PHP2Shell: patch PHP this week
If your website runs on PHP, and most do, a stranger could have taken control of the server it lives on without a password. The fix came out on 21 October. Until it is installed, the door is still open.
PHP is the software that quietly runs most of the web. WordPress, Drupal, Joomla and a great many company sites are built on it.
In August, researchers at Wiz, working with AI models, found two serious flaws inside it. They called them PHP2Shell. Every version of PHP from the past ten years has at least one of them. The researchers told PHP privately, PHP built a fix, and both were announced together on 21 October.
No attacks had been seen before the announcement. Now that the details are public, anyone can try. That is why this week matters.
Three checks, this week.
- 01Ask whoever runs your site to install the 21 October update.
The safe versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Many hosts install it without changing the number you see, so ask rather than guess.
- 02On PHP 8.1 or older? Book the upgrade now.
Those versions no longer get regular fixes. This one was an exception, and the next one may not be.
- 03If it can't happen today, turn on protection in front of the site.
Cloudflare, Fastly, Google and Vercel have published protections that help while you wait.
If your website is older than the team now running it, send me the address. I'll tell you honestly what I'd do first, whether that's a patch, a redesign or a rebuild.
Work with me