PHP2Shell: Two Critical Vulnerabilities, One Real Test of Your Dev Team

On 21 October 2026 (AEST), the details of two critical security vulnerabilities in PHP leaked online. Just over a day later, at midnight on 22 October, the PHP team shipped emergency patches. Together the flaws are being called PHP2Shell, and they carry a severity rating of 9.2 out of 10 — about as serious as it gets.

If your business runs a website, an online store, a customer portal, or pretty much any web application built in the last two decades, there's a good chance PHP is running underneath it. So this matters to you, even if you've never heard the word “PHP” in your life.

Here's what actually happened, what it means in plain English, and the one simple question that tells you whether your development team is worth keeping.

What happened, without the jargon

PHP is one of the most widely used programming languages on the internet. It quietly powers a huge portion of the websites and web applications you use every day — including platforms built on WordPress, Magento, Shopware, WooCommerce, and Laravel.

The two vulnerabilities — officially CVE-2026-109618 and CVE-2026-109619 — are what's known as remote code execution flaws. In plain terms: they let an attacker run their own commands on your server without ever logging in. No stolen password required. No tricking one of your staff into clicking a dodgy link. Just a specially crafted request sent to your website.

Worse, the flaw sits deep inside PHP itself — not in your application's code. That means a site could be perfectly well built, with no mistakes by your own developers, and still be exposed. Security researchers confirmed that the malicious request is processed before any of your application's own protections even get a chance to run. Your login screen, your security rules, your careful code — none of it gets a say.

And this wasn't theoretical. Threat intelligence teams reported attackers probing for these flaws in the wild several days before the public even knew, and before any patch existed.

The only real fix is to update PHP to a patched version. There's no clever workaround, no setting you can flip to make the problem go away. You patch, or you stay exposed.

Why you're going to see a lot more of this

Here's the part that should have every business owner paying attention.

This kind of vulnerability has always existed. What's changing is the speed and scale at which they're found and exploited — and the reason is AI.

AI doesn't sleep. It can work around the clock, analysing enormous codebases, hunting for weaknesses, and working out how to exploit them. A task that used to take a skilled human researcher weeks can now be done faster, cheaper, and continuously.

And this isn't a PHP problem. Every programming language, every framework, every platform will face exactly the same pressure. PHP happened to be in the spotlight this week. Next month it'll be something else.

So let's be clear about the wrong response: the answer is not to panic, tear everything down, and switch to a different technology every time a headline appears. No technology is immune. Jumping ship doesn't make you safer — it just makes you slower, and gives you a fresh set of problems to learn.

The right response is far less dramatic, and far more effective.

The real question: is your team already on it?

Technology matters. But the people standing behind it matter more.

When these two vulnerabilities dropped, the clock started immediately. The patch was released at midnight AEST on 22 October. Within hours, every business running PHP had a decision to make — whether they knew it or not. The ones who moved fast were protected. The ones who waited for someone to notice were exposed, with attackers already scanning the internet for easy targets.

This is the honest test of a good development team, and it has nothing to do with how clever their code is:

Did you get an email from your development or hosting team before 9am the morning after a critical vulnerability was announced — telling you that they already knew, they'd already assessed whether you were affected, and they'd already dealt with it?

If yes, you have the right team.

If you found out from a news article and had to forward it to your developers asking “are we affected by this?” — then you don't have a team that's protecting you. You have a team waiting to be told. And in a world where attackers move in hours, that gap is where businesses get hurt.

A good team doesn't wait to be chased. They're already watching for this. They're already working on it. And when it's the middle of the night and a patch has just landed, they're the ones staying up to make sure what keeps your business running stays safe.

What this looked like for us

We're not writing this to boast — but it's the clearest way to show what “good” actually looks like in practice.

The patch landed at midnight AEST. Our team was already working on it from 12am. By 6am, every one of our clients was patched and protected — before most of the business world had even had its first coffee.

It wasn't glamorous. The night included PHP's own download servers buckling under load and returning errors, and parts of the hosting ecosystem struggling under the sudden demand. It was far from the smoothest night's work. But that's the job. When something critical breaks, you don't wait for perfect conditions. You get your clients safe and you sort out the mess as you go.

That's the difference between a team that reacts and a team that's ready.

What you should actually do

You don't need to become a security expert. You need to ask a few straight questions and listen carefully to the answers:

• Do you know every system we run that uses PHP? (If they can't answer this quickly, that's a red flag.)
• How did we hear about PHP2Shell, and when were we patched? (The honest answer tells you everything.)
• What's our process when the next critical vulnerability lands? (There should be a process, not a scramble.)
• Are we on supported, up-to-date versions of the software we rely on? (Out-of-date systems are where attackers look first.)

If those questions get clear, confident answers, you're in good hands. If they get silence, confusion, or “we'll look into it” — that's worth acting on.

The bottom line

Security vulnerabilities like PHP2Shell aren't going away. With AI accelerating how fast they're found and exploited, they're going to arrive more often, with less warning. No technology will save you from that reality.

What will protect you is a team that takes it seriously — one that's already watching, already acting, and willing to stay up all night to protect what keeps your business running.

The technology matters. The people standing behind it matter more.