A pair of serious security flaws in PHP, the programming language that runs a large share of the world’s websites, became public last week, and attackers moved fast. The flaws have been nicknamed PHP2Shell and are tracked as CVE-2026-109618 and CVE-2026-109619.
If your business has a website, there is a good chance it runs on PHP. WordPress, the most common platform for small business sites, is built on it.
What happened
Business Insider reports that details of the flaw were released earlier than planned, before fixes were widely in place, which left much of the web exposed. 4sysops reports that millions of attempts to exploit the flaws arrived within hours of disclosure, although at that point the PHP Foundation had not seen successful attacks.
That has since changed. The Hacker News reports that attackers have broken in to at least one organisation, a government body in Europe, and within two hours had reached stored password data. Researchers also saw the attackers using AI tools to speed up what they did after getting in.
The flaws themselves are not new. According to 4sysops and Wired, they had been known about for years, and AI-assisted research is what turned them into practical attacks. That is the bigger lesson: old weaknesses are being found and used faster than before, so the gap between a fix being released and attackers using a flaw is shrinking.
What to do this week
- Ask your web host or developer whether the PHP version on your website has been updated for PHP2Shell, and get a yes or no in writing.
- Check any other systems that might use PHP, such as booking tools, customer portals or online shops.
- Update your website platform and plugins, and remove plugins you no longer use.
- Make sure you have a recent backup of your site stored somewhere separate, and know how to restore it.
- Change admin passwords and turn on multi-factor sign-in for your website if it is not already on.
If nobody can tell you who looks after your website’s updates, that is worth fixing now rather than after an incident.
Worried this affects your business? Get a free 15-minute IT check – call Trends IT on 0485 011 911 or visit /contact/.
Sources
- The Hacker News: PHP2Shell exploitation hits government entity amid global scanning and signs of AI-assisted hacking
- 4sysops: PHP2Shell drew millions of exploit attempts within hours
- Wired: The PHP meltdown shows how AI makes bugs more exploitable
- Business Insider: Inside the cyber flaw scramble that brought the AI threat to life