PHP2Shell Vulnerability: How MOJO Responded
By Ian Mason • October 22, 2026 • Website Design
By Ian Mason • October 22, 2026 • Website Design
By Ian Mason • October 22, 2026 • News, Website Design
On October 22, MOJO sent an important security update to our website clients.
The message concerned a critical PHP vulnerability disclosed the previous day. It was the kind of security news that can leave business owners wondering whether their websites are at risk, whether their information is secure, and what they need to do next.
But our email wasn't asking clients to figure out how to fix the problem themselves.
It was letting them know that the necessary security updates had already been applied to their websites and verified by our team.
That distinction is important. Because while cybersecurity threats are an unavoidable part of operating online, responding to them shouldn't be left to chance.
Here's what happened, why the vulnerability mattered, and what business owners can learn from the response.
On October 21, 2026, the PHP development team released emergency security updates addressing two critical vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619.
The vulnerabilities, collectively known as PHP2Shell, affected PHP, a programming language that operates behind the scenes on a significant portion of the internet.
PHP powers websites built with popular content management systems such as WordPress, Drupal, and Joomla.
Researchers discovered that, under certain conditions, attackers could exploit weaknesses in PHP to execute unauthorized code on a website's server without needing to log in.
Both vulnerabilities received a critical severity rating of 9.2 out of 10.
The potential impact was substantial. Security researchers at Palo Alto Networks identified more than 22.6 million exposed instances that were potentially vulnerable.
That doesn't mean millions of websites were compromised. It does help explain why the PHP development team and cybersecurity industry treated the discovery with such urgency.
One of the more concerning aspects of PHP2Shell was that the vulnerabilities existed in PHP itself, rather than in a particular WordPress plugin, theme, or application.
Consider a business that regularly updates its WordPress website, maintains its plugins, and follows good security practices.
That business may still have been running a vulnerable version of PHP on its server.
The website could appear completely normal to visitors. Forms might work, pages could load quickly, and customers might continue browsing without noticing anything unusual.
But a serious vulnerability could still exist in the underlying technology.
That's why website security involves more than keeping the visible parts of a website updated.
It also requires attention to the server environment, hosting configuration, and software dependencies that make the website function.
The discovery also highlighted the growing role of artificial intelligence in cybersecurity.
According to security researchers at Wiz, the underlying weaknesses had existed in PHP's code for more than a decade.
What changed was researchers' ability to find and understand them.
Teams at Wiz and Calif used advanced AI tools to investigate the vulnerabilities and develop demonstrations of how they could be exploited.
Researchers and technology organizations, including OpenAI and the PHP development team, subsequently collaborated on disclosure, testing, and remediation efforts.
AI helped make a highly complex security problem more practical to investigate.
But the discovery also raises an important concern: the same advances that help security researchers uncover vulnerabilities could help malicious actors find and exploit weaknesses more quickly.
For businesses, that creates another reason to have an established process for monitoring security developments and addressing vulnerabilities promptly.
When the October 21 PHP vulnerabilities were disclosed, MOJO took proactive steps to address the issue for the website clients covered by our maintenance response.
The priority was straightforward: apply the necessary security updates, verify their completion, and communicate the results.
On October 22, we sent clients a security update explaining the vulnerability and the actions taken.
The message included this confirmation:
"The updates have been completed and verified, and no further action is needed on your end."
It was a short email, but it communicated something important.
The necessary updates had been handled. Clients knew what had happened, and they didn't have to figure out what action to take next.
When a critical security vulnerability makes headlines, business owners often have more questions than answers.
Does this affect my website? Is my hosting company handling it? Should I contact my developer? What happens if something breaks during an update?
Those are reasonable questions. But they're also questions that a clearly defined website maintenance relationship should help answer.
In this case, MOJO's clients received confirmation that the security issue had been addressed within the scope of our website management work.
We didn't need to turn the communication into a lengthy technical report. We needed to explain the situation, confirm the work, and let clients know what to expect.
That's part of what proactive service looks like.
Applying security updates is only part of the process.
Depending on the hosting environment and website configuration, updating PHP can affect compatibility with existing website features or custom functionality.
That's why confirming completion is an important part of a responsible update process.
In our October 22 communication, we confirmed that the necessary updates were completed and verified.
Verification of an update should not be confused with a guarantee that a website has never been compromised. Those are different security questions, and suspected compromise requires its own investigation.
But confirming that updates have been applied is a meaningful part of maintaining a website responsibly.
And communicating that confirmation helps business owners understand where things stand.
If you didn't receive a security update from your hosting company or website maintenance provider, that doesn't automatically mean your website is vulnerable.
But it is worth confirming that someone has reviewed the issue.
Here are four questions every business owner should be able to get answered.
If your website uses WordPress, you can usually find your PHP version under Tools → Site Health → Info → Server in the WordPress dashboard.
Your hosting company or website developer can also provide this information.
The PHP development team released fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Websites using older PHP versions may need an upgrade or an appropriate vendor-supported security backport.
Don't assume your website is protected simply because WordPress and its plugins are up to date.
The PHP2Shell vulnerabilities existed in the underlying PHP software.
Ask your hosting provider or maintenance team whether the October 21 vulnerabilities were reviewed and whether the appropriate security updates were applied.
This question may be more important than the specific PHP version.
Depending on your hosting arrangement, server-level security updates may be managed by your hosting company, your website developer, or a separate maintenance provider.
Problems can arise when everyone assumes someone else is responsible.
Make sure you understand what your maintenance agreement covers, including who handles urgent security updates and who verifies their completion.
PHP2Shell won't be the last major website security alert.
New vulnerabilities are discovered regularly, affecting everything from content management systems and plugins to hosting software and underlying server technology.
Ask your website provider how they monitor security advisories, prioritize important updates, and communicate with clients when urgent action is necessary.
You should know who is responsible before an issue arises, not while you're trying to respond to one.
Most business owners think about their websites in terms of what customers experience.
Does the website look professional? Is it easy to use? Does it load quickly? Does it generate calls, inquiries, or sales?
Those things matter. They're often the primary reasons a company invests in a professionally developed website.
But the value of a website also depends on what happens behind the scenes.
A website needs ongoing attention as software changes, technologies evolve, and new security threats emerge.
Much of that work is invisible to customers.
When it's done well, there may not be a dramatic moment or a major interruption. The website simply continues to operate, supporting the business that depends on it.
That's an important distinction between launching a website and taking responsibility for maintaining it.
A website isn't finished when it goes live. It becomes an ongoing part of the business.
And like any important business system, it needs people who understand how it works and who are responsible for looking after it.
The October 21 PHP vulnerability was a significant reminder of how quickly website security concerns can develop.
It also illustrated why ongoing website management matters.
At MOJO, our October 22 client communication wasn't about creating urgency or drawing attention to a technical accomplishment.
It was about letting clients know that our team had addressed the vulnerability, completed and verified the necessary updates, and would continue monitoring security developments.
No website maintenance provider can guarantee that a website will never face a security threat.
But a good maintenance relationship should provide clearly defined responsibilities, timely attention to important vulnerabilities, and straightforward communication when action is taken.
The goal isn't to make business owners experts in website security. It's to make sure they have the right people taking care of the responsibilities they depend on.
If you're unsure who manages your website's security updates, PHP environment, or ongoing maintenance, now is a good time to find out.
MOJO helps businesses develop and manage websites that support their long-term goals, not just their launch day.
Contact MOJO Creative Digital to discuss your website and its ongoing maintenance needs.
