Website owners are being urged to patch PHP immediately after researchers disclosed two serious flaws affecting versions released over the past decade.
What happened?
Researchers from Wiz and Calif disclosed two vulnerabilities collectively described as “php2shell”. Under the right conditions, an attacker could exploit them to run code on a vulnerable web server, potentially gaining access to website data and the systems behind it.
The PHP Foundation has released emergency patches. Security agencies and technology providers have advised organisations to update without delay, and to consider restricting or temporarily taking affected services offline if they cannot be secured quickly.
Why this matters
PHP runs a large part of the web, including WordPress and many online shops, portals, and business systems. Because PHP is installed on the server, the fix normally needs to be applied by the hosting provider, server administrator, or managed IT team.
Public reporting also indicates that exploitation attempts increased rapidly after details became known. Patching is therefore only part of the response: administrators should also look for signs that an exposed system may already have been accessed.
What website owners should do now
- Confirm your PHP version. Ask your host or server administrator which version is running and whether the vendor’s emergency fixes have been applied.
- Patch PHP itself. A WordPress core or plugin update is not a substitute for the server-level PHP update.
- Review for compromise. Check web-server logs, administrator accounts, scheduled tasks, and recently changed files for unexpected activity or backdoors.
- Verify backups. Make sure a recent, isolated backup exists and that it can be restored before making major platform changes.
- Reduce exposure if patching must wait. Restrict access or temporarily suspend the affected service where practical, then monitor vendor and NCSC guidance.
Our advice
Do not panic, but do not leave this for a routine maintenance window. Contact whoever manages your hosting and ask for evidence that the PHP runtime—not just the website software—has been updated. If you manage your own server, take a backup, apply the supported patched release, restart the relevant services where required, and then review logs and file changes.
