PHP2Shell: What Website Owners Need to Know About the Latest PHP Security Vulnerabilities

2020Media | 22 October 2026

Two critical security vulnerabilities affecting PHP, one of the world’s most widely used web programming languages, have prompted urgent action from hosting providers around the world. The issue, being referred to as PHP2Shell, has raised concerns about the security of millions of websites and the challenges involved in keeping older systems protected.

At 2020Media, we are actively responding to the situation, applying available security patches across our hosting infrastructure and reviewing systems that cannot be updated through conventional methods.

For website owners, the important message is that this is a serious security issue, but one that needs to be addressed carefully to avoid creating further problems.

What is PHP2Shell?

PHP is the programming language behind a substantial proportion of the world’s websites, including popular applications such as WordPress, Drupal, Joomla and CiviCRM.

On 21 October 2026, security fixes were released to address two critical vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619.

The concern is that these vulnerabilities could potentially allow attackers to execute malicious code on affected servers without first having to log in. Depending on the server configuration, this could put website files, databases and other information at risk.

Unlike a vulnerability in an individual WordPress plugin or website theme, a PHP vulnerability affects the underlying software used to run the website. Consequently, keeping a website’s content management system updated does not necessarily provide protection against this particular threat.

What is 2020Media doing?

Our technical team is working through a programme of security updates across our hosting infrastructure.

This includes reviewing installed PHP versions, applying available security patches and checking compatibility with the websites and applications running on our servers.

The process is not always as straightforward as installing a single update. Different servers run different operating systems and PHP versions, and some older applications depend on software that is no longer actively maintained.

In particular, older operating systems may no longer receive security updates through their normal package management systems. In these cases, alternative solutions may be necessary, including additional protective measures or migration to a newer server environment.

We are prioritising security while working to minimise disruption to customers.

Why might some websites experience problems?

Security updates sometimes require changes to the software environment in which websites operate.

A website that has been running reliably for many years may depend on an older version of PHP, a discontinued WordPress theme or an application that is no longer compatible with modern server software.

When underlying components are updated, previously unnoticed compatibility problems can become apparent. These may result in website errors, missing functionality or, occasionally, a website becoming temporarily unavailable.

Unfortunately, leaving vulnerable software in place indefinitely is not a safe option. Hosting providers have a responsibility to address serious security risks, even where doing so may expose problems with older websites.

We recognise that any interruption is inconvenient and are working to resolve issues as quickly as possible.

What should website owners do?

Customers can help by ensuring that their websites, plugins, themes and other applications are maintained and supported.

If your website uses an older content management system, a discontinued theme or custom PHP code, it may be worth reviewing whether those components remain compatible with currently supported PHP versions.

We also encourage customers to report any unusual behaviour, error messages or missing functionality that they notice.

Although our team is monitoring the infrastructure, reports about individual websites are particularly valuable. They help us identify compatibility problems, establish which services have been affected and prioritise remedial work.

A wider issue with ageing website technology

The PHP2Shell incident also highlights a longstanding challenge for the hosting industry: websites often remain in service long after the software on which they were originally built has reached the end of its supported life.

A website may appear to work perfectly well, but that does not necessarily mean its underlying technology is secure.

Older operating systems, unsupported PHP versions and abandoned website components can all make responding to newly discovered vulnerabilities considerably more difficult.

Where software can no longer be maintained securely, upgrading or rebuilding may ultimately be the most reliable long-term solution.

What versions of PHP are affected?

The PHP development team released emergency security updates on 21 October 2026. The minimum fixed versions are:

PHP 8.1 and older versions are no longer supported by the PHP project and require particular attention. Some operating system vendors may provide backported security fixes without changing the main PHP version number.

The PHP developers have emphasised that updating to a patched version is the only complete solution. Firewall rules and other protective measures should not be considered substitutes for the security updates.

Our commitment to customers

At 2020Media, protecting our customers’ websites and data remains our priority.

We are continuing to apply available patches, assess older server environments and investigate compatibility issues arising from these updates. Some disruption may be unavoidable, particularly where websites depend on outdated software, but we are working to keep this to a minimum.

We are grateful to customers who have already reported specific issues. Your feedback is helping us direct our response to the areas where it is most needed.

If you experience problems with your website, please contact the 2020Media support team with details of the affected site and any error messages.

We will continue monitoring the PHP2Shell situation and responding to further security developments as necessary.