PHP vulnerability “PHP2Shell”: what website operators should do now
Two critical vulnerabilities in PHP affect millions of websites – from WordPress and online shops to the simple contact form. The BSI (German Federal Office for Information Security) has issued a cyber security warning, and the updates are available. No reason to panic, but a clear reason to act now.
Key points at a glance
- What: two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619), called “PHP2Shell” in the media. Severity 9.2 out of 10 (CVSS 4.0).
- Risk: attackers could execute malicious code remotely and without logging in on web servers running PHP.
- Situation: according to the BSI, no attacks have been confirmed yet, but there are unconfirmed reports of ready-made attack tools.
- Solution: security updates have been available since 21 October 2026. They should be installed without delay.
What does BSI warning level 3 mean?
The BSI rates the situation at level 3 (“orange”), i.e. as business-critical. This is the second-highest level. The BSI assigns the highest level 4 (“red”) when the regular operation of many services can no longer be maintained – most recently, for example, for the Log4j vulnerability (“Log4Shell”) in December 2021.
For you, level 3 means: take it seriously and act promptly – install updates and have someone check whether your website is affected. In most cases, nothing more is needed.
Am I affected?
Any website that uses PHP on the server is affected. These include, for example:
- WordPress, Joomla or TYPO3 websites
- Online shops such as WooCommerce, Shopware or Magento
- Websites with a contact or enquiry form that is sent via PHP
Purely static sites without PHP are not affected. If you are not sure, ask your hosting provider or your web agency.
These PHP versions are secure
| PHP branch | Secure from version |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
| PHP 8.1 and older | no more updates – switch to a newer version |
What to do now
- Web hosting (web space): with classic web hosting, the hosting provider usually installs the updates. Check its status page or customer area to see whether this has been done.
- Check your PHP version: in your hosting provider’s customer area you can see which PHP version your website uses. If it still runs on PHP 8.1 or older, switch to 8.3 or 8.4 and test the site afterwards.
- Your own server (vServer, root server): here you or your IT service provider must update PHP yourselves and restart the web server or PHP service.
- Test functionality: try out contact forms, shop checkout and login once after the update.
- Check for anomalies: unknown files in the web space, new administrator accounts or unusual redirects can be signs of an attack. In that case, please call in a specialist company.
And what does this have to do with insurance?
If an attack happens despite everything, cyber insurance can cover costs for IT forensics, recovery, business interruption or third-party claims – depending on the contract. Important: many cyber insurance policies require in their terms that security updates are installed promptly. Anyone who leaves known vulnerabilities open for a long time risks disputes or reductions in the event of a claim.
That is why the rule is: install the update, note the date and, if necessary, check your own policy terms. What cyber insurance covers and what companies should look out for can be found on our page Cyber security for companies.
Sources
- BSI: Cyber security warning “PHP – Kritische Schwachstellen bedrohen Webanwendungen weltweit” (PHP – critical vulnerabilities threaten web applications worldwide) (version 1.1, 21.10.2026).
- PHP: Release archive 2026 (security release of 21.10.2026).
- CERT-EU: Security Advisory 2026-018 – Critical Vulnerabilities in PHP.
Note: This article reflects the situation as of 22 October 2026 and is for general information purposes. It does not replace IT security advice for your specific website or individual insurance advice. The instructions of your hosting provider or IT service provider and the terms of your insurer are authoritative. KiS – Kontor im Schwarzwald GmbH, insurance broker licensed under § 34d Abs. 1 GewO, Reg.-Nr. D-PS74-61V96-00.
👉 Want to know whether your cyber insurance suits your business? Just get in touch with us – click Request advice