The PHP project released urgent security updates on 21 October 2026 to address two critical vulnerabilities that could allow attackers to run malicious code on affected web servers without logging in. The release has prompted an immediate call for website owners and hosting providers to check their systems and apply the fixes.
The vulnerabilities, collectively known as PHP2Shell, are also attracting attempted attacks. Amazon Threat Intelligence reported an attempt dating back to 17 October, four days before public disclosure, followed by broad exploitation attempts after the fixes became available. Its analysis does not establish whether the observed attempts would have succeeded against real-world systems. Read Amazon’s findings.
For businesses running WordPress or another PHP-based website, the immediate priority is to confirm that the underlying PHP software has received the security fixes. The incident also highlights why website maintenance needs to continue long after a site goes live.
What is PHP
PHP is a programming language that helps websites work behind the scenes. It originally stood for “Personal Home Page”, but its name is now the recursive acronym “PHP: Hypertext Preprocessor”.
PHP supports functions such as processing forms, managing user accounts and retrieving information from databases.
WordPress relies on PHP, which is why WordPress has issued its own notice urging website owners to check with their hosting providers and update promptly.
Which are the vulnerabilities?
The security update addresses two issues:
Involves faulty cleanup of internal request data after an out-of-memory error.
Involves internal state from an earlier request referring to memory that has already been released.
These vulnerabilities can allow hackers to run code without logging in. The links above lead to the PHP project’s technical advisories.
The PHP project says all PHP installations serving web requests are at risk. Fixes were released in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Some providers apply equivalent fixes through their own software packages, so ask your provider to confirm your installation’s status.
PHP 8.1 and older no longer receive regular security updates from the PHP project. If your site uses an older version, ask your provider about a verified backported fix or an upgrade to a supported release that addresses these vulnerabilities.
What should website owners do now
Send your hosting provider or developer this question:
“Has the PHP software running our website received the security fixes released on 21 October 2026?”
Ask them to confirm that the update is active and that important website functions still work. Depending on your site, these could include enquiry forms, customer logins, online payments and booking systems.
Ask your provider to review server logs and check for unexpected file changes or processes, particularly if the site was exposed before patching. Amazon recommends investigating activity from at least 17 October. See Amazon’s response guidance.
The PHP team advises that updating is the only complete solution to these vulnerabilities. However, patching does not remove an existing compromise.
If an affected system cannot be patched promptly, discuss temporary isolation or taking it offline with your provider.
Why ongoing website maintenance matters
Your website needs someone responsible for keeping its software supported, checking backups and testing changes. These jobs are easy to overlook when the site appears to be working normally.
Older websites can become more difficult to maintain. An outdated plugin might stop working after an upgrade, or custom code may need to be updated before the site can run on supported software.
Regular maintenance gives your team a clearer picture of what needs attention and who is responsible for addressing it.
Every platform needs secure development and ongoing maintenance. Your choice of platform should reflect your requirements, budget and the support available to keep it running well.
Rebuilding with an alternative platform
A rebuild is not automatically necessary. If your website still meets your business needs, a PHP upgrade and compatibility fixes may be sufficient. If updates repeatedly expose problems with ageing code, unsupported plugins or limited functionality, it may be time to assess the website’s longer-term future.
For businesses considering a different platform, one option is Umbraco, a content management system built on Microsoft’s .NET technology. It gives your team tools to edit website content, with scope for custom features and connections to other business systems.
TIM Africa provides Umbraco development alongside website design and development.
The right recommendation should reflect your website’s condition, business requirements, budget and ongoing support needs. Every platform requires maintenance.
How TIM Africa can help
We can review your website, help manage PHP upgrades and resolve compatibility issues. We also offer a free website audit to help you identify areas that need attention.
Unsure whether your website is affected? Speak to TIM Africa about checking your current setup and the updates it may need.
Frequently Asked Questions
CVE-2026-109618 and CVE-2026-109619 are memory handling vulnerabilities that could allow attackers to run malicious code on an affected server without logging in.
WordPress uses PHP, so your website could be affected if its server has not received the relevant fixes. Ask your hosting provider to confirm whether your PHP installation has been patched.
The fixes were released on 21 October 2026 in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Some hosting providers supply equivalent patched packages. Your provider should confirm which fix applies to your website.
Updating WordPress, themes or plugins alone does not fix vulnerabilities in PHP itself. Your hosting provider or server administrator needs to update the underlying PHP installation.
A rebuild is not automatically necessary. A PHP upgrade and compatibility fixes may be sufficient. An assessment can help determine whether maintaining your current website or rebuilding is the better option.
Sources
Technical details were checked against the PHP project’s advisories and WordPress guidance. We also reviewed coverage from Cybersecurity News, TechCentral, The Guardian and 2oceansvibe. Sources checked on 23 October 2026.