PHP Security Alert: Two Serious Vulnerabilities, and What We've Done About Them

If you run a website, here's something worth knowing about.

On 21 October, two serious security vulnerabilities were disclosed in PHP, the technology that powers millions of websites, including a huge number of WordPress sites.

They're being referred to as PHP2Shell, and they're not the sort of updates you want to put off until next week.

So, what happened, what does it mean for your website, and what have we been doing about it at Rufus Design?

Let's keep it simple (well i will try).

What's the problem?

Two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, were discovered in PHP itself.

Both have a critical severity rating of 9.2 out of 10. Under certain conditions, an attacker could exploit an affected server to run their own code without needing to log in first.

In plain English, that's a pretty serious security problem.

And here's the important bit: this isn't simply a WordPress plugin vulnerability that can be fixed by clicking an update button in your dashboard. The issue sits much deeper, in the PHP engine that runs your website.

That means updating WordPress, changing your password or installing another security plugin isn't enough to fix it. The underlying PHP software needs to be patched.

What did we do about it?

As soon as the issue emerged, we started working through the response on our infrastructure.

On Tuesday (before the patch) we introduced temporary security measures while the official PHP fixes were being prepared. These measures were designed to reduce exposure while the permanent patches were being made available.

The official PHP updates were released on 21 October, with the patched packages for our NGINX-based hosting environment becoming available on 22 October.

We've since updated the relevant PHP runtimes on our servers to PHP 8.5.12, and verified that the running PHP-FPM processes are using the patched version.

That's an important distinction. It's not enough for a control panel to say you're using PHP 8.5. We checked the actual software running behind the websites too.

We're also following our hosting provider's guidance on the remaining security measures and continuing to review the wider infrastructure.

Does this affect WordPress websites?

Potentially, yes.

PHP is used by WordPress and many other popular website platforms. The vulnerabilities affect the PHP runtime itself, rather than a particular theme or plugin.

The official patched releases are:

  • PHP 8.5.12

  • PHP 8.4.27

  • PHP 8.3.36

  • PHP 8.2.35

If your website is running an earlier version in one of these release branches, you should check that the appropriate security update has been applied.

Older PHP versions, including PHP 8.1 and earlier, are no longer supported by the main PHP project and aren't covered by these official patched releases. If you're running one of these versions, speak to your hosting provider about your options and plan a move to a supported release.

One thing worth remembering: a website can look perfectly normal and still be running vulnerable software behind the scenes.

Is my website safe now?

Getting the patched PHP version installed is the essential step in fixing these vulnerabilities. However, applying a patch doesn't automatically prove that a server was never compromised before the update.

That's why we take a layered approach to hosting security, including software updates, server-level protection and ongoing monitoring.

We also need to be realistic. No hosting setup can promise that a website will never be attacked. What matters is taking credible threats seriously, responding quickly and keeping the underlying infrastructure maintained.

That's precisely what we've been doing.

Do you need to do anything?

If your website is hosted and maintained by Rufus Design, there's no action required from you specifically for these PHP updates. We're handling the relevant server-side work.

If your website is hosted elsewhere, we'd recommend contacting your hosting provider and asking them to confirm that your PHP runtime has been updated to a patched version.

Don't just assume that because your website is online, everything is up to date.

The bottom line

Security updates aren't always exciting, and most of the time they're completely invisible to website visitors. But they're a big part of keeping websites reliable and protecting the businesses that depend on them.

This was a serious vulnerability, and it needed a prompt response. We've updated the relevant PHP runtimes on our NGINX hosting servers and will continue to follow the remaining guidance from our hosting provider.

At Rufus Design, we'd rather spend time dealing with a security update properly than wait for a problem to land on a client's doorstep.

If you have any questions about your website hosting or PHP version, just get in touch.

Rufus Design
Website design, development, digital marketing and managed hosting.

Further reading: RunCloud's security announcement and the NHS England Digital security alert. (opens in new tab)