Yesterday we wrote that the websites we host stayed online while DigiD, MijnOverheid and the Dutch House of Representatives went dark. Today more is known about the two PHP flaws: whether they are being exploited, what exactly they do and who will get no fix at all. Here is the current state of affairs, in plain English.

Last updated: Friday 23 October 2026, 00:30 CEST. We will keep updating this post as the news develops.

The flaw now has a name: PHP2Shell

The two vulnerabilities (CVE-2026-109618 and CVE-2026-109619) are jointly known as PHP2Shell. They sit in PHP itself, not in WordPress or in a plugin, and in principle affect every website running on PHP. Disclosure was planned for 22 October, but the details leaked on 20 October via social media. That is why the PHP team released the patch a day earlier than planned and why many organisations took their websites offline as a precaution.

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If your site runs on one of those versions, this flaw is closed for you.

Is the flaw being exploited?

Opinions on that shifted today, in two directions:

  • The NCSC (the Dutch National Cyber Security Centre) reported on 21 October that it had no indications of exploitation yet. On 22 October it said it was investigating the first signs of successful exploitation.
  • Security researchers saw attack attempts coming in via honeypot servers. At the same time, Utrecht-based Sansec says mass exploitation is less likely than feared on day one: the publicly shared attack code does not work against a standard PHP installation, and an attack requires specific knowledge of the target server.
  • The US government (CISA) urges immediate updating, but has not (yet) put the flaws on its list of actively exploited vulnerabilities.

Our reading: a patched server is safe, and an unpatched server is not a “small risk” but an open door that people are now rattling. Waiting is no longer an option.

More than just code execution: a memory leak too

A detail that got little attention yesterday: one of the two flaws can also leak server memory. Via a session cookie, an attacker can retrieve pieces of the web server’s memory, which may contain passwords, session tokens or API keys of other visitors. This even works on websites that do not use sessions at all.

In practice this means: if your website was on an unpatched server between 20 and 22 October, consider renewing the passwords and API keys that were in use on that server. Not because something definitely happened, but because you cannot rule it out.

No patch for PHP 8.1 and older

This may be the most important point for many business owners. PHP 8.1, 8.0 and all 7.x versions are no longer supported and will not receive a security update. A website on such a version remains vulnerable until the server is moved to PHP 8.2 or newer. That is not a matter of flipping a switch: old plugins and themes sometimes do not work on a new PHP version, so it has to be tested.

How to check it yourself in WordPress: go to Tools → Site Health → Info → Server. That shows the PHP version. Does it start with 8.2, 8.3, 8.4 or 8.5 and is the version number equal to or higher than the ones above? Then you are patched. If you see 8.1 or lower, contact your hosting provider today.

What we have done and keep doing

  • All servers we host on were updated to a patched PHP version on 21 October, the same day as the release.
  • Verploy, our own maintenance platform, checked after the update whether every client site still worked correctly. It did everywhere: not a single site went offline.
  • We found no exploitation in our logs, and over the coming days we will keep monitoring extra closely for unusual traffic.
  • None of our client sites runs on PHP 8.1 or older. That is no coincidence: timely PHP upgrades are part of our maintenance.

Three things you can do today

  1. Check your PHP version (see above) or ask your hosting provider. A good host can tell you right away when the patch was applied.
  2. Renew passwords and API keys if your site has been on an unpatched server.
  3. Make sure this is the last time you have to figure it out yourself. A website should be monitored, not looked at once a year.

Not sure where your site stands?

Leave your website address below. You will receive a short, personal report by e-mail: is your site running on a safe PHP version, how are speed and findability, and what are the three improvements with the biggest impact. Free and without obligation.

Book a free consultation   

Prefer to call? +31 (0)166 700204, Mon–Fri 9:00–17:30 CET.

Sources: Sansec, PHP2Shell analysis (updated 22 October) · watchTowr, PHP2Shell FAQ · Help Net Security · Scientias · php.net security advisory of 21 October 2026.