Critical PHP vulnerability “PHP2Shell”: is your website already secured?
Two vulnerabilities in the PHP core (CVSS 9.2) are being actively exploited. Almost every PHP website is affected, whether WordPress, Joomla, TYPO3 or an online shop.
As of 30 October 2026 · Sources: php.net, BSI, CISA, tagesschau.de
Request a PHP checkOr call us straight away: Bastian Kretzschmar, 089 700742-660
Check, secure, look for traces
The vulnerabilities allow attackers to run their own code on your server without logging in. We check your website, install the updates and verify whether anyone has already broken in.
What has happened since 20 October
Details of the vulnerabilities were published online prematurely, one day before the updates were ready. Since then, attackers and website operators have been in a race. In Germany and worldwide, cities, hospitals and companies have taken their websites offline as a precaution.
Details leaked
Technical details of CVE-2026-109618 and CVE-2026-109619 appear in public.
Updates released, first attacks
php.net releases PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The German Federal Office for Information Security (BSI) issues a level 3 / orange warning.
Another vulnerability, no update yet
CVE-2026-115560 becomes known. A fix is still pending; until then, only the right configuration helps.
Officially listed as actively exploited
The US agency CISA adds the vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue.
End of life for PHP 8.2
After that, there will be no more security updates for 8.2. If you update to 8.2.35 today, you should plan the move to a newer version at the same time.
Am I affected?
Yes, if your website runs on PHP and the PHP version on the server has not yet been updated and restarted. Check your version in the table.
| Your version | Secured from | What to do |
|---|---|---|
| 8.5 | 8.5.12 | Update is enough |
| 8.4 | 8.4.27 | Update is enough |
| 8.3 | 8.3.36 | Update is enough |
| 8.2 | 8.2.35 | Update, plan the switchEnd of life on 31 December 2026 |
| 8.1 and older | no official update | Upgrade requiredonly backports from individual hosting providers and distributions |
This applies to all common systems: WordPress, Joomla, TYPO3, Shopware, Magento, Neos, Drupal, Laravel and custom PHP applications.
What helps now and what doesn’t
Do now
- Bring PHP up to the secured version and restart all PHP processes.
- Update the CMS, shop and extensions at the same time.
- Keep a backup from before 20 October.
- Look for traces, even if the website looks normal.
- Change passwords for the admin area, FTP and database as soon as traces turn up.
Better not
- Assume your hosting provider has already activated the new version without checking.
- Install the update only and skip the search for traces.
- Restore a backup from after 20 October without checking it.
- Stay on PHP 8.1 or older and wait for an update. None is coming.
Signs that someone has broken in
- Unknown PHP files, often in upload or image folders
- New administrator accounts that nobody created
- Modified
.htaccessorindex.php - Unfamiliar redirects or spam pages in Google
- Scheduled tasks (cron jobs) that nobody recognises
- High server load or a lot of outgoing traffic
Not having seen any of these does not mean “clean”. We check the files against the original files of your system.
How we secure your website
Five steps, in this order. With you on the phone or via access you give us.
Take stock
PHP version, operating mode and hosting of every website.
Install updates
Update PHP and restart all processes, at your hosting provider or on your server.
Look for traces
New or modified files, unknown accounts, suspicious processes and access since 20 October.
Migrate legacy systems
For PHP 8.1 and older: a plan for new PHP and CMS versions, usually including an update of TYPO3, Joomla or the shop.
Stay alert
Monitor the vulnerability from 23 October and mitigate it through the configuration until the next update is released.
PHP systems we look after on an ongoing basis
We look after shops and websites built on TYPO3, Magento 2, Shopware 6, Joomla and Laravel. All of them run on PHP; we keep the PHP version, system and extensions up to date.
- TYPO3 · Websites and portals
- Magento 2 · Online shops
- Shopware 6 · Online shops
- Laravel · Websites and applications
- Joomla · Websites
More of our work on our references page.
From our blog: updates and security
What we pay attention to when updating TYPO3, Magento and PHP systems, and how to protect your website against the most common attacks.
Frequently asked questions
My hosting provider takes care of PHP. Do I still need to do anything?
Ask whether the new version is already active. With many hosting providers, you choose the PHP version yourself. If your website is still running on an older version, it will not get the update. We check this for you.
Is the update enough?
It closes the vulnerability. It does not show whether someone exploited it before the update. That is why we look for traces of an attack – especially as the details were public a day before the updates were released.
How can I tell whether my website has been attacked?
Often not at first glance. Typical traces are unknown PHP files, new administrator accounts, unfamiliar redirects or spam pages appearing in Google. We check the files against the original files of your system.
Our website still runs on PHP 7.4. What now?
There are no official updates for PHP 8.1 and older. In the short term, some hosting providers and Linux distributions help with their own fixes (backports). In the long run, there is no way around a newer PHP version – and usually not around a CMS update either. We plan this with you.
What about the vulnerability from 23 October?
CVE-2026-115560 depends on a specific setting and is not yet closed by the updates from 21 October. Until the next update is released, it can be mitigated through the configuration. We check whether your server is affected.
- tagesschau.de (German): Security vulnerability threatens websites worldwide
- php.net: security advisory of 21 October 2026 and notice of 23 October 2026
- BSI cyber security warning on PHP, warning level 3 / orange, 21 October 2026
- CISA: Known Exploited Vulnerabilities Catalog, entry of 26 October 2026
Your contact for PHP security
Bastian Kretzschmar
Dipl.-Math. oec., Managing Director
Phone: 089 700742-660 Phone:089 700742-660
So that updates like these don’t get left undone: website maintenance with updates, backups and monitoring