PHP2Shell: What the Critical PHP Vulnerability Means for Your Business

If you've seen the news this morning, you'd be forgiven for feeling a little alarmed.

Headlines about a flaw putting "70% of the internet" at risk are designed to grab attention.

The good news is that a fix is already available. The flaws were found by security researchers rather than criminals, and patches were released within a day of the details leaking online.

Here's the Netitude take on what's been going on.

What's happened

On Wednesday, 21 October, PHP released fixes for two critical security flaws, now widely known as PHP2Shell, after details leaked online the day before. PHP is an open-source programming language that runs behind the scenes on an estimated 70% of websites worldwide. 

If left unpatched, the flaws could allow an attacker to take control of a vulnerable web server, install malicious software or steal data. They've reportedly been present in PHP for well over a decade. What’s changed is that AI has made it far quicker to find flaws like these. 

The flaws were found by researchers at the security firm Calif using OpenAI's GPT-5.6 Sol model, as part of OpenAI's "Patch the Planet" initiative.

Researchers at Wiz, owned by Google, found the flaws independently. Both teams reported them to PHP in August, and work on a fix was well underway, but details leaked two days before the planned disclosure, so PHP released the patches early. 

Why "70% of the internet"?

That figure refers to how widely PHP is used, not to how many websites have been attacked. PHP powers many popular website platforms, including WordPress, so its reach is enormous.

A website is only at risk if it runs an unpatched version of PHP and is exposed to the internet. Now that fixes are available, the job is making sure they're applied quickly.

Some early attack attempts have been reported, so the priority now is applying fixes safely and at speed. 

Is my business affected?

For most businesses, the main thing to check is your website. If your website runs on a PHP-based platform, such as WordPress, it may be affected until the hosting provider or whoever manages it applies the update.

A few points that should help put this in perspective:

•  Your everyday tools aren’t PHP applications: Microsoft 365, Teams and standard Windows laptops don’t run on PHP, although it’s occasionally installed on PCs for development tools or local web apps. 
• Many hosting providers patch on your behalf: If your website is on managed hosting, your provider may already be updating it.
•  Other systems may need checking: PHP is often built into business applications, management consoles, monitoring tools and devices such as storage units and phone systems, and many organisations don’t realise they have it.

What we're doing

Our service delivery team is checking every system we manage, including copies of PHP built into other applications, and prioritising anything accessible from the internet. Where something can’t be updated straight away, we’ll put temporary protections in place and agree a plan with the client.

We expect to complete our checks by the end of today, and we’ll send clients a short summary of what we found and fixed. If anything urgent comes up, we’ll be in touch straight away.

• If you’re a Netitude client, please let us know about any websites, applications or devices hosted or supported by another company, as we may not be able to see them.

What you can do now

If your website or any web application is managed by someone else, such as a web agency or hosting provider, it's worth a quick check:

1. Ask your website host or agency whether your site runs on PHP and whether it has been updated to a patched version.
2. Make sure updates are applied promptly to any PHP-based systems you manage yourselves.
3. Be wary of phishing. Big security stories are often followed by scam emails pretending to offer "urgent fixes". Don't click links or download attachments from unexpected messages, and forward suspicious emails to report@phishing.gov.uk.
4. Get in touch if you're unsure. If you're unsure whether you're affected, our service desk can help you find out.

Why this matters: vulnerability management isn't optional

This is a clear example of why keeping software up to date is one of the most important things any business can do.

Our approach to patching is based on severity. We use the industry-standard CVSS scoring system and prioritise vulnerabilities rated 7 or above, which are classed as high or critical. That aligns with Cyber Essentials, which requires high and critical security updates to be applied within 14 days of release. We normally allow a short window to make sure an update is stable before rolling it out widely, so a fix doesn't cause problems of its own.

It's also why we believe Cyber Essentials Plus should be the standard every business aims for. It doesn't just ask whether you have good security controls in place. It independently tests that they're working.

And it's a sign of where things are heading. AI is now helping researchers find serious flaws faster than ever, and attackers have access to the same kinds of tools. That makes the time between a vulnerability being announced and attackers trying to exploit it shorter, so having a reliable, well-run patching process matters more than ever.

The bottom line

PHP2Shell is a serious vulnerability, and it's right that it's getting attention. But researchers quickly found it, and fixes are now readily available. The steps to stay protected are clear: make sure PHP-based systems, especially websites, are updated promptly, and stay alert to scams that exploit the news.

Not sure whether your business is affected?

Our service desk is on hand to help. Get in touch, and we'll help you work out whether any of your systems need attention, with no jargon and no scare tactics.

Frequently asked questions (FAQs)

• What is PHP2Shell? PHP2Shell refers to two critical security flaws in PHP, an open-source programming language used by an estimated 70% of websites. If left unpatched, the flaws could allow an attacker to take control of a vulnerable web server.
  
  

• Who discovered the PHP vulnerability? Researchers at the security firm Calif found the flaws using OpenAI's GPT-5.6 Sol model, as part of OpenAI's "Patch the Planet" initiative. Researchers at Wiz, owned by Google, also identified parts of the issue. Details leaked before the planned disclosure, and PHP released fixes on 21 October. 
  
  

• Is my website affected by PHP2Shell? Your website may be affected if it runs on PHP, which includes many WordPress sites, and hasn't been updated yet. Ask your hosting provider or web agency whether your site has been patched.
  
  

• Does PHP2Shell affect Microsoft 365? No. Microsoft 365, Teams and standard Windows laptops are not PHP applications.
  
  

• Do Netitude clients need to do anything?  We’re checking the systems we manage, so there’s nothing you need to do for those. Please let us know about any websites or systems hosted or supported by a third party, as we may not be able to see them.
  
  

• How quickly should security updates be applied? Cyber Essentials requires high and critical security updates, those with a CVSS score of 7 or above, to be applied within 14 days of release. For high-profile, critical issues like this one, it's sensible to act as quickly and safely as possible.