Two critical flaws have been found in PHP, the software underneath most business websites. You may not be able to fix this one yourself, which makes knowing who can the first job.

Most businesses in Shropshire do not run their own web servers. Your website sits with a hosting company, or with the agency that built it, and this week that matters.

Two vulnerabilities, nicknamed PHP2Shell, have been published in PHP, the language WordPress, Drupal, Magento and most business websites are built on. Both are rated 9.2 out of 10. Both let an attacker run their own code on your server without needing a password. The NCSC is urging UK organisations to act immediately, and says every version of PHP should be treated as affected, not only the old ones. Attack traffic has already been seen.

This is not a plugin problem, and it is not something you can fix from your own dashboard. The people who run your server have to do it. Your job this week is to make sure they have, and to get the answer in writing.

Ask them three things.

  1. Which version of PHP does our website run on?
  2. Have you applied the fix for CVE-2026-109618 and CVE-2026-109619, either by updating to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or through a backported package from your Linux vendor?
  3. Have the PHP processes been restarted since?

The third is the one people forget, and without it the first two count for nothing. A patch does not take effect until the service is restarted, so a server can be fully updated on paper and still running the vulnerable version in practice.

If you are not sure who hosts your site, check who your domain name is registered with, or look for a small recurring hosting charge on your bank statement. One warning while you are looking: ignore the PHP checker scripts doing the rounds at the moment, as some of them carry malware.

“The version number on its own will not tell you whether you are safe,” says Daly Whyte, founder of Solusec. “Several vendors patched this while leaving the version string looking exactly as it did before, so a site can look out of date and be perfectly fine, or look current and still be wide open. The question to ask is not which version are we on, it is have you applied this fix and have you restarted since. Patching and leaving the old processes running is the mistake I expect to see most over the next fortnight.”

Daly holds the OffSec Web Expert qualification alongside OSCP, CREST Registered Tester and CISSP, and is an IASME Lead Assessor for Cyber Essentials Plus.

Solusec is a cyber security consultancy based at Albrighton and a full member of the Chamber. If you would rather someone put the questions to your host for you, or want to know whether anything has already got in, email This email address is being protected from spambots. You need JavaScript enabled to view it.. No obligation either way.