What is PHP2Shell?
PHP2Shell is the name being given to two PHP vulnerabilities announced this week – CVE-2026-109618 and CVE-2026-109619 – which allow any attacker to gain full remote access to a web server without any authentication. With PHP being a widely used programming language in the web industry, this was a critical security issue, with PHP’s own published advisorieson GitHub rating them at 9.2/10 severity.
Patches were released for PHP 8.2, 8.3, 8.4 and 8.5 on October 22, 2026 at 1:00 AM AEDT, but PHP2Shell was reported as being exploited on live websites prior to that time, leading major hosting platforms like AWS to publish their own critical advisories, leading Cloudflare to apply Web Application Firewall (WAF) rules to protect against known PHP2Shell exploits prior to the PHP patch releases, and leading some organisations to take their websites offline until a fix could be applied.
How Spicy Web responded
After PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released, Spicy Web took prompt action to secure our managed services and hosting clients’ websites. Most of the servers we manage were updated to the patched PHP versions the same day. A smaller number host older websites on PHP versions that have reached end of life, which PHP no longer patches. For those, we applied a temporary fix that blocks the main attack route, and we’re working with each client on a permanent solution. Many of these sites also sit behind Cloudflare’s firewall, which adds another layer of protection.
While this progressed, we notified our managed services and hosting clients, to reassure them that we were aware of the issue, and had been taking action to resolve it for their sites.
None of our servers have shown any sign of being attacked, and we continue to monitor them for any suspicious activity.
No further action was needed for our Craft Cloud clients, with Craft CMS developers Pixel & Tonic taking immediate action to apply the patch to the Craft Cloud architecture. This dedicated, proactive action to maintain the security of the sites they host is one of many reasons why we recommend Craft Cloud for reliable hosting.
We’ve done this before
When the critical Craft CMS vulnerability CVE-2025-32432 was patched in April 2025 – fixing an exploit rated as having 10/10 severity on GitHub – our team spent a full day applying the patch for all of our managed services and hosting clients. Earlier this year, when the Australian Signals Directorate's Australian Cyber Security Centre publicised an alert regarding serious vulnerabilities in various CMS platforms, including CVE-2025-32432, our clients were already covered.
Not sure if your Craft CMS site is protected?
If your Craft CMS website is hosted elsewhere, it’s worth checking where it stands. Log in to your Craft control panel and go to Utilities > System Report to see which PHP version it runs. If it’s PHP 8.2 or newer, your host should be able to apply the official patch. If it’s PHP 8.1 or older, there’s no patch coming, and the only lasting fix is to upgrade PHP, which for older Craft sites can mean upgrading Craft as well.
We’re happy to take a look. We can check your site’s PHP and Craft versions, tell you whether it’s protected, and talk you through your options, whether that’s a quick update or a bigger upgrade.
If you’re looking for a reliable partner for a new Craft CMS website, or your existing Craft CMS website’s ongoing hosting and maintenance, get in touch with us.
