Live: PHP security flaw PHP2Shell

Live update. Last updated: Wednesday 21 October, 21:08 CEST

Two serious security flaws in PHP are big news today, at SecurityWeek and The Hacker News, among others. PHP is the technology most websites, web applications and webshops run on, including WordPress and WooCommerce. On this page we explain what this PHP vulnerability means for your website, which measures we have taken and how we are monitoring. The newest update is at the top.

“This is big news, but we are on top of it. Every website we manage is being monitored live today. Follow this page for the latest status.”

Justin van Dongen, JKC Media

Latest updates

LIVE

21 October, 21:08: update tonight, more tomorrow

The installation of the PHP update through our hosting partners is still ongoing and will continue tomorrow. Meanwhile, the temporary PHP measures and the extra firewall stay active, and our monitoring stays on. If anything unusual happens, we act right away.

You do not need to do anything. We will update this page again tomorrow by 10:00 at the latest.

21 October, 18:20: installation in progress, working closely with our partners

The installation of the PHP update is still in progress. We are working closely with our hosting partners on the rollout across all servers. In the meantime our team is checking and working on the websites one by one, so that each website runs properly on the new version.

Until then, the temporary PHP measures and the extra firewall stay active and we keep monitoring every website live. You do not need to do anything.

21 October, 17:15: installation still in progress

The PHP update is being rolled out across all our servers, together with our hosting partners. This takes a little time because every server is updated and checked one by one.

Until the update is installed everywhere, the temporary PHP measures and the extra firewall stay active, and we keep monitoring every website live. If anything unusual happens, we act right away.

You do not need to do anything. We post the status here as soon as the installation is complete.

21 October, 15:34: PHP update released

At 15:34, a little earlier than announced, PHP released the official security update. It closes both flaws (CVE-2026-109618 and CVE-2026-109619). The fixed versions are:

• PHP 8.2.35
• PHP 8.3.36 (most of our websites run on this version)
• PHP 8.4.27
• PHP 8.5.12

PHP’s own advice is clear: update now. Right after the release we started installing it on our servers, together with our hosting partners. After the installation we check that the websites really run on the new version.

During the installation your website may be unreachable for a moment. Notice anything odd after that? Email service@jkc.media.

For PHP 8.1 and older there is no regular update, only source code for developers who build PHP themselves. That is why we are moving the few websites on older versions to PHP 8.3 today.

We keep monitoring every website live, also after the update, and post the status here as soon as the installation is complete on all our servers.

21 October, 15:15: what we have done so far

Since the news broke this morning, our whole team has been working on this flaw. These are the measures now in place:

• All servers and hosting accounts checked. Since 12:30 we have checked every website we manage for unknown files, new admins and recent changes, including our test and development sites.
• PHP versions in order. Because we update PHP as part of our regular maintenance, almost all our websites were already on a version that gets the official update (8.2 or higher). The few exceptions are being moved today.
• Temporary PHP measures. On our servers we have switched off the PHP feature that this attack abuses (session upload progress) and made sessions stricter. These are the temporary measures security experts recommend.
• Extra firewall. Our servers run a firewall with rules that block known attack attempts on this flaw.
• Live monitoring. We follow all activity on every website we manage live. If anything unusual happens, we act right away.
• Clients informed. We are informing our clients by email today, with a link to this page.

These measures make an attack a lot harder, but only the official PHP update really fixes the flaw. It comes today at 16:00. We install it on all our servers right away and post the status here as soon as that is done.

21 October, 14:50: extra firewall active

Our servers now also run a firewall with rules that block known attack attempts on this PHP flaw before they reach your website. Together with the PHP settings, that gives two layers of protection until the update.

21 October, 13:30: temporary PHP measures active

On all our hosting accounts we have switched off session upload progress in PHP, the feature this attack uses, and made sessions stricter so PHP only accepts sessions it created itself. We checked per website that the settings are really active. This makes an attack much harder.

21 October, 13:15: we monitor every website live

We are following all activity on every website we manage live today. If something unusual happens despite the measures we have taken, we see it in our monitoring and act right away. Right now we see no reason to take websites offline. We therefore do not do that automatically.

Would you rather take your website, application or webshop offline until the fix is installed? That is possible. Email service@jkc.media, and we will arrange it with you.

21 October, 13:00: ready for the update

The PHP security team releases an official update today at 16:00 (14:00 UTC) that closes the flaws. What we have done so far:

• Mapped all websites we manage, including the PHP version each one runs on.
• We keep PHP up to date as part of our regular maintenance, so almost all our websites were already running on PHP 8.3 before this flaw came out. The few still on an older version are being moved to PHP 8.3 today, with a backup first and a test afterwards, so they get the update too.
• We are checking the websites for signs of abuse and keep monitoring them until the update is installed everywhere.

As soon as the update is available, we install it as fast as we can. Next update on this page: expected around 16:30, after the installation.

21 October, 12:30: checking all servers and websites

Right after the news we started checking every hosting account we manage, including test and development sites: which PHP version each website actually runs on, whether new or changed PHP files had appeared in the last few days, and whether any new admin accounts had been created.

20 October, 22:32: PHP announces two critical flaws

PHP announced two critical vulnerabilities, both rated 9.2 out of 10. Details leaked before a fix was ready, which is why the update comes early.

Stay online or go offline: you choose

Stay online (what most clients do)

We have taken extra measures to protect your website while it stays online, and we monitor all websites actively managed by JKC live. If anything unusual happens, we are on it right away.

Go offline for now

Would you prefer your website to go offline until the update is available? That is possible too. We take it offline for now and put it back online once the update is installed. Email service@jkc.media or reply to our email.

What does this mean for your website, webshop or web application?

PHP runs on the server, behind your website. According to security researchers, an attacker could use these flaws to run their own code on that server, without logging in. That could affect your website, your webshop or your web application (for example one built with Laravel), and the data in it. The flaw is in PHP itself, not in WordPress, a plugin or something you did. That is why the fix has to be installed on the server, and that is our job.

What is PHP2Shell?

PHP2Shell is the name for two flaws in PHP, known as CVE-2026-109618 and CVE-2026-109619. More background is in the CERT-EU security advisory. Only supported PHP versions get the official fix.

Which PHP versions get the update?

PHP version	Gets the update?
8.5, 8.4, 8.3 and 8.2	Yes, from 21 October
8.1 and older	No, upgrade needed

Is your website not hosted by us? This is how you check your PHP version:

• WordPress: go to Tools, Site Health, Info tab, Server section.
• Laravel or another web application: ask your developer, or check the PHP settings in your hosting panel.
• Hosting panel (such as DirectAdmin or cPanel): look for PHP version or PHP Selector.
• Not sure? Ask your hosting provider which PHP version your site runs on and whether the PHP update of 21 October will be installed.

Do I need to do anything?

No, if you have a maintenance contract with us or we host your website, we handle it. Noticing anything odd on your website, however small? For example unknown users, pages that look different, strange redirects or emails you did not expect? Email it straight to service@jkc.media or call +31 40 369 0296. We will look at it right away.

Hosting somewhere else? Ask your hosting provider whether the PHP update of 21 October will be installed and whether your site runs on PHP 8.2 or higher. Older versions do not get the update.