On 21 October 2026 a critical, actively-exploited vulnerability nicknamed "PHP2Shell" was disclosed in PHP, the software quietly running most small business websites. Here is what it actually means for you.
Published 22 October 2026 · Local Launchpad
PHP shipped an emergency patch on 21 October 2026 for two critical flaws, CVE-2026-109618 and CVE-2026-109619, that let an attacker run their own code on a vulnerable server with no password needed. The Wikimedia Foundation took systems offline as a precaution, the Internet Archive briefly went dark, and government web services in Finland and the Netherlands shut down entirely while they patched. The UK was not spared either.
If organisations that size took it seriously enough to go dark for a while, it is not an overreaction for a dentist's or an accountant's site to take it seriously too. The attack does not check how big you are before it tries the door.
Edinburgh council's website became inaccessible, and so did the online homes for Doctor Who and The Traitors.
PHP2Shell is now being broadly exploited in the wild.
Tens of thousands in the first 45 minutes. Millions now.
PHP's official, installable fix only covers versions 8.2, 8.3, 8.4 and 8.5, the versions still in general support. For anything older, PHP 7.4, 7.0 or 5.6, which is still one of the most common versions on the open web, PHP only published the raw source code of a fix, not a build anyone on ordinary hosting can actually install. For most small businesses, on shared hosting with no way to compile PHP themselves, that is no patch at all. Those versions stopped receiving real security support years ago, and PHP2Shell is exactly the kind of flaw that gets left open.
We are not pitching a new website. Your site stays exactly as it is, same design, same content, same URL. We move what is running underneath it onto a current, patched version of PHP, test that nothing broke, and hand it back working. It is a one-off job, not a subscription.
Exact price depends on how your site is built. We confirm it after a quick look, before any work starts.
Tell us your website address and we will tell you, honestly, whether this affects you and what it would take to fix it.
Email us your website