcome to also browse through my Hosting & Website Care packages so you know that if it were to ever happen again, you're taken care of.