Is Your Website Affected By The PHP Bug?

Quite possibly. Two flaws in PHP, the programming language that sits under a large share of the world's websites, became public on 21 October 2026, and the Cyber Security Agency of Singapore told organisations to patch immediately. Wiz Research, which found the flaws, says PHP powers about 70 per cent of websites worldwide and that every version released in the last decade is affected. Fixes went out the same day, in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The fix is the PHP software on your server. Updating a plugin or the website's own code does nothing for it.

Summary

The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and together they are called PHP2Shell. Both are rated critical, 9.2 out of 10.

PHP is the language underneath WordPress, Drupal and Joomla. Wiz Research says every PHP version released in the last decade, back to 5.4, is affected by at least one of the two.

Patched versions were released on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP project is not fixing PHP 8.1 or older, and PHP 8.2 reaches end of life on 31 December 2026.

The Cyber Security Agency of Singapore issued its alert the same day and said it knew of widespread attempts to exploit the flaws. On 22 October the Commissioner of Cybersecurity, Gwenda Fong, said many small and medium businesses may not realise their systems are affected.

In short

Two critical flaws in PHP, known together as PHP2Shell, became public on 21 October 2026. Both are rated 9.2 out of 10.
Wiz Research, which found them, says PHP powers about 70 per cent of the world's websites, and that every version back to 5.4 is affected.
Singapore's cyber agency told organisations to patch at once, and says many small businesses do not know what their site runs on.
The fix is the PHP software on the server. A plugin update, or a change to your website's own code, does not close these two holes.

What The Flaws Actually Allow

An attacker can run their own code on a web server without logging in.

That is what unauthenticated remote code execution means. It is why both flaws score 9.2.

Wiz Research demonstrated it against WordPress, Drupal and Joomla. The same work let it read the memory of a PHP worker, which can hold passwords, tokens and API keys belonging to other people's requests.

The flaws sit in PHP's own engine. Well written website code is not a defence, because the problem is underneath it.

Who Is Affected, And Who Is Not

Any PHP installation that answers web requests. That covers PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

The PHP project rates the risk highest for mod_php, where a request can set off the attack before any of your own website code runs.

If your site is built on WordPress, WooCommerce, Laravel, Magento, Drupal or Joomla, there is PHP underneath it.

If your site is a static build, or runs on another language, these two flaws are not yours. CSA still asks organisations to check every server for PHP, including inside third party tools that may have brought it along.

What To Ask Your Developer This Week

Ask which version of PHP your site runs, and whether it has been updated since 21 October 2026.

The patched versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

If your site is on PHP 8.1 or older, the PHP project is not releasing a fix. Ask your host whether they have backported one, or plan the upgrade.

Then ask a second question. Has anyone looked for signs that the server was already broken into?

CSA published a separate guide on 23 October 2026 on monitoring for related compromises. If your host manages PHP for you, the update is theirs to apply and yours to ask for, in writing.

Singapore's Cyber Agency Says Do Not Wait

CSA issued alert AL-2026-151 on 21 October 2026, under one line of advice: patch immediately.

The alert says the flaws affect all versions of PHP, that there have been widespread exploitation attempts, and that proof of concept exploits are circulating.

Commissioner of Cybersecurity Gwenda Fong put it plainly on 22 October. "My message to every organisation in Singapore is simple: do not wait."

She singled out small and medium businesses that lean on outside IT vendors or hosting providers, because they may not know what is installed on their own server.

Her advice for anyone who is unsure was to contact the IT team, the website developer or the hosting provider that day.

Why This One Spread So Fast

The flaws had been in PHP for more than a decade, according to Wiz Research.

They were found with help from advanced AI models. Wiz says that work removed the barrier that had kept the flaw theoretical, because building the attack by hand needed a long chain of steps that was barely within reach of a human team.

Cloudflare says the details leaked before the official release date, and that it had firewall protection out about nine hours before the disclosure went public.

So the hole was common knowledge before most sites had patched. CSA says the attempts started straight away.

Our take

I would not file this one under IT and move on.

Most small business sites I come across are WordPress or something like it, and PHP is underneath. That is what it means for a language to run 70 per cent of the web.

The word I would be careful about is patched. A host saying everything is up to date tells you very little. I would ask for the version number, and keep the reply.

The sites my studio builds do not run on PHP, so this particular wave does not touch them. I am not relaxed about it, because the next flaw will land somewhere else, and the same hurry will apply.

The part that stays with me is how it was found. A flaw that sat quietly in the code for more than a decade came out because AI models went looking. The same tools are open to anyone doing the looking for worse reasons.

Keeping software current used to be housekeeping. It is closer to a standing appointment now. So, would you be able to say today which version of PHP your website is running?