Customer security briefing | Updated October 22, 2026

Two critical vulnerabilities in PHP, a technology used to run websites and business applications, require immediate attention. Known collectively as PHP2Shell, these flaws could allow an attacker to execute malicious code on an affected server without logging in.

Security updates are available. Businesses should confirm whether they use PHP, identify who owns the update, and verify that affected systems have been remediated. PHP’s security team is urging immediate action. www.php.net

For many organizations, the challenge will be coordinating across internal IT, hosting providers, website agencies, and software vendors. This briefing explains where to start and how Universal Systems can help.

What is happening?

PHP2Shell refers to two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting the underlying PHP software that processes requests for websites and applications.

In plain terms, an attacker could exploit an affected system to run unauthorized code on its server. Depending on the access available to that server, the consequences could include disrupted services, compromised applications, or exposure of sensitive information.

This is an industry-wide software issue. It is not specific to one website platform, hosting company, or IT provider. PHP released security updates on October 21. www.php.net

The urgency goes beyond a theoretical risk. Amazon Threat Intelligence reported exploitation attempts dating back to October 17, before public disclosure, and says PHP2Shell is now being broadly exploited in the wild. aws.amazon.com

Could your business be affected?

PHP supports widely used platforms including WordPress, Drupal, Joomla, and Magento, along with many custom applications. Your business may use it even if nobody on your team works directly with PHP. www.tenable.com

Start by asking about:

• Your public website and ecommerce store.

• Customer, employee, and partner portals.

• Custom applications and internal web tools.

• Software or appliances that bundle PHP.

• Development, staging, and legacy website environments.

Include the systems your business has stopped actively using. Replacing a website does not automatically shut down its old server. An overlooked environment can remain accessible after the business has moved on.

You may also see headlines suggesting that roughly 70% of websites are affected. That figure reflects PHP’s widespread use among websites whose server-side language is known. It is not a verified count of vulnerable or compromised websites. Your organization needs an assessment of its actual systems and patch status. www.tenable.com

What should you do now?

1. Confirm where PHP is running and who owns it

Contact your IT team, hosting provider, or website agency today. Ask them to identify PHP deployments across your environment and confirm who is responsible for remediation.

Website maintenance and server maintenance may sit with different providers. Get a clear answer about who owns the PHP runtime update, including any systems outside your main website.

2. Apply the appropriate security update

The PHP project released the following fixes for supported production branches. Use the listed release or a later security release within the same branch. www.php.net

Some operating system and extended support vendors provide backported fixes. Ask your provider to confirm that its installed package addresses both CVEs. Older PHP branches require vendor guidance or migration to a supported release. www.php.net

Updating WordPress, a plugin, or a theme should not be treated as confirmation that the underlying PHP runtime has been patched.

3. Verify that the fix is actually running

Ask the responsible team to confirm that the updated runtime is serving requests, that necessary PHP processes have been restarted or replaced, and that every application instance is covered.

Then validate important business functions, including forms, customer logins, transactions, and integrations. Document when remediation was completed and identify any remaining exceptions.

A completed update should leave you with a clear record of what changed and which systems were verified.

4. Escalate systems that cannot be patched promptly

If an affected application cannot be updated immediately, work with its owner to reduce exposure. That may involve restricting access, isolating the service, or temporarily taking it offline.

PHP states that interim configuration changes can reduce specific attack paths but do not provide a complete fix. Assign an owner and a firm deadline to any temporary arrangement. www.php.net

5. Review for suspicious activity

Patching closes the vulnerability. It does not remove an intrusion that has already occurred.

Amazon recommends investigating activity from at least October 17. Have your security team review relevant logs, unexpected file changes, and unusual process execution. Preserve evidence and escalate suspicious findings through your incident response process. aws.amazon.com

What to ask your hosting provider or web agency

You do not need to understand PHP internals to ask for a useful status update. These five questions will help:

1. Do any systems you manage for us use PHP, including old sites and staging environments?

2. Have fixes for CVE-2026-109618 and CVE-2026-109619 been applied?

3. Have you verified that the patched software is running across every affected instance?

4. Are there any outstanding systems, temporary protections, or actions required from us?

5. Have you reviewed for suspicious activity, and what period did that review cover?

Ask for a written response so your organization can track completion and follow up on gaps.

How Universal Systems can help

A vulnerability response becomes harder when responsibilities are spread across several providers. Your website agency may manage the application, your hosting company may control the server, and your internal IT team may own access and security monitoring.

USI can help you bring those pieces together.

We can work with your team and relevant providers to clarify which systems need review, establish ownership, prioritize business-critical services, and coordinate remediation and verification.

If you already work with USI, contact your account team so we can confirm which systems fall within your services and where another provider needs to take action. Websites and applications managed separately may require coordination with their hosting company or developer.

If you are unsure whether your business uses PHP, start there. You do not need a complete technical inventory before reaching out.

Talk to a USI expert to review your next steps and get help coordinating your response.