PHP2Shell remediation: why businesses should act immediately

Two serious security flaws have been found in PHP, the programming language behind most websites. They’re rated 9.2 out of 10 for severity. They let anyone on the internet take over a web server without a password, and attackers were already trying to exploit them before the flaws were made public.

The riskWhy a fix is urgent

• Attackers are already at work. Amazon’s security systems caught an attack attempt on October 17, four days before the flaws were made public. The NSA has warned that attackers are likely to build tools to exploit them.
• Real damage is happening. Government and public-sector websites in several countries have gone offline, according to the BBC.
• No workaround exists. Because the problem is in PHP itself and not in your website or its settings, the only complete fix is to update PHP.

The catchWhy it’s harder than it sounds

• Updating your website software isn’t enough. Updating WordPress, Drupal, or Laravel doesn’t fix this. The underlying PHP engine has to be updated, and the servers restarted so the fix takes effect.
• You may not know where PHP is hiding. It’s often built into other products, appliances and services, so exposure is easy to miss.
• Older versions are stuck. PHP versions before 8.2 won’t get an official fix. You’ll need a patch from your vendor or an upgrade to a newer version.
• A third, smaller flaw (CVE-2026-115560) has only a temporary configuration workaround until PHP’s next regular release.
• Patching doesn’t clean up an existing break-in. If an attacker already got in, they may have left hidden access or malicious code behind, so systems should also be checked for signs of compromise.

The fixPatched PHP versions

The PHP project released emergency fixes on October 21, 2026. The patched versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, so businesses should move to the latest release on whichever of these branches they use. PHP 8.1 and older no longer get official fixes, so those systems need a patched build from their vendor or an upgrade to a supported version.

StopgapIf you can’t update right away

If an immediate update isn’t possible, your IT team can put interim safeguards in place: lifting PHP’s memory limit, switching off its upload-progress feature, and restarting all PHP workers. These steps reduce your exposure, but they are a stopgap rather than a cure. Updating PHP remains the only complete fix and should follow as soon as possible.

Learn more about PHP2Shell remediation and how Adroitent can help.