PHP2Shell: what businesses should do about the critical PHP vulnerabilities

Five questions that turn concern into action

Question	What to establish
1. What uses PHP?	Which websites, applications, appliances and supplier-operated services use it? Which can be reached from the internet?
2. Is the fix running?	Which PHP release or vendor package addresses both original CVEs? Have serving processes picked up the update?
3. What remains exposed?	Where is patching incomplete? What temporary controls and limits apply, and who owns the decision?
4. Does the service still work?	Have important journeys such as login, enquiries, purchases, bookings or learning access been checked?
5. What needs investigating?	What review of the exposure period is appropriate, and who will investigate anything suspicious?

Need an independent view? CyberSolace can help you understand exposure, review supplier responses and decide whether a specialist compromise assessment is appropriate. Talk to CyberSolace.

No dedicated IT provider?

In WordPress, Tools → Site Health → Info → Server shows the PHP version reported to WordPress. Send it and the five questions above to your host. The reported version is a starting point; it may not show whether the supplier has applied a security fix to its own package.

If nobody is clearly responsible for maintaining the server, consider a managed hosting arrangement with explicit responsibilities for updates, monitoring and recovery. WordPress guidance for site owners.

What PHP2Shell could mean for a business

On 21 October, PHP released fixes for the original two vulnerabilities. Both are rated 9.2 out of 10 under CVSS version 4.0. CVSS describes technical severity; it does not by itself measure risk to your organisation. PHP advisory · Palo Alto Networks advisory.

Under relevant conditions, the flaws can allow unauthenticated remote code execution: an attacker could cause a vulnerable server to run instructions without signing in. Depending on the service and permissions obtained, consequences could include stolen information, altered web content or a foothold for a wider attack. Actual impact depends on the system.

A website depends on more than its application

Visitor → Web server → PHP runtime → WordPress or other application → Data

The website owner, hosting provider and application supplier may each control different layers. Updating WordPress does not automatically update the PHP runtime beneath it. Ask who owns, patches and verifies each layer.

Customer portals, learning platforms, subsidiary sites and products that bundle PHP also belong in the inventory. The Dutch National Cyber Security Centre’s product information inventory is a starting point; confirm the current position for each exact product and version with its vendor.

PHP says installations serving web requests include PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. It identifies the highest assessed risk with mod_php, a way of running PHP within Apache. Configuration affects the attack path, but PHP-FPM should not be treated as automatically safe. PHP advisory.

What has been fixed—and what needs checking

These are the first upstream PHP releases fixing both original PHP2Shell vulnerabilities. Use the appropriate fixed release or a later supported release for the relevant branch, following supplier guidance.

PHP branch	First upstream release fixing the original CVEs
8.5	8.5.12
8.4	8.4.27
8.3	8.3.36
8.2	8.2.35
8.1 and older, including 7.x and 5.x	No normal PHP-project security release; check supplier support and plan migration.

Some suppliers backport a fix: they apply a security correction to an older package without adopting the newest upstream version number. Request the exact installed package revision and vendor confirmation that it addresses both original CVEs. PHP · CERT-EU.

Older PHP needs an ownership decision

Where a supported supplier fix cannot be confirmed, plan migration to a supported branch. Until a safe migration is possible, assess isolation and appropriate temporary controls. External version scans can help identify potentially outdated services, but a visible version does not reliably reveal a vendor backport. Censys exposure tracker.

CVE-2026-115560 needs its own check

On 23 October, PHP disclosed a separate issue, CVE-2026-115560. The 21 October releases above do not fix it. PHP says exploitation requires an unusual combination of configuration and application behaviour, and its notice plans a full advisory for the next regular release. At this review we found no newer PHP announcement confirming a fix or complete affected-version list. PHP notice · Canadian Centre for Cyber Security.

PHP recommends operators set session.upload_progress.enabled=0 until the next regular bug-fix release; where this was already applied, keep it in place. Ask your provider to assess applicability, apply the relevant advice, check for any effect on the application and monitor vendor guidance.

This is a temporary mitigation. It does not replace the fixes for the original vulnerabilities or the appropriate later fix for this separate issue.

What the exploitation reports tell us

Confirmed: CISA added both original CVEs to its Known Exploited Vulnerabilities catalogue. That records evidence of exploitation; it is not a finding about any particular organisation.

Reported and independently checked: Dream Research reported a campaign against internet-exposed PAN-OS management interfaces in which attackers combined PHP2Shell with a separate Linux kernel vulnerability to obtain higher privileges. Unit 42 says it independently verified the tooling and confirmed the results. Palo Alto Networks advises restricting management access and applying the appropriate product fixes. Unit 42 · Product advisory.

Unknown for your organisation: Whether your services were vulnerable, exposed or accessed requires an assessment of your own systems and suppliers. The PAN-OS report concerns a specific product and campaign; exposure alone does not prove compromise.

Unit 42’s Xpanse telemetry identified more than 22.6 million exposed instances potentially vulnerable at publication. This is a vendor estimate of potential exposure, not a count of confirmed compromises or necessarily of distinct organisations.

On 25 October, Unit 42 retracted an earlier update after it could not confirm that initial access in an intrusion was associated with these CVEs. The 29 October PAN-OS update concerns the separate campaign described above. Unit 42 update history.

If you cannot patch immediately

Some operators have taken services offline as a precaution. An outage can be a deliberate protective measure; it does not, by itself, establish that attackers caused it. The Guardian’s reporting.

• Patch: Is an appropriate supported fix available, and can it be deployed and verified now?
• Mitigate: If not, which vendor-recommended temporary controls are available, and what risk remains?
• Isolate: If the exposure is unacceptable, should access be restricted or the service taken offline until it can be protected?

The NCSC alert prioritises updating and vendor advice. Temporary measures are not equivalent to a complete fix. If isolation is necessary, identify an alternative contact or service route, a communications owner and the evidence needed before reopening.

Investigate the exposure period

Ask those responsible for monitoring to review the relevant web-server, application, authentication and endpoint logs. Unexpected processes, accounts, files or outbound connections associated with a PHP service may warrant investigation; they can have legitimate explanations and need context. Canadian Cyber Centre guidance.

If suspicious activity is found, move into your incident-response process. Preserve relevant evidence and obtain advice on containment and recovery before indiscriminate clean-up.

Where a personal data breach is reportable under UK GDPR, the ICO says the controller must notify it without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Not every incident or breach is reportable. Separate NIS Regulations duties can apply to organisations in scope. Take specialist advice. ICO data breach guidance · ICO NIS guidance.

UK organisations can also consider the NCSC’s free Early Warning service, which provides notifications of potentially malicious activity identified in available feeds. It complements an organisation’s own monitoring.

Discovery is only the beginning

OpenAI describes a coordinated response involving AI-assisted research, maintainers, providers and public bodies. Its account of a pre-disclosure “defender’s window” is not proof that no attacker had prior knowledge; exploitation has since been reported. For business, the enduring lesson is to know who will find affected services, reach suppliers, authorise urgent changes and verify the fixes.

What changed since 21 October

• 21 October: PHP published fixes for the original CVEs and the NCSC issued an alert.
• 23 October: PHP published its notice about the separate CVE-2026-115560.
• 25 October: Unit 42 retracted an earlier update where it could not establish that initial access was linked to the original CVEs.
• 26 October: CISA added both original CVEs to its Known Exploited Vulnerabilities catalogue.
• 29 October: Unit 42 reported exploitation against exposed PAN-OS management interfaces and independently verified the tooling and results of Dream Research’s campaign.

Assign the five questions

Use this table alongside the five questions to record an owner, evidence and completion time. Copy the table into a working document if a printable record is useful.

Service	Owner	Evidence / status	Completion time
Website or application	________________	________________	________________
Bundled product / supplier	________________	________________	________________
Residual exposure / decision	________________	________________	________________
Service check	________________	________________	________________
Exposure-period review	________________	________________	________________