ALL NEWS
October 22, 2026

PHP2Shell Vulnerabilities: What Happened and Why Your Website Is Protected

By InnerDigital

PHP2Shell Vulnerabilities: What Happened and Why Your Website Is Protected

On October 21, 2026, security researchers disclosed two serious vulnerabilities in PHP, the programming language behind a large share of the world's websites. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and known together as "PHP2Shell," have drawn wide attention, including alerts from the NSA and the UK's National Cyber Security Centre.

We want our clients to hear directly from us about what this means and what's been done.

What happened

PHP runs behind the scenes on many websites, including platforms like WordPress. The newly disclosed vulnerabilities could allow an attacker to run their own code on an affected web server without permission. Both received a severity score of 9.2 out of 10, and they affect PHP versions going back many years. Because PHP is so widely used, a large portion of the internet is potentially affected, and some organizations have temporarily taken sites offline as a precaution.

The PHP project has released fixed versions (8.5.12, 8.4.27, 8.3.36, and 8.2.35), and hosting providers around the world have been working to apply them.

How InnerDigital websites are protected

Websites hosted with InnerDigital were protected in two stages:

  • Before the official patch was available, server-level protections were applied across our entire hosting infrastructure. These disabled the affected functionality on every supported PHP version, and our web application firewall (WAF) and request filtering began blocking known attack attempts in real time.
  • As of October 22, the full PHP updates have been completed across all of our hosting servers.

What this means for you

If your website is hosted with InnerDigital, your site and its data are protected, and you don't need to do anything. We're continuing to monitor the situation, and we'll contact you directly if anything changes or any action is needed on your part.

Hosting somewhere else? We're happy to check.

If your website is hosted with another provider, or your business runs PHP applications on its own servers, it's worth confirming that those systems have been patched. InnerDigital is offering a free PHP2Shell security review. We'll check whether your systems are affected and help you get them updated if needed. Just reach out to our team to get started.

Our ongoing commitment to security

Responding to events like this is a core part of what we do. As a managed IT and cybersecurity provider, InnerDigital watches for emerging threats around the clock and makes sure our clients' systems are protected before problems reach them.

If you have questions about this vulnerability, your website, or the security of your business systems more broadly, please contact us. We're always happy to help.