If you've seen the news this morning, you'd be forgiven for feeling a little alarmed.
Headlines about a flaw putting "70% of the internet" at risk are designed to grab attention.
The good news is that a fix is already available. The flaws were found by security researchers rather than criminals, and patches were released within a day of the details leaking online.
Here's the Netitude take on what's been going on.
On Wednesday, 21 October, PHP released fixes for two critical security flaws, now widely known as PHP2Shell, after details leaked online the day before. PHP is an open-source programming language that runs behind the scenes on an estimated 70% of websites worldwide.
If left unpatched, the flaws could allow an attacker to take control of a vulnerable web server, install malicious software or steal data. They've reportedly been present in PHP for well over a decade. What’s changed is that AI has made it far quicker to find flaws like these.
The flaws were found by researchers at the security firm Calif using OpenAI's GPT-5.6 Sol model, as part of OpenAI's "Patch the Planet" initiative.
Researchers at Wiz, owned by Google, found the flaws independently. Both teams reported them to PHP in August, and work on a fix was well underway, but details leaked two days before the planned disclosure, so PHP released the patches early.
That figure refers to how widely PHP is used, not to how many websites have been attacked. PHP powers many popular website platforms, including WordPress, so its reach is enormous.
A website is only at risk if it runs an unpatched version of PHP and is exposed to the internet. Now that fixes are available, the job is making sure they're applied quickly.
Some early attack attempts have been reported, so the priority now is applying fixes safely and at speed.
For most businesses, the main thing to check is your website. If your website runs on a PHP-based platform, such as WordPress, it may be affected until the hosting provider or whoever manages it applies the update.
A few points that should help put this in perspective:
Our service delivery team is checking every system we manage, including copies of PHP built into other applications, and prioritising anything accessible from the internet. Where something can’t be updated straight away, we’ll put temporary protections in place and agree a plan with the client.
We expect to complete our checks by the end of today, and we’ll send clients a short summary of what we found and fixed. If anything urgent comes up, we’ll be in touch straight away.
If you’re a Netitude client, please let us know about any websites, applications or devices hosted or supported by another company, as we may not be able to see them.
If your website or any web application is managed by someone else, such as a web agency or hosting provider, it's worth a quick check:
This is a clear example of why keeping software up to date is one of the most important things any business can do.
Our approach to patching is based on severity. We use the industry-standard CVSS scoring system and prioritise vulnerabilities rated 7 or above, which are classed as high or critical. That aligns with Cyber Essentials, which requires high and critical security updates to be applied within 14 days of release. We normally allow a short window to make sure an update is stable before rolling it out widely, so a fix doesn't cause problems of its own.
It's also why we believe Cyber Essentials Plus should be the standard every business aims for. It doesn't just ask whether you have good security controls in place. It independently tests that they're working.
And it's a sign of where things are heading. AI is now helping researchers find serious flaws faster than ever, and attackers have access to the same kinds of tools. That makes the time between a vulnerability being announced and attackers trying to exploit it shorter, so having a reliable, well-run patching process matters more than ever.
PHP2Shell is a serious vulnerability, and it's right that it's getting attention. But researchers quickly found it, and fixes are now readily available. The steps to stay protected are clear: make sure PHP-based systems, especially websites, are updated promptly, and stay alert to scams that exploit the news.
Not sure whether your business is affected?
Our service desk is on hand to help. Get in touch, and we'll help you work out whether any of your systems need attention, with no jargon and no scare tactics.
What is PHP2Shell? PHP2Shell refers to two critical security flaws in PHP, an open-source programming language used by an estimated 70% of websites. If left unpatched, the flaws could allow an attacker to take control of a vulnerable web server.
Who discovered the PHP vulnerability? Researchers at the security firm Calif found the flaws using OpenAI's GPT-5.6 Sol model, as part of OpenAI's "Patch the Planet" initiative. Researchers at Wiz, owned by Google, also identified parts of the issue. Details leaked before the planned disclosure, and PHP released fixes on 21 October.
Is my website affected by PHP2Shell? Your website may be affected if it runs on PHP, which includes many WordPress sites, and hasn't been updated yet. Ask your hosting provider or web agency whether your site has been patched.
Does PHP2Shell affect Microsoft 365? No. Microsoft 365, Teams and standard Windows laptops are not PHP applications.
Do Netitude clients need to do anything? We’re checking the systems we manage, so there’s nothing you need to do for those. Please let us know about any websites or systems hosted or supported by a third party, as we may not be able to see them.
How quickly should security updates be applied? Cyber Essentials requires high and critical security updates, those with a CVSS score of 7 or above, to be applied within 14 days of release. For high-profile, critical issues like this one, it's sensible to act as quickly and safely as possible.