PHP2Shell is the name given to two critical flaws in the core of PHP, the programming language behind a large share of the web. If your website, client portal or quoting tool runs on PHP, this concerns you directly. Consequently, it belongs on the leadership agenda and not only in the IT inbox. This article explains what the flaws are, how a non-technical leader can check exposure, and who should own the fix.
Key takeaways
- PHP2Shell covers CVE-2026-109618 and CVE-2026-109619, two core PHP flaws that each score 9.2 on CVSS v4.0 and can allow remote code execution without a login.
- The flaws are believed to reach back to PHP 5.4, so older versions should be treated as exposed until confirmed otherwise.
- Qualys found that 110 million of 156 million known PHP installations (71%) run end-of-life or end-of-support versions, so most firms have to upgrade as well as patch.
- A managing director can start with three answers: which PHP version each customer-facing system runs, who owns patching, and whether that version is still supported.
- Naming one accountable executive and keeping an owned inventory of systems stops unreviewed platforms from lingering for years.
PHP2Shell Explained: Why a Flaw in PHP Itself Is a Business Risk
PHP2Shell covers two vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Both sit in core PHP rather than in a plugin or a single application. Imperva’s analysis of PHP2Shell reports that each scores 9.2 on the CVSS v4.0 scale, which is Critical. Both are classed CWE-824, an access of an uninitialised pointer.
In plain terms, the software reads a piece of memory before it has been properly set up. Specifically, an attacker can exploit that without logging in and without any action from your staff. The outcome can be remote code execution, meaning an outsider runs their own commands on your server. It can also expose about 67 KB of process memory, which may hold fragments of whatever the server was handling at that moment.
A flaw at this level is not a niche technical matter.
Which versions are affected
Researchers traced the flaws back to PHP 5.4. However, PHP’s own advisory does not say how far they reach, and not every release has been tested individually. Dynatrace’s guidance is sensible: treat older versions as exposed until confirmed otherwise. Wiz Research adds that every PHP version released in the last decade is affected by at least one of the flaws.
Scale matters here as well. Roughly 69% to 70% of websites use PHP, so the odds that at least one of your systems depends on it are high.
One situation, worked through
Consider an illustrative case, not a client engagement. An owner-led manufacturer has a website, a client portal and a quoting tool. A supplier built all three several years ago, and the firm no longer works with that supplier. Nobody has reviewed the PHP version since, because the systems work and nobody has had a reason to look.
That is the ordinary situation, not the exception. The managing director does not need to read code. Three answers are enough to start.
- Which PHP version runs each customer-facing system.
- Who owns patching, by name.
- Whether that version is still supported.
The third answer decides everything that follows. The scale of the problem shows why, because Qualys analysed anonymised data from more than 10,000 customers. Of 156 million PHP installations with a known version, 73% sit on internet-facing assets. Only 44 million (28%) run supported branches, 8.2 to 8.5. The other 110 million (71%) run end-of-life or end-of-support versions, from 5.4 to 8.1.
In other words, most PHP installations in the data sit on versions that no longer receive routine fixes. If your portal is one of them, you are in the majority, which is reassuring about your company but not about your exposure.
Why an upgrade is different from a patch
A patch fixes a flaw inside a version that its maintainers still support. An end-of-life version no longer receives security fixes, so there is often nothing to apply. The only real remedy is to move to a supported branch.
That move takes planning, because software written years ago sometimes needs adjustment to run on a newer PHP. As a result, the quoting tool may need developer time, testing and a sensible window for the switch. This is exactly why the question belongs with leadership. It involves budget, timing and a decision about whether a ten-year-old system is worth keeping as it is.
What is at stake commercially
Calm is the right response, and alarm is not. Even so, the commercial consequences are worth naming plainly.
- Client trust: customers share pricing, contracts and personal details through a portal, and they expect you to protect them.
- Reputation: a breach reaches your clients and partners well before it reaches the press, and it is hard to undo.
- Continuity: if the quoting system goes down, your sales team cannot respond to enquiries, and revenue slows with it.
None of these is a prediction that something will happen. Rather, each describes what a managing director is protecting when they ask the three questions above.
Patching PHP2Shell: The Practical Steps for Leadership
Fixing the PHP vulnerability is mostly a matter of clear ownership and a short sequence of checks. You do not need technical depth to lead it. You do need a named person who answers for the outcome.
Start with an inventory. Ask your IT lead or hosting provider to confirm the PHP version running on every customer-facing system, in writing. That includes the website, the client portal, the quoting tool and any forgotten staging or test sites. Auditing the systems behind your marketing stack often turns up platforms that leadership had assumed were retired.
Next, sort each system into one of two groups. If it runs a supported branch, your provider applies the PHP security release. If it runs an end-of-life version, a patch will not rescue it, so it needs a scheduled upgrade, and until then your team should treat it as exposed.
Meanwhile, ask for the logs to be checked. Your IT lead should look for abnormal activity on the affected systems, such as unfamiliar requests, unexpected processes or changes nobody authorised. Given that these flaws allow remote code execution without a login, a clean result is useful, but only a technical review can give it.
Accountability deserves a plain statement. One executive, usually the managing director or the operations lead, should own the outcome. The IT lead or hosting provider carries out the work and reports back by an agreed date. Without that single name, the task tends to drift between departments and suppliers, and that is how an unreviewed system stays unreviewed for years.
This approach has limits. It does not tell you whether an attacker has already used these flaws against you, and it does not replace a proper security assessment. If your logs show anything unusual, bring in a specialist security firm rather than relying on a routine patch.
Turning a Security Scare into Long-Term Technology Stewardship
Most firms did not choose their older systems badly. They simply stopped looking at them once they worked. Stewardship means looking again on a schedule.
That has three parts. First, keep an owned inventory of every customer-facing system, with its software version and its supplier. Second, name one accountable person for each system. Third, review the list at least annually as part of the growth plan, because the portal and the quoting tool carry your client relationships. The role of a growth advisory firm for SMEs is partly to keep such matters visible to leadership before they become urgent.
Some leaders want that oversight without adding a full-time executive. Fractional CMO strategic counsel can give you senior attention on how sales, marketing and client-facing platforms fit together, and our advice stays discreet.
If you would like a considered conversation, Republic Digital Consultancy’s growth advisory service treats digital resilience as part of long-term stewardship. A good first step costs you nothing: find out who owns and maintains each of your customer-facing systems today.
Frequently asked questions
What is PHP2Shell?
PHP2Shell is the name for two critical flaws in core PHP, CVE-2026-109618 and CVE-2026-109619. Each scores 9.2 on CVSS v4.0 and is classed CWE-824, an access of an uninitialised pointer. They can allow remote code execution without authentication, or expose about 67 KB of process memory.
What does PHP cyber-security mean for a business?
PHP is the language many websites, portals and quoting tools run on. Keeping it secure means knowing which version each system uses, keeping that version supported and patched, and naming who is responsible. It is a governance task as much as a technical one.
How do I patch the PHP vulnerability?
Ask your IT lead or hosting provider to confirm each system’s PHP version. If it runs a supported branch, they apply the PHP security release. If it runs an end-of-life version, it needs an upgrade to a supported branch, because there may be no fix to apply.
What if nobody can tell me which PHP version we run?
Treat the system as exposed until someone confirms the version in writing. Researchers traced the flaws back to PHP 5.4, and not every release has been tested individually. Your hosting provider or original developer can usually confirm the version quickly.
