RKAZNOn October 20-21, 2026, security researchers disclosed two critical remote-code-execution flaws in PHP — CVE-2026-109618 and CVE-2026-109619, nicknamed "PHP2Shell" by the researchers who found them. PHP itself rated both a 9.2 out of 10 on severity. Within hours, Reuters reported government websites in Europe going offline, and Cloudflare confirmed it was already seeing active exploitation attempts and had to push emergency firewall rules at 3:02 AM UTC to block attacks.
This isn't a niche developer problem. PHP quietly runs a huge share of the web — WordPress, Drupal, Magento, and Joomla are all built on it. Security firm Censys counted roughly 2.58 million internet-facing hosts and 54.9 million web properties running PHP, and estimated close to 70% of those sites need a core software update because of this.
What actually happened, without the jargon
A flaw this severe, in software this widely used, is being compared by researchers at Wiz to Log4Shell — one of the most disruptive security incidents of the last several years, precisely because PHP is embedded inside so many other platforms that patching takes a long time to fully roll out. PHP released fixed versions (8.5.12, 8.4.27, 8.3.36, and 8.2.35) in an emergency, out-of-cycle release on October 21. Anything on PHP 8.1 or older gets no official fix at all — those versions are end-of-life, and Censys found roughly 884,000 internet-facing hosts still reporting that old a version.
The scariest part of a disclosure like this usually isn't the vulnerability itself — it's finding out how many businesses don't actually know what software their own website is running.
The question most business owners can't answer
If you run a website — whether you built it yourself on WordPress, hired a freelancer years ago, or inherited it from someone who's long gone — ask yourself honestly: do you know what PHP version it's running? Do you know if your hosting provider auto-updates it, or if that's been sitting untouched since the site launched? Most business owners genuinely don't know, and that's not a knock on them — it's not their job to know. But it's exactly the gap that incidents like this one exploit.
What to actually do about it
- If you're on WordPress, Drupal, Magento, or Joomla, check with your host or developer about whether the underlying PHP version has been patched — don't assume it's automatic
- If you don't know who manages your hosting/updates, that's the real finding here, independent of this specific CVE — find out before the next one
- A web application firewall (many hosts and CDNs, including Cloudflare, offer this) buys time between a disclosure and a full patch rollout
- If your site is on an end-of-life PHP version (8.1 or older), it needs a real upgrade plan, not just a patch — this isn't the last critical flaw that branch will never get fixed
Why this is really an automation problem, not just a security one
The businesses that scrambled hardest this week weren't the ones without technical skill — they were the ones without a system. No inventory of what's running where, no automatic patch monitoring, no process that flags "this needs attention" before a researcher's disclosure forces the question. That's the same gap we see constantly in operations outside of security too: the cost isn't the one-time fire, it's not having a system that catches the next one before it becomes a fire. If you want to know where that kind of blind spot exists in your own business — not just your website — our business process automation page is a reasonable place to start, or run the numbers on what untracked manual work is actually costing you with our free ROI calculator.