You might have seen news headlines around the world recently talking about a serious vulnerability in PHP, known as PHP2Shell. This was a HUGE deal for the tech world, but what does it actually mean for you as a normal person with a website?
What Is PHP Anyway?
PHP (which stands for PHP: Hypertext Preprocessor 🙃) is a coding language that is typically found on servers and backends of websites. It’s usually used to interact between the user, the server and the database, which allows webpages to be dynamic. For example, to view this page right now, some PHP script has requested the page content from our site database and injected it into the HTML template for this page. If you go to another blog post, you are actually loading the same HTML template, but the PHP query is different, so you’ll see different images and text on the page.
PHP is the language used to run popular website builders like WordPress, Joomla, Moodle and Laravel, amongst many other smaller systems, so it’s extremely common. It’s rare for modern websites to be built solely on one platform, with many using different systems for the server operating system, HTML requests, databases and processing; this combination is known as the stack. Overall, it’s estimated around 70% of websites use PHP at some point in their stack, with the LAMP stack (Linux, Apache, MySQl and PHP) being the ‘go-to’ setup for many.
What Was The PHP2Shell Vulnerability?
The recent headlines about PHP vulnerabilities refer to two loopholes in the PHP system that rely on overwhelming the memory. Essentially, old or invalid information can be incorrectly used by PHP if the normal code execution process is interrupted by the system running out of memory. Therefore, if you can get the system to run several processes at once, you can trick it to accept a fake password, run some malicious code or reveal credentials as it becomes overwhelmed.
This mechanism was actually known some time ago, but the process to actually overwhelm the memory was so complicated it was thought to be impossible to exploit. However, by using sophisticated AI agents, security researchers were able to create the memory error at the same time as deploying fake credentials or malicious code. This meant that suddenly 70% of websites were now open to an exploit, creating one of the most serious cyberthreats ever discovered.
A good analogy is leaving a high loft window unlocked; technically someone could climb in and burgle you. In reality, the window is several storeys up, there’s no way of knowing it’s unlocked from street level and there are nosy neighbours wandering about all day who would notice someone climbing up a drainpipe, so the actual chances of the loft window being used are basically zero. However, imagine that the AI agents used are equivalent to an invisible ladder – it’s now really easy to climb up to loft windows without being seen, check if they are locked and get in. Once the invisible ladder is created, then an unlocked loft window becomes a critical security issue, even though it wasn’t really a problem before.
The exploit was discovered in August 2026, and PHP issued a patch to fix the vulnerability in October 2026.
How To Check If You Are Using PHP
It’s actually pretty tricky to work out if you are using PHP if you didn’t code the website yourself, but here are some clues to look out for:
- You are using WordPress, Joomla, Drupal, Moodle or Magento. These all use PHP so any site using these CMSs is vulnerable to the PHP exploit. If you know you are using another CMS, check to see if it is also affected.
- Your site has urls that end in .php. Not every page will use the .php suffix, (this page uses PHP but there’s no .php in the url), so look at things like login screens, profile pages or admin dashboards. These often involve transmitting lots of data to and from the database so are more likely to link directly to a PHP file.
- The url yoursite.com/index.php loads or redirects you back to your homepage. If the page loads ok, it suggests you are using PHP. (However, if you get a 404 error, you might still be using PHP in another part of your site.)
- You have seen the names Laravel, Symfony or CodeIgniter used in reference to your website. Check back through correspondence with your web developer to see if these PHP frameworks are mentioned when setting out how your site is built.
Remember, around 70% of websites use PHP in some form, so even if you don’t find any definitive evidence your website is using it, it’s still quite likely that it’s in the mix somewhere.
What To Do Next If You Think Your Site Uses PHP
If you have access to the web hosting then the best plan is to check there. Most big hosting companies forced the security patch onto all sites running on their servers, so you won’t need to do anything else.
To check, find the PHP version your server is running – the following PHP versions are safe and patched.
- 8.5.12
- 8.4.27
- 8.3.36
- 8.2.35
If you are running another version number, see if there is an option to upgrade to a safe version. Some hosting packages allow you to set your PHP version manually, although the severity of the PHP2Shell threat means many hosts will have forced sites on to a safe version even if they had manual PHP selection. If you aren’t on a safe version and don’t see an option to change the PHP version, contact your host immediately to confirm they have installed the security patch for you. Some setups allow the patch to be installed without the version number being updated, so don’t panic if you appear to have an older PHP version and no choice to upgrade yourself.
(As a side note, if you are running anything below PHP 8.4, you should plan to upgrade as soon as possible. Older versions of PHP do not get the same security support as the current versions, and only PHP 8.4 and 8.5 currently receive full active support.)
With the growing use of AI, it’s likely more of these previously ‘unexploitable’ loopholes will become usable routes into the backend of websites. Therefore, it’s even more vital that you keep your website secure and well-protected. We can help audit your existing security, and our hosting services provide peace of mind against threats like these. Why not get in touch and find out how we can help you?
