On Wednesday 21 October, the PHP team shipped emergency fixes for two flaws that let an attacker take over a web server with a single request. Around the world, site owners took their stores offline to be safe. None of our clients had to.
What PHP2Shell was
The two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been nicknamed PHP2Shell. Neither needed a login. One crafted request was enough to run code on the server, and PHP sits under a huge share of the web. Magento is built on it, so every Magento store was in scope, along with a long list of other platforms.
It was nasty for another reason too. Amazon spotted someone trying the exploit on 17 October, four days before the fix was public. The UK’s NCSC told organisations to consider taking offline any system they couldn’t patch straight away, and plenty of sites did exactly that. For a store, that means a day with the shutters down.
What our hosting partners did
Our clients’ sites are hosted with Corefinity and Hypernode. Both of them handled it brilliantly.
Corefinity’s alert landed at 12:27 on the Wednesday, before the official fix existed. It told us exactly where things stood. Their teams had already put mitigations in place across the whole platform. The official PHP patches were due at 15:00 UK time, and they had the tooling ready to roll them out within minutes of release. It also told us what we needed to do, which for anything they managed was nothing at all.
So that’s what happened. They protected the servers first, then applied the official patches as soon as they landed, which meant the sites were covered the whole way through. When a client emailed on Friday morning to ask whether their store had been looked at, I could tell them it had been secure all along.
Hypernode confirmed publicly that patches and mitigations were in place across their whole platform too. We always knew what was happening and when, so we never had to guess, and we didn’t take a single client site down.
For our clients, PHP2Shell was something they read about in the news rather than a day they lost.
Why your host matters more than you think
Cheap hosting looks fine right up until the week it matters. The difference shows up on a Wednesday afternoon, when a fix lands and somebody has to roll it out across every server. Either your host does it, tells you, and you carry on trading, or you find out it’s your problem.
So ask your host three things before the next one. Who patches PHP on your servers? How will they tell you when something like this happens? And how quickly did they patch PHP2Shell? A good host will answer all three without having to go and check.
Check your PHP version while you’re at it. PHP 8.1 and older no longer get fixes from the PHP team, so if that’s what you’re on, you’re relying entirely on whoever looks after the server.
Why it’s worth paying for
Every incident a good host absorbs is a day your team spends selling rather than firefighting. It keeps the retainer hours on growth work, and it means the problems on your list next month are the good kind, like keeping up with orders.
Do you know who patches PHP on your server, and how they’d tell you?
