- What happened after the October 21 fix: confirmed exploitation and signs of compromise
- Why PHP also lives inside device admin screens, not just websites
- Fixed versions and what to do about unsupported ones
- What to ask your maintenance company and device vendor
Short answer
The two vulnerabilities the PHP team fixed on October 21, 2026, known together as "PHP2shell", could let someone run code on a server from outside. On October 26 (US time), CISA in the United States added them to its catalogue of known exploited vulnerabilities, and on October 29 JPCERT/CC added that traces of a successful compromise had been found on a firewall product. On November 2, IPA added that some products, including the web admin screens of VPN appliances, use PHP. Check your network devices as well as your website.
What happened
PHP is a language for programs that run behind websites, used by many company sites, online shops and business systems. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP team says there are no complete mitigations and updating is the only safe choice.
When the fix came out, the message was "apply it soon". With exploitation confirmed, the situation is now "attacks are happening". Many pieces of code claiming to exploit the flaws have also been published. If you planned to wait for your next scheduled maintenance, reconsider.
PHP lives outside websites too
PHP can sit inside the admin screens of VPN and security appliances. You cannot update that PHP yourself; you wait for the vendor's fixed firmware and apply it. According to JPCERT/CC, the Dutch National Cyber Security Centre (NCSC-NL) keeps a list of potentially affected products on GitHub.
"Our website doesn't use PHP" is not enough. The admin screen of your VPN appliance or firewall may use it.
Unsupported versions
PHP 8.1 and older no longer get updates from the PHP project. Some distributions and long-term support vendors provide fixes, so ask your vendor or move to a supported version. PHP 8.2 reaches end of life on December 31, 2026. IPA asks organisations that cannot secure maintenance to consider moving to a supported product, cutting features, taking the service offline or retiring it.
What to check, in order
- Your website and business systems. Ask your web developer, maintenance contractor or hosting provider whether PHP is at a fixed version or later. Some hosting plans let you choose the version, so make sure an old one is not still selected.
- Your network devices. Note the model numbers of your VPN appliance and firewall, and check the vendor's security advisories for whether they are affected and whether fixed firmware exists. If the admin screen can be opened from outside, treat it as urgent.
- If you cannot update right away. IPA asks you to apply interim measures such as access restrictions, and to decide whether to block outside access or pause the service.
- Whether you have been attacked. JPCERT/CC asks that, if compromise is suspected, you preserve logs and other evidence, investigate the scope, and isolate the system. Finding no traces does not prove you were not attacked. Leave the investigation to your maintenance contractor or a specialist.
Do not rebuild servers or delete logs before the investigation. You would lose the ability to find out what happened.
One thing to check today
Send one message to your web developer or maintenance contractor asking whether your site's PHP is at a fixed version or later.