PHP2Shell: Immediate PHP Security Update Required

22/10/2026 / Announcements

Critical security vulnerabilities affect websites and applications running PHP. Check your PHP version and apply the available security updates immediately.

Two critical vulnerabilities in PHP, known as PHP2Shell, have been disclosed. Under certain conditions, they can allow attackers to execute code remotely or expose sensitive data without authentication.

The vulnerabilities affect PHP itself. Websites built on platforms such as WordPress, Drupal and Joomla, as well as other PHP applications, may be affected.

What you need to do now

Contact your technical team or the partner responsible for managing your environment to check all PHP installations and apply the relevant security updates.

Fixes are available in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, depending on the branch you use, or through corresponding patched packages from your vendor. If you use an older version, confirm whether a security fix is available or arrange an urgent upgrade to a supported version.

After installing the update, restart the relevant services and PHP workers to activate the fix.

Updating your CMS is not enough

Updating WordPress, another CMS or its plugins does not replace updating PHP itself. Temporary protective measures also do not fully address these vulnerabilities.

Treat this update as an urgent security priority, even if you have not observed any signs of an attack.

For further information and upgrade guidance, visit the PHP2Shell advisory and the official PHP announcement.

At Cloud Concept, our mission is to provide continuous technical support, deliver high-quality managed services and share practical insights that help businesses manage their data more efficiently.

Follow us on LinkedIn, Facebook & Instagram, or subscribe to our Newsletter to stay up to date with the latest insights and updates.