CybersecurityNews

PHP2Shell: What BC Clinics and Offices Should Do This Week

Nexanova Systems6 min read

On October 21, 2026, PHP's security team released fixes for two critical flaws in PHP, the programming language behind most of the web. The flaws, CVE-2026-109618 and CVE-2026-109619, can let an attacker run their own code on a web server without logging in. Anything your office relies on that runs PHP needs one of the fixed versions (8.5.12, 8.4.27, 8.3.36 or 8.2.35) or a patch from its vendor, this week.

Both flaws are rated 9.2 out of 10. Wiz, one of the security firms that reported them, named the pair "PHP2Shell", and the official records credit OpenAI with finding them. The FBI's Cyber Division has urged organizations to update now, and to take a system offline if it can't be updated right away.

What is PHP2Shell, in plain terms?

PHP runs about 69% of websites whose server-side language is known, according to W3Techs. It also sits behind plenty of business tools you open in a browser.

The two flaws are in how PHP handles memory from one web request to the next. PHP's advisory says the risk covers "all PHP installations serving web requests". It's highest on servers running Apache with mod_php, where a working attack has been shown to run before any of the website's own code does.

PHP's release notes put the fix plainly: "There are no complete mitigations, updating is the only safe choice."

Where does PHP run in a typical office?

Probably in more places than you'd guess. The website is the obvious one. In a small practice or office, it also turns up in:

  • client or patient portals, booking pages and intake forms, especially self-hosted ones or ones from a small vendor
  • an intranet, wiki or file-sharing server (Nextcloud, for example)
  • some firewall admin pages (pfSense and OPNsense are written in PHP)
  • some web hosting control panels and older in-house apps

Vendor products often bundle PHP inside them, including some network appliances and admin consoles, and you usually can't patch those yourself. The Dutch National Cyber Security Centre keeps a running list of affected products.

Cloud software you sign in to, like your practice management or accounting system, is the vendor's to patch. Get their answer in writing anyway.

If your firewall's admin page can be reached from the internet, fix that whether or not it runs PHP.

What should you do this week?

If you only have ten minutes today, do steps 1 and 3.

  1. List everything with a web address or a login page: the website, portals, booking tools, file sharing, and firewall or network admin pages. Start with anything the public can reach.
  2. Write down who looks after each one. That might be you, your web host, a software vendor or your IT provider.
  3. Ask each of them, in writing, whether it runs PHP and whether it's been updated for these two flaws.
  4. Update anything you run yourselves. Linux distributions often patch PHP without changing the version number, so check your distribution's security notice as well as the number.
  5. If something can't be updated yet, take it offline or limit who can reach it. PHP's advisory lists temporary settings that reduce exposure, and it says they don't make a server safe.
  6. Watch for warning signs: new admin accounts, files nobody added, or a web server doing things it shouldn't, like PHP starting a command shell or downloading files.

To ask a vendor or host, you can send this:

Hi, does [system or website] run PHP? If so, has it been updated for CVE-2026-109618 and CVE-2026-109619 (PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor patch), and on what date?

If you find signs of a break-in, don't wipe the server. Disconnect it from the network, keep its web server and PHP logs, and call your IT provider. In Canada, incidents can be reported to the Canadian Centre for Cyber Security. If client or patient information may be involved, talk to your privacy officer about your obligations under BC's PIPA. Law firms also have a duty under Law Society of BC Rule 10-4 to notify the Law Society if records may have been accessed without authorization.

If you'd rather hand this off, book a free 15-minute assessment. We'll find what runs PHP in your office and who needs to patch it.

What about PHP 8.1 and older?

PHP 8.1 and older no longer get official releases, so there's no new version for them. PHP did publish minimal source-code fixes for 7.4, 8.0 and 8.1, for teams that build PHP themselves, and some Linux vendors with long-term support patch older versions too. W3Techs counts about a third of PHP websites still on PHP 7 or older. For most of those, this is the push to upgrade.

Upgrading PHP can break an older website, so test the upgrade on a copy first.

Frequently asked questions

Is PHP2Shell being exploited yet?

Not confirmed yet. As of October 22, 2026, neither flaw is in CISA's Known Exploited Vulnerabilities catalog, and CERT-EU says exploitation hasn't been confirmed. CERT-EU also reports that early proof-of-concept code has started circulating, which makes real attacks more likely. Don't wait for the confirmation.

Our web host says it's patched. Are we done?

For that website, probably. Ask which PHP version it runs now. Then work through the rest of your list, because the website is rarely the only thing running PHP.

Does this affect our laptops or Microsoft 365?

Not directly. The flaws are in PHP running on web servers. A PHP-based tool you open in your browser still counts, because the PHP runs on its server.

Is our WordPress site affected?

WordPress runs on PHP, so the site is exposed if its server runs an unpatched version. Updating WordPress or its plugins won't fix it. The PHP underneath has to be updated, usually by your host. Our sister studio, Nexanova Designs, has a guide to checking a WordPress site.

Can a firewall rule protect us instead?

Not completely. PHP's security team says there are no complete mitigations and that updating is the only safe choice. Limits on request size at your web server or proxy can lower the risk while you schedule the update.

Sources

Need help with your practice's IT?

Book a free 15-minute assessment. We'll review your current setup and give you practical next steps.

Book a 15-Minute Assessment
← Back to all posts