PHP2Shell: Why SMEs Need to Check Their Website Security Now

A vulnerable business website can become the starting point for a security incident affecting sales, data and operations. Here is what small and medium-sized enterprises need to know.

A customer visits your website to request a quote. Another logs into the customer portal to download a document. An order comes through your online store. For many SMEs, these services are an integral part of everyday work: a security issue can disrupt essential activities and damage customer relationships.

This is where PHP2Shell comes into the picture. The name refers to two critical PHP vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. The PHP project released fixes on 21 October 2026, urging users to update immediately. These vulnerabilities can allow remote code execution without authentication.

In practical terms, an attacker could execute instructions within the PHP process running the website. The consequences depend on that process’s permissions, the server configuration and the isolation between applications: the vulnerability does not automatically mean complete control of the infrastructure, but it can provide a dangerous initial foothold.

PHP2Shell affects the engine that runs the applications. The two flaws involve memory management and internal request state. The risk spans several ways of running PHP on the web; the PHP project considers Apache installations using mod_php particularly exposed, with an attack demonstrated before any application code runs. Updating only the CMS or its plugins does not fix the underlying issue in the PHP runtime.

For an SME, the impact of a potential compromise can take several forms:

• Business disruption: an unavailable website, online store or customer portal, resulting in lost orders and sales enquiries.
• Information exposure: potential access to data and credentials accessible to the compromised application.
• Website tampering: modified content, fraudulent pages or redirects that send visitors elsewhere.
• Recovery costs: urgent technical work, investigations, rebuilding systems and time diverted from normal operations.
• Reputational damage: customers and partners may lose confidence in the company’s ability to protect its digital services.

These are possible scenarios, rather than inevitable consequences for every vulnerable installation. They help explain why checking exposure should be a business priority as well as a technical one.

The first step is to identify where PHP is being used. The inventory should include the main website, subdomains, test environments accessible from the internet and older applications. For each service, the business needs to establish who manages the server and who is responsible for installing updates.

The patched releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. For packages supplied by vendors and operating system distributions, check the relevant security advisory: some fixes are applied through backports, without adopting the same version number as the official releases. For PHP 8.1 and earlier, check whether the vendor provides security coverage and plan a migration to a supported release branch.

Businesses using Docker also need to check the services actually running in their environments. Docker has announced updates to its PHP images: to benefit from the fixes, businesses must deploy the updated images.

The work should include checking essential functions after the update: user login, contact forms, purchases, document uploads and integrations. If there are signs of a possible compromise, remediation should be accompanied by an incident investigation: installing a patch does not remove any access or modifications an attacker may already have established.

A useful question to ask your provider is straightforward: “Have you checked all our PHP services, and can you confirm that those running in production include the fixes for both vulnerabilities?”

For Elsinor, securing digital services means clear responsibilities, verified updates and business continuity. PHP2Shell demonstrates the importance of understanding the technologies a business depends on and having a process in place to respond promptly.

Want to assess your infrastructure’s exposure? Contact Elsinor to review the security of your services and establish your remediation priorities.