Enterfusion Insights

PHP Security Alert: What Your Business Should Check Now

Published October 26, 2026 · Current advisory • Reviewed October 26, 2026

PHP helps run many websites and business tools, including WordPress. You may use it without knowing its name.

What is the current concern?

On October 21, 2026, the PHP team released urgent fixes for two serious flaws, often called PHP2Shell. In affected systems, an attacker may be able to run harmful commands without logging in. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Read the PHP team’s security advisory.

This does not mean every website has been hacked. Risk depends on the software version, setup, and fixes already in place.

What should business leaders ask?

• Where do we use PHP? Check websites, customer portals, and other hosted tools.
• Are the fixes installed? Ask your provider to check the version used by the live website. A WordPress update alone does not update PHP.
• Are there follow-up steps? The PHP team issued a narrower follow-up notice on October 23. Ask IT to review it too.
• Can we update safely? Plan a backup, check that the site’s software works with the update, and test important features afterward.
• Is there any sign of an attack? Updating software and checking for a past intrusion are separate tasks.

The initial fixed releases are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Some operating-system vendors provide fixes in their own packages. Have your provider confirm the correct update for your system and review the October 23 follow-up notice. Security guidance can change as the investigation continues.

Use this review to plan ahead

Enterfusion is helping clients review the software they rely on, compare supported options, and build update recommendations and plans.

A useful plan names each system, its owner, its support end date, and the steps needed to update or replace it. It also sets a time for testing and explains how to recover if an update causes trouble.

That gives your team a clear next step today—and fewer surprises when the next urgent warning arrives.