How to Stay Safe From the Critical PHP Flaw Affecting Websites

The PHP flaw now known as PHP2Shell is not an ordinary website bug. It affects PHP itself, can let an attacker run commands on a vulnerable server without a username or password, and creates a direct route to customer records, login credentials, payment data, and internal business files. The safest response is immediate patching, followed by a careful check for signs that attackers already gained access.

What the PHP flaw means

Security agencies have identified two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell. Each carries a CVSS v4.0 severity score of 9.2 out of 10, and both can enable unauthenticated remote code execution on affected servers.

In practical terms, the PHP flaw can allow someone with no account and no password to execute malicious code on a web server. From there, an intruder may steal databases, alter website content, install backdoors, or move further into a connected network.

The issue is especially serious because it exists in the PHP runtime rather than in a poorly written plugin or theme. A website can follow secure coding practices and still be exposed if the underlying PHP version is vulnerable.

Update PHP immediately

The first and most important step is to update PHP to a patched release. The fixes are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

Website owners should not assume that updating the content management system is enough. The PHP flaw must be addressed at the server, container, hosting platform, and deployment pipeline level. Google Cloud specifically urges operators to update PHP across every server environment, container image, and deployment pipeline.

If you use managed hosting, contact the provider and ask for written confirmation that the server has been updated to a fixed PHP release. If you manage a virtual private server, update the operating system package, restart PHP-FPM or the web server where required, and verify the active version from the command line or a temporary diagnostics page.

Take unpatchable systems offline

Cybersecurity authorities are clear on this point: if a system cannot be patched quickly, disconnect it from the public internet until it can be secured. The U.S. National Security Agency recommends taking affected systems offline when an immediate update is not feasible.

That advice may sound disruptive, but it is proportionate. The PHP flaw can give attackers server-level access without authentication, so leaving a vulnerable public website online creates ongoing risk to users, partners, and the wider network.

For organizations with critical web services, the better option is usually a controlled maintenance window. Restrict access through a firewall, VPN, or IP allowlist, apply the patch, test core functions, and only then restore public access.

Find every place PHP runs.

A common mistake is patching the main website while overlooking older staging servers, backup environments, internal dashboards, APIs, cron jobs, and third-party appliances. The PHP flaw affects any service that runs a vulnerable PHP version, including applications and devices that embed PHP as a component.

Create a simple inventory before patching. Include production websites, development and staging systems, administrative panels, container images, legacy servers, and vendor-supplied software. Internet-facing systems should come first because attackers can reach them directly.

This is also the moment to retire unsupported software. PHP 8.1 and earlier branches do not receive an official fix for these vulnerabilities, so any system still relying on them remains exposed even after other servers are patched.

Look for signs of compromise.

Patching stops future exploitation, but it does not erase evidence of an earlier intrusion. Security teams should review logs for unexpected command execution, unusual file downloads, new administrative users, modified core files, unfamiliar scheduled tasks, outbound connections, and sudden changes to website content.

Pay particular attention to web server logs around the disclosure period. Reports indicate that news of the vulnerability leaked before the official patch was available, and threat intelligence firms observed millions of exploitation attempts soon after the flaws became public.

If compromise is suspected, preserve logs before resetting systems, rotate credentials for databases and administrative accounts, revoke API keys and session tokens, scan for persistence mechanisms, and involve an incident response specialist. Do not simply reinstall the application and assume the server is clean.

Protect data beyond the patch.

A patched server reduces the immediate risk, but strong data protection requires defense in depth. Limit database permissions so the web application can access only the tables it needs. Store secrets in a dedicated secrets manager rather than in publicly readable configuration files. Encrypt sensitive data at rest where possible and use TLS for all data in transit.

Segment the network as well. A public web server should not have broad access to internal file shares, payment systems, employee workstations, or administrative databases. If attackers exploit a PHP flaw on one system, segmentation can prevent them from using that foothold to reach more valuable assets.

Backups also matter, but only if they are isolated. Keep at least one offline or immutable backup, test restoration regularly, and ensure backup credentials are separate from website administrator credentials. This limits the damage if an attacker gains access through the PHP flaw and attempts to encrypt or destroy production data.

What ordinary users should do

Most people do not run PHP servers, but they may still have accounts with websites that do. Change passwords for services that notify you of a breach, enable multi-factor authentication, and avoid reusing the same password across important accounts. These steps reduce the value of any credentials stolen during an attack.

Be cautious with unexpected emails claiming that your account was affected. Attackers often exploit major security incidents to send convincing phishing messages. Go directly to the official website rather than clicking links in an email or text message.

The bottom line

The PHP flaw is urgent because it undermines the basic assumption that a login is required before someone can control a server. Patch to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, remove unsupported PHP installations, isolate anything that cannot be updated, and investigate for evidence of prior compromise.

For organizations, the response should be treated as an incident readiness exercise rather than a routine software update. The PHP flaw is a reminder that the software underneath a website can become the fastest path to its most sensitive information.