Tuesday afternoon, I got the kind of heads-up nobody in this business wants to get. Two brand-new security flaws in PHP, the language that powers WordPress and most of the web, were about to go public. And they were as serious as it gets.
Here’s the short version: every website we manage is patched, protected and backed up, and none of them were impacted. You don’t need to do anything.
If you want to know what happened and how we handled it, here’s the full story.
What Is the php2shell PHP Vulnerability?
php2shell is the name for two critical security flaws in PHP (CVE-2026-109618 and CVE-2026-109619) that were made public on Wednesday, October 21, 2026. Both were rated a 9.2 out of 10.0 on the CVSS scale.
In plain English: these flaws could let an attacker run their own code on a web server just by sending it specially crafted traffic. That’s called a remote code execution, or RCE, attack. Depending on the site, an attacker could also crash it or get access to data they shouldn’t see.
They were also “zero-day” vulnerabilities. That means the flaws were known (and, according to Cloudflare, already leaked) before a fix was available to the public.
Which Websites Were Affected?
Almost every website running PHP version 5.4 or later was affected. That includes the vast majority of WordPress sites on the internet.
The flaws are in PHP itself, not in your theme or your plugins. So updating plugins or your website code doesn’t fix them. The fix has to happen at the server level, which is usually your hosting company’s job.
One more catch: older versions of PHP (8.1 and below) are no longer supported, so they won’t receive a patch at all. Sites still running those versions stay exposed until they’re upgraded.
How We Responded: A Timeline
1. Tuesday afternoon: We checked every site’s PHP version. The first question was simple: would our sites even get a patch? Good news: every site we manage was already running PHP 8.3 or higher. Still vulnerable, but in line for the fix.
2. Tuesday afternoon: We contacted our hosting company. We built a plan. The one thing we couldn’t control was timing, since everyone had to wait for PHP to release the patch to the public.
3. Tuesday evening: Cloudflare put up a shield. Cloudflare, which manages DNS for our sites, rolled out new firewall rules to block php2shell attacks before they ever reached the server. That protection covered every one of our sites while we waited on the official patch.
4. Wednesday: Our hosting company was in frequent communication with us on their plan to roll out the patch. Once PHP released the fix, we checked every site hourly to confirm the update had landed. Patches started showing up around 6pm Arizona time.
5. Wednesday at midnight: Every site was patched. No attacks reached our sites. No downtime. No impact.
What Is a Web Application Firewall, and Why Did It Matter Here?
A web application firewall (WAF) is a filter that sits between your website and the rest of the internet. It inspects incoming traffic and blocks requests that look like known attacks before they reach your server.
That mattered a lot this week. There’s always a gap between “we know about the problem” and “the fix is installed.” Cloudflare’s firewall covered that gap. Even before the PHP patch existed, attackers trying to use php2shell were stopped at the door.
Think of it like a locksmith on the way to fix your lock, and a security guard standing at the front door until they get there.
What If Something Had Gone Wrong?
We had a backup plan for the backup plan. Every site we manage is backed up every single day, at staggered times, to three different locations.
Here’s why that matters: if a site were ever compromised, we wouldn’t be starting from scratch. We’d restore a clean copy from before the problem and get you back online fast. Staggering the times and spreading the copies across three places means one bad moment (or one bad server) can’t take out every backup at once.
We didn’t need them this time. But we never want to find out the hard way that we should’ve had them.
What Should You Do Now?
If we manage your website, nothing. We’ve got it covered.
If you have other websites we don’t manage, here’s how to check them:
- Ask your host which PHP version the site runs. Tip: anything 8.1 or below won’t get this patch and needs to be upgraded.
- Ask your host if the php2shell patch has been applied. Remember, updating plugins alone won’t fix this one.
- Check whether the site sits behind a firewall like Cloudflare.
- Confirm you have recent backups stored somewhere other than the server itself.
If any of those answers come back as “I’m not sure,” you’re not alone. That’s exactly the kind of thing we take off your plate.
Is Your Website Ready for the Next One?
Security issues like php2shell are going to keep happening. It’s just a matter of having the right people, the right partners and the right plan in place before they do.
This week, that plan worked exactly the way it should. Your website stayed up, your data stayed safe, and you got to spend your week doing what you love instead of worrying about server patches.
If you have a website that doesn’t have that kind of protection behind it, we’d love to help.
Learn more about our website care plans or reach out to our team.
Source: Cloudflare: php2shell PHP Vulnerabilities and Cloudflare’s WAF Response
