Critical PHP2Shell Vulnerability: What Businesses Need to Know

Your business website may look and function exactly as it should, but that doesn't necessarily mean it's secure. Some of the most serious security vulnerabilities exist behind the scenes, in software most business owners never see or think about.

That's the concern surrounding PHP2Shell, a pair of critical vulnerabilities affecting PHP, the software that powers many business websites, e-commerce platforms, and customer portals.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could let attackers run malicious code on vulnerable web servers, potentially exposing sensitive information or disrupting business operations.

Unlike a typical website vulnerability, you can't necessarily fix this issue by updating WordPress or installing a security plugin. It involves the underlying server software, so your hosting provider or IT team may need to take action.

The good news is that security updates are available. The key now is to confirm that the systems supporting your business have been checked and properly patched.

Why Updating Your Website Isn’t Enough

Most business websites rely on two important components: the website itself and the software running behind the scenes.

Your application code is the front-facing website you see every day. That includes your WordPress or Joomla installation, your theme, your plugins, and your content. The PHP runtime engine is the software on the underlying server that actually executes code, pulls data from your database, and delivers web pages to visitors.

When you update WordPress or its plugins, you're maintaining the website, but you're not necessarily updating PHP on the server.

That's what makes PHP2Shell particularly concerning. These vulnerabilities exist in PHP itself, so routine website updates won't resolve them. The underlying PHP software must also receive the appropriate security patches.

If an attacker exploits them, they could run malicious code on an affected server. Depending on the server's configuration, that could lead to stolen information, website disruptions, or unauthorized access to connected systems.

The key takeaway is simple: Keeping your website updated is important, but the software running behind it needs attention, too.

What Systems Are at Risk?

These vulnerabilities affect the PHP runtime itself. These vulnerabilities may affect websites and applications running vulnerable versions of PHP, including those hosted in the following environments:

• Self-hosted or dedicated web servers running PHP.
• Cloud-hosted web applications or customer portals.
• Third-party managed hosting accounts (shared, VPS, or dedicated).
• Internal business applications that rely on a local web server.

Fortunately, resolving the issue is straightforward: the underlying PHP packages on the server hosting your website or application must be patched to a secure, supported release.

What You Should Do Right Now

Most business owners aren't responsible for maintaining web servers, but they should know who is. If your company operates a website, customer portal, or web-based application, now is the time to confirm that the appropriate security updates have been installed.

Here is the exact process you should follow to address this specific issue:

Identify where your web assets live. Determine whether your website or web apps are hosted on an Internal server, a dedicated cloud server, or through a third-party hosting company.

Contact your web host or development agency. If a third party manages your hosting or developed your website, reach out to them directly. Ask them these specific questions:

“Are our servers running a version of PHP vulnerable to “PHP2SHELL”?”

“Has the PHP runtime been updated to the latest patched version?”

“Are automated backups running and verified in case a rollback is required?”

Review Connections to Your Business Network. If your website or web applications connect to internal systems or databases, ask your IT provider to verify that appropriate security controls are in place. These safeguards can help prevent an incident involving your website from spreading to other business systems.

Verify your backups. Ensure you have recent, working backups stored independently of the web server itself. If anything goes wrong during a software patch, a clean restore point eliminates downtime.

Don't assume the issue has been addressed simply because your website is working normally. The safest approach is to confirm with the people responsible for maintaining your systems.

Protecting Your Business Beyond the Website

Downtime and security incidents are expensive disruptions that directly eat into your company's productivity. Even when your website is hosted by a third party, you need to know your business systems are properly maintained and protected.

Ultimately, cybersecurity is about having a clear, repeatable process for verifying that your systems and service providers are doing what they are supposed to do.

If you're unsure whether your systems are protected or need help coordinating with your technology vendors, Directive can help. Contact us at 607-433-2200 to discuss your security concerns.