Security news · 23 October 2026
PHP2Shell: a critical flaw in PHP, and what it means for your website
On 21 October PHP released emergency updates for two flaws that let an attacker run code on a web server without logging in. If your site runs on WordPress, Joomla or anything else built on PHP, it is worth ten minutes today.
In brief
PHP2Shell is the name for two flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, rated 9.2 out of 10. They affect almost every PHP version back to 5.4, and with it most WordPress, Joomla, Drupal and Magento sites. The fixed versions came out on 21 October 2026: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Updating PHP is the only complete fix. A site with no PHP on the server is not affected. PB AGENCY in Phuket checks your site for free within 12 hours and, if you prefer, rebuilds it without PHP from ฿3,000, live in 24 hours.
What happened
Two bugs in PHP, not in a plugin
Researchers at Wiz found two bugs in the core of PHP and reported them to the PHP team on 24 August. The fixes and the public announcement followed on 21 October. Because the bugs sit in PHP and not in a plugin or a theme, keeping plugins and themes up to date does not protect a site against them. Wiz demonstrated working attacks against current WordPress, Drupal and Joomla installations.
An attacker who gets through can run their own code on the server. One of the two flaws can also leak server memory, and that memory may hold passwords, access keys and data from other visitors.
Amazon's security team recorded a first attempt on 17 October, four days before the announcement. watchTowr and Cloudflare have reported attacks since. The US agency CISA had not confirmed exploitation when it published its alert, but it tells everyone to patch immediately and to take PHP systems offline if they cannot be updated.
Customer data and the PDPA
Worse if your website has forms
A booking or contact form often keeps what people type into it. If that data sits on a server an attacker can take over, a break-in becomes a data breach under Thailand's Personal Data Protection Act. A breach that puts people at risk has to be reported to the PDPC within 72 hours, and administrative fines go up to ฿5 million.
Hotels, villas and guesthouses
Booking forms with names, phone numbers, travel dates and sometimes passport details.
Clinics, dentists and aesthetic clinics
Appointment requests that mention a treatment or a complaint. Health data is a sensitive category under the PDPA.
Spas and wellness
Bookings, phone numbers and, at some places, a health questionnaire.
Real estate and rentals
Inquiries with names, budgets and copies of ID documents.
Schools and kindergartens
Enrolment and trial-lesson forms with details about children.
Lawyers, accountants and visa agents
Upload forms for contracts, passports and financial documents.
What to do now
Three ways to close it
Ask your host
Ask your hosting company which PHP version your site runs and whether it is now on 8.5.12, 8.4.27, 8.3.36 or 8.2.35. On PHP 8.1 or older there is no official fix: the version has to go up.
Let us check
Send us the address. Within 12 hours we tell you whether the site runs on PHP, what can be seen from outside and what to do next. Free, and nobody will call you to sell anything.
Leave PHP behind
If the site is old, hard to update or nobody looks after it any more, we rebuild it as a static site with no PHP on the server. From ฿3,000, live in 24 hours.
PHP-free rebuild
฿3,000. Live in 24 hours. No PHP to patch.
A static site has no PHP, no database and no plugins on the server, so the next PHP announcement is not your problem. It is also fast, and we build it to be read by Google and the AI answer engines from day one.
Included · ฿3,000
- Your current site rebuilt as one fast page, with no PHP on the server
- Your text and images carried over
- SEO and AI-search basics: meta tags, schema, sitemap
- LINE, WhatsApp, phone and map links
- Domain setup, SSL and one year of static hosting
Modules, ฿2,000 each
- Each extra language
- Each extra page
- Contact or booking form with PDPA consent
Free PHP check
Is your website affected?
Under a minute to fill in. A person looks at your site and you hear from us within 12 hours.
FAQ
Frequently asked questions
If it runs on PHP and the host has not updated yet, very likely yes. Most WordPress, Joomla, Drupal, Magento and Laravel sites run on PHP. On hosted platforms such as Wix, Squarespace or Shopify, the platform runs the servers and is responsible for the update. A static site with no PHP on the server is not affected.
Sources