On 21 October 2026, the team behind PHP released an emergency update to fix two serious security flaws, now known as PHP2Shell. If you’re a Simplicity Digital hosting or maintenance client, here’s the short version: every one of our servers was patched the same day, and there’s nothing you need to do.
What is PHP2Shell?
PHP is the programming language that powers WordPress and a huge share of the websites on the internet. PHP2Shell is the nickname for two flaws in PHP itself (officially CVE-2026-109618 and CVE-2026-109619). Both are rated critical – 9.2 out of 10.
In plain terms, they could let an attacker take control of a web server just by sending it specially crafted requests. No password, no login, and nobody on the site has to click anything. Researchers say the flaws affect PHP versions going back more than a decade.
Why it mattered
Details leaked online before the fix was ready, and Amazon’s security team spotted an attempt to exploit the flaws on 17 October, four days before they were made public. That makes this one to deal with straight away, not at the next routine update.
What we did
As soon as PHP released the fixed versions (8.5.12, 8.4.27, 8.3.36 and 8.2.35) on 21 October, we updated PHP on every server we manage. All Simplicity Digital hosted sites are protected.
If your website is hosted elsewhere
PHP2Shell affects almost any server running PHP, not just ours. If your site is hosted somewhere else, it’s worth asking your host to confirm they’ve installed the 21 October PHP update.
Any questions?
If you have any questions about PHP2Shell or your site’s security, just get in touch.
