Was Your Website Affected by PHP2Shell? A 5-Minute Check for UAE Business Owners

On 21 October 2026, the PHP project released emergency fixes for two critical security flaws nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619, each rated 9.2 under CVSS v4.0) that let an attacker run code on a web server without logging in, whatever CMS or plugins the site uses. The vulnerabilities affect WordPress, Drupal, Joomla and custom PHP applications alike. Within hours, government web services across Europe and North America, major platforms including the Internet Archive and DeviantArt, and a range of corporate sites went into maintenance mode to patch the flaw before attackers could exploit it.

The scale of this issue is unusual. Every PHP version from the last decade is affected by at least one of the two flaws, back to PHP 5.4, according to security firm Wiz. The vulnerabilities sit in PHP's memory handling, not in WordPress or a plugin, so updating WordPress or plugins alone does nothing. The host or server administrator must update PHP itself and restart the web server. That is why so many organisations, following guidance from CISA, the UK NCSC, CERT-EU and Germany's BSI, took their sites offline until they could confirm the patch was deployed. A large share of UAE business websites run on WordPress and shared PHP hosting, so this matters locally even though no UAE-specific statement has been issued yet. If your site is built on a modern JavaScript stack such as Next.js (which The Digital Agency uses for client projects), it does not run PHP and is not affected.

What the PHP project announced

The PHP project released fixed versions on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Details had leaked a day earlier, and GitHub security advisories went out at about 13:34 UTC on 21 October. PHP 8.1 and older versions are end of life, meaning no official builds exist, though source patches are available for PHP 7.4, 8.0 and 8.1. Users on those versions must check with their operating-system vendor or upgrade to a supported release.

Both vulnerabilities affect PHP serving web requests: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed are all vulnerable. Because the flaws allow unauthenticated remote code execution, an attacker can take over the server without needing any credentials. Researchers at Calif and Wiz found the vulnerabilities in August 2026 using AI models, and Wiz says it confirmed unauthenticated takeover of the latest WordPress, Drupal and Joomla installations in lab tests.

Amazon's MadPot honeypot network logged an exploit attempt on 17 October 2026, four days before the public disclosure, meaning attackers had access to working exploits before the patch was announced. Amazon advised organisations to check for suspicious activity going back to at least 17 October.

How the attacks unfolded and what protection exists

Cloudflare switched on free firewall (WAF) protection for all plans, including free accounts, at 03:02 UTC on 21 October, about nine hours before disclosure. Cloudflare CEO Matthew Prince reported thousands of exploit attempts in the 10 hours before the public announcement, tens of thousands within 45 minutes after, hundreds of thousands within two hours, and millions by the next day. Attackers adapted their payloads to try to bypass the firewall. These are logged attempts, not confirmed successful compromises. Cloudflare stressed that its firewall rules are an extra layer, not a replacement for patching.

CISA issued an alert on 21 October telling organisations to patch immediately, starting with internet-facing systems. If patching was not possible, or if a site ran PHP 8.1 or older, CISA advised taking PHP systems offline until patched. Other national cyber-security agencies echoed the same guidance. As a result, government web services in Finland, the Netherlands (Overheid.nl), France (Interior Ministry sites), Denmark (a national school platform) and Canada went offline or into maintenance, along with Wikimedia support services, the Internet Archive, DeviantArt and several large mobile games in Japan. A maintenance page alone does not mean a site was hacked, only that the organisation followed official advice.

What it means for UAE businesses

If your UAE business runs a WordPress, Drupal, Joomla or custom PHP website, you need to confirm that your hosting provider or IT team has applied the fix. On shared hosting, most businesses cannot update PHP themselves, so it is down to the host. Even if you update WordPress core and every plugin daily, that does not close this vulnerability because the flaw is in PHP, not WordPress.

You also need to confirm the update is installed, not just scheduled. A hosting provider may tell you they plan to patch over the weekend, but evidence shows attackers were active days before disclosure and ramped up within hours of the announcement. Every hour counts. If your hosting provider cannot confirm an immediate patch, or if you are on PHP 8.1 or older with no upgrade path, consider moving the site into maintenance mode until the update is complete, or switching to a provider that has already patched.

Beyond patching, check for signs of compromise going back to 17 October 2026. Look for unknown admin users in WordPress or your CMS, new or changed files in the web root, unexpected redirects, spam pages indexed by Google, or PHP processes that start shells or download tools. If you use Cloudflare or another web application firewall, keep it enabled as an additional layer, but do not rely on it as a substitute for the patch. For businesses evaluating a move away from legacy PHP stacks, our web design practice can help you assess modern alternatives that eliminate this entire class of risk.

The 5-minute check

Call or email your hosting provider or in-house IT team today and ask them to confirm which version of PHP your website is running and whether it has been updated to one of the fixed versions: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Ask them to confirm the update is installed and the web server has been restarted, not that it is planned for later this week. If the answer is unclear, push for a written statement with a completion date and time.

If your site is on PHP 8.1 or older, you are running an unsupported version. Official builds do not exist for 8.1, 8.0, 7.4 or anything earlier. Some operating-system vendors backport security fixes, so ask your provider whether your OS distribution has issued a patch. If not, plan an upgrade to PHP 8.2 or later as an urgent project. Test your site on the new version in a staging environment first, because PHP 8.2 introduced breaking changes that may affect older code.

Review your server and application logs for the period from 17 October onward. Look for unusual POST requests, unexpected PHP errors, new files in /tmp or the web root, changes to core CMS files, new admin accounts, or processes spawned by the web server user. If you find anything suspicious, treat it as a potential breach and engage a forensic specialist. Change all administrator passwords and API keys as a precaution.

Finally, if you do not have a web application firewall in place, set one up now. Cloudflare offers a free tier that provides basic WAF protection. Keep it on even after patching, because the next vulnerability is a matter of when, not if.

If you need help auditing your site, planning a migration off an old PHP version, or moving to a modern, PHP-free stack that removes this risk entirely, get in touch with our team. We can give you a clear plan within days, not weeks.