PHP2Shell: What Business Owners Should Check Now

Security information checked on 29 October 2026.

If your website uses WordPress, a security update inside its dashboard may not tell the whole story.

WordPress also depends on PHP—the software on the server that helps run the website. WordPress’s own requirements confirm that dependency. This means your website team and hosting provider may both have work to do when a PHP security issue appears. WordPress requirements

The important question is simple: has the software actually running your website received the relevant fixes?

What has changed?

On 21 October, PHP released fixes for two critical vulnerabilities commonly called PHP2Shell. They could allow an attacker to run unauthorised code on an affected server without logging in.

The fixes were released in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Some hosting vendors provide their own patched packages, so a version number alone may not establish whether a server is protected.

Two later notices matter too:

• 23 October: PHP described a separate session-related issue that requires an unusual combination of settings and application behaviour.
• 26 October: PHP released updated Windows packages containing a fix for a Brotli decompression vulnerability. These packages have a “-1” suffix, while the PHP runtime version stays unchanged.

Your technical team should check which notices apply to your actual setup. The later issues have specific conditions; they do not mean every PHP website has the same exposure. PHP’s official October notices

Does this mean our website has been hacked?

No. A vulnerability means a weakness exists. It does not, by itself, prove someone has used that weakness against your website.

Equally, a website that looks normal is not proof that everything is safe. Your homepage might still load while an issue affects an account, a background process or another part of the system.

Avoid drawing conclusions from appearances. Ask for evidence of the update and, where there is a reason for concern, a separate review of possible unauthorised activity.

Four questions to send your website team

You do not need to understand server configuration to ask useful questions:

1. Which PHP package is running our live website, and does it contain the PHP2Shell fixes?
2. Have you checked the follow-up PHP notices from 23 and 26 October against our setup?
3. When was the update applied, and what evidence confirms it is active?
4. Have our important website functions been tested afterwards?

“Hosting is updated” is less useful than a clear answer covering your website, the relevant package and the date checked.

Check the customer journey after an update

Security maintenance should also protect the website’s ability to serve customers.

Ask the team to check the functions your business depends on: enquiry forms, booking steps, checkout, customer login and document uploads, where applicable. Agree how any tests will be identified so they are not mistaken for genuine enquiries or orders.

Keep a short record of what changed, who checked it and any remaining work. This makes the next maintenance discussion much easier.

An update and an investigation are different jobs

Applying a fix addresses the software weakness. It does not automatically establish whether the website was accessed before the fix.

If you notice unfamiliar administrator accounts, unexpected redirects or unexplained changes, tell your technical team promptly. Preserve relevant records and let the team assess the situation before making broad changes that could remove useful evidence.

There is no need to replace a functioning website simply because a security advisory exists. Start by establishing what you have, what applies and what action is needed.

Need help getting a clear answer?

Orangesoft offers a website security evaluation for RM300 plus applicable SST, for technologies we support.

Share your website address and the platform you use, if known. We can confirm suitability and the evaluation scope before you proceed. You do not need to send passwords with your initial enquiry.

The aim is to help you make an informed next decision. If ongoing maintenance is appropriate, we can discuss that after the evaluation.

Enquire About a Website Security Evaluation