--- title: "PHP2Shell: What your IT team needs to know | heureka e-Business GmbH" description: "Are your systems affected by the PHP vulnerabilities? A clear explanation, practical next steps and personal support from heureka." canonical_url: "https://heureka.com/en/resources/blog/php2shell" last_updated: "2026-10-26T00:00:00.000Z" meta: author: "heureka e-Business GmbH" "og:description": "Are your systems affected by the PHP vulnerabilities? A clear explanation, practical next steps and personal support from heureka." "og:image": "https://heureka.com/media/opengraph/resources.webp" "og:image:alt": "Enterprise IT resources and practical guidance from heureka" "og:image:height": "600" "og:image:type": image/webp "og:image:width": "1200" "og:title": "PHP2Shell: What your IT team needs to know" "twitter:description": "Are your systems affected by the PHP vulnerabilities? A clear explanation, practical next steps and personal support from heureka." "twitter:image": "https://heureka.com/media/opengraph/resources.webp" "twitter:image:alt": "Enterprise IT resources and practical guidance from heureka" "twitter:title": "PHP2Shell: What your IT team needs to know" --- > Index of every page on this site: [llms.txt](https://heureka.com/llms.txt) [Back to Resources](https://heureka.com/en/resources) **Blog** 2026-10-26 4 min read Nico Kempe # **PHP2Shell: What your IT team needs to know** Your website is up to date — but is PHP behind it? Learn what to check now and how heureka can help you work through the open questions. *By Nico Kempe, Consultant at heureka e-Business GmbH. Information checked on 26 October 2026.* **“Are we affected — and do we need to act?”** Recent PHP2Shell alerts have put this question on many IT teams' desks. The short explanation: two critical PHP vulnerabilities can, under certain conditions, let attackers run their own code on a server without signing in. Security updates have been available since 21 October. [1](https://www.php.net/archive/2026.php) Three questions matter most for your IT: **Where does PHP run? Are those installations protected? And who is handling anything still outstanding?** If the answers are not immediately clear, that is where we can help. ## What is PHP2Shell? PHP is part of the technology behind many websites, online shops and portals. It works on the server in the background, including within software that users simply recognize as a business application. The two vulnerabilities, **CVE-2026-109618 and CVE-2026-109619**, affect this underlying technology. [1](https://www.php.net/archive/2026.php), [2](https://cert.europa.eu/publications/security-advisories/2026-018/) A practical example: your WordPress website may be fully up to date while the hosting provider's PHP installation still needs patching. **An updated application does not automatically mean PHP has been updated too.** WordPress explicitly recommends checking PHP's status with the hosting provider. [3](https://wordpress.org/news/2026/10/critical-php-security-release/) The potential consequences are serious: attackers could access data, change applications or disrupt services. An application login does not rule out the risk, because some attack paths take effect before the login check runs. A vulnerable version does not, however, prove that an attacker has already compromised the system. [1](https://www.php.net/archive/2026.php), [2](https://cert.europa.eu/publications/security-advisories/2026-018/) ## Why should you address this now? AWS observed attack attempts before the updates were released. Its report leaves open whether those attempts would have succeeded against real systems. [4](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/) In practical terms, **check and update known internet-facing PHP systems promptly.** In parallel, look for applications that might be missed in an initial inventory. For example, a hosting provider may have updated the corporate website while an older test portal or another application remains a different team's responsibility. A statement such as “our website is up to date” should therefore always refer to the specific systems checked. ## What you can do now **1. Start with the applications you know.** List your websites, shops and portals and identify their owners. Ask about internal applications and software that includes its own PHP installation. Building the inventory should not delay necessary updates to systems already identified. [2](https://cert.europa.eu/publications/security-advisories/2026-018/) **2. Ask the operator specific questions.** Instead of asking only “Are we affected?”, ask: which PHP version serves this application? Has the relevant security fix been installed? Has someone verified that the application is running on the updated version? Your internal team, hosting provider or software vendor should be able to answer these questions. [5](https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/) For reference, these are the first fixed PHP versions in the supported branches: [1](https://www.php.net/archive/2026.php) | PHP branch | Security fix from | | --- | --- | | 8.2 | 8.2.35 | | 8.3 | 8.3.36 | | 8.4 | 8.4.27 | | 8.5 | 8.5.12 | Some providers incorporate the fix into their own packages without changing the displayed base PHP version. In that case, verify the relevant security package with the provider. For older PHP versions, agree a supported patching or migration path. PHP also published an additional notice for certain configurations on 23 October; include that in the technical assessment. [1](https://www.php.net/archive/2026.php), [5](https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/) **3. Prioritize and follow up on open items.** Record what has been checked, the supporting evidence and who still needs to act. If an internet-facing system cannot be updated immediately, discuss temporarily restricting access with its operator. CERT-EU recommends considering isolation from public networks until the fix has been applied and verified. [2](https://cert.europa.eu/publications/security-advisories/2026-018/) After patching, verify the application in operation. If there are signs of a previous attack, investigate those separately: installing the update does not remove malicious code already introduced. [5](https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/) ## How we can help You do not need a complete inventory or a finished security assessment for an initial conversation. We work through the information you already have and help clarify: - **Where is action needed?** Which systems should be checked first? - **What information is missing?** What can be verified technically, and where do you need a response from the operator or vendor? - **What happens next?** Who owns each action, and how will its completion be documented? Together with Tenable, we can also use **Tenable One** to support this work. The platform helps discover internet-facing systems, assess covered PHP installations for vulnerabilities and prioritize findings. Attack Surface Management, Vulnerability Management and Web App Scanning provide complementary views. [6](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote), [7](https://docs.tenable.com/attack-surface-management/Content/Topics/Welcome/GettingStarted.htm) We help interpret the results. A scan's coverage and the information available to it affect what it can establish. **A scan with no findings is therefore not a blanket assurance of safety.** [6](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote) Over time, this approach builds a maintained view of your systems and outstanding risks. Tenable One can bring the technical information together; heureka supports implementation and use. [8](https://docs.tenable.com/quick-reference/tenable-one-deployment-guide/Content/Welcome.htm) This gives your team a better starting point for the next security alert, with less information to gather from scratch. ## Let us work through your questions **Want to understand whether you need to act, or still unsure where PHP is running? Email me directly.** [**Discuss PHP exposure with Nico Kempe**](mailto:nico.kempe@heureka.com?subject=PHP2Shell%20-%20assessment) A short message such as “Please help us assess PHP” is enough. If you already have an application or a specific question in mind, feel free to include it. We can discuss which checks make sense for your situation. Where useful, we can also coordinate a 30-day evaluation, proof of concept or joint technical session with Tenable. ## Sources and technical details 1. [PHP: Security notices and updates dated 21 and 23 October 2026](https://www.php.net/archive/2026.php) 2. [CERT-EU: Assessment and recommended actions](https://cert.europa.eu/publications/security-advisories/2026-018/) 3. [WordPress: Check PHP with your hosting provider](https://wordpress.org/news/2026/10/critical-php-security-release/) 4. [AWS: Observed attack attempts](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/) 5. [Datadog Security Labs: Technical assessment and follow-up checks](https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/) 6. [Tenable: PHP2Shell detection and assessment limitations](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote) 7. [Tenable: Discovering internet-facing systems](https://docs.tenable.com/attack-surface-management/Content/Topics/Welcome/GettingStarted.htm) 8. [Tenable One: Bringing technical information together](https://docs.tenable.com/quick-reference/tenable-one-deployment-guide/Content/Welcome.htm) ## **Ready to move forward?** Talk to our experts about your specific challenges. We provide honest assessments and actionable recommendations. [Talk to Experts](https://heureka.com/en/contact) **Practical implementation** ## **Turn this resource into an actionable next step** Discuss your current situation with heureka. Together, we can clarify priorities, ownership, and the most useful place to start. ## **More resources you might like** **Article ** ### [SolarWinds Additional Polling Engine vs. Platform Remote Collector: Which Polling Architecture Fits?](https://heureka.com/en/resources/blog/solarwinds-additional-polling-engine-vs-platform-remote-collector) 14 min read [**Read article → **](https://heureka.com/en/resources/blog/solarwinds-additional-polling-engine-vs-platform-remote-collector) **Checklist ****· Exclusive** ### [ITSM Readiness Checklist](https://heureka.com/en/resources/checklists/itsm-readiness-checklist) 12 min read [**Get the checklist → **](https://heureka.com/en/resources/checklists/itsm-readiness-checklist) **Whitepaper ****· Exclusive** ### [AI Starts with Data Modelling: Why 'Model First' Matters More Than Ever](https://heureka.com/en/resources/whitepapers/ai-starts-with-data-modelling-model-first) 16 min read [**Get the whitepaper → **](https://heureka.com/en/resources/whitepapers/ai-starts-with-data-modelling-model-first) ```json {"@context":"https://schema.org","@graph":[{"@id":"https://heureka.com/#website","@type":"WebSite","description":"Enterprise-IT-Beratung, Lösungen, Schulungen und Support für Data Management, IT Operations, Security und Media Streaming.","inLanguage":"en-US","name":"heureka e-Business GmbH","url":"https://heureka.com/","publisher":{"@id":"https://heureka.com/#identity"},"translationOfWork":{"@id":"https://heureka.com/#website"}},{"@id":"https://heureka.com/en/resources/blog/php2shell#webpage","@type":"WebPage","dateModified":"2026-10-26","datePublished":"2026-10-26","description":"Are your systems affected by the PHP vulnerabilities? A clear explanation, practical next steps and personal support from heureka.","name":"PHP2Shell: What your IT team needs to know","url":"https://heureka.com/en/resources/blog/php2shell","breadcrumb":{"@id":"https://heureka.com/en/resources/blog/php2shell#breadcrumb"},"isPartOf":{"@id":"https://heureka.com/#website"},"potentialAction":[{"@type":"ReadAction","target":["https://heureka.com/en/resources/blog/php2shell"]}],"primaryImageOfPage":{"@id":"https://heureka.com/#logo"}},{"@id":"https://heureka.com/#identity","@type":"Organization","description":"Enterprise-IT-Beratung, Lösungen, Schulungen und Support für Data Management, IT Operations, Security und Media Streaming.","email":"heureka@heureka.com","legalName":"heureka e-Business GmbH","name":"heureka e-Business GmbH","telephone":"+49-7152-939310","url":"https://heureka.com","vatID":"DE815096051","address":{"@type":"PostalAddress","streetAddress":"Eichwiesenring 4F","postalCode":"70567","addressLocality":"Stuttgart","addressCountry":"DE"},"logo":{"@id":"https://heureka.com/#logo"},"sameAs":["https://www.linkedin.com/company/heureka-e-business-gmbh/","https://www.xing.com/pages/heurekae-businessgmbh","https://x.com/heurekagotdg","https://de-de.facebook.com/heureka.eBusiness/"]},{"@id":"https://heureka.com/en/resources/blog/php2shell#article","dateModified":"2026-10-26","datePublished":"2026-10-26","description":"Your website is up to date — but is PHP behind it? Learn what to check now and how heureka can help you work through the open questions.","headline":"PHP2Shell: What your IT team needs to know","inLanguage":"en-US","thumbnailUrl":"https://heureka.com/media/opengraph/resources.webp","@type":["Article","BlogPosting"],"author":{"@id":"https://heureka.com/#/schema/person/1"},"image":{"@id":"https://heureka.com/#/schema/image/1"},"isPartOf":{"@id":"https://heureka.com/en/resources/blog/php2shell#webpage"},"mainEntityOfPage":{"@id":"https://heureka.com/en/resources/blog/php2shell#webpage"},"publisher":{"@id":"https://heureka.com/#identity"}},{"@id":"https://heureka.com/en/resources/blog/php2shell#breadcrumb","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","name":"Home","item":"https://heureka.com/en","position":1},{"@type":"ListItem","name":"Resources","item":"https://heureka.com/en/resources","position":2},{"@type":"ListItem","name":"PHP2Shell: What your IT team needs to know","item":"https://heureka.com/en/resources/blog/php2shell","position":3}]},{"@id":"https://heureka.com/#/schema/person/1","@type":"Person","name":"Nico Kempe"},{"@id":"https://heureka.com/#logo","@type":"ImageObject","caption":"heureka e-Business GmbH","contentUrl":"https://heureka.com/favicons/android-chrome-512x512.png","inLanguage":"en-US","url":"https://heureka.com/favicons/android-chrome-512x512.png"},{"@id":"https://heureka.com/#/schema/image/1","@type":"ImageObject","contentUrl":"https://heureka.com/media/opengraph/resources.webp","inLanguage":"en-US","url":"https://heureka.com/media/opengraph/resources.webp"}]} ``` ## Sitemap See the full [sitemap](https://heureka.com/sitemap.md) for all pages.