PHP2Shell: What the Critical PHP Vulnerability Means for Your Brand Website and Campaign Pages
PHP2Shell, two critical PHP flaws, puts WordPress, WooCommerce and campaign sites at risk. Here’s what yesterday’s updates mean for your brand website and what to do now.
PHP2Shell is the name for two critical vulnerabilities in PHP itself (CVE-2026-109618 and CVE-2026-109619), the language behind WordPress, WooCommerce, Magento, Drupal and many custom websites. Both are rated 9.2 out of 10 and can let an attacker run code on a server without logging in. PHP released fixes on October 21, and the days since, up to yesterday, October 23, brought three updates every brand with a website should know about.
First, PHP disclosed a separate session-handling flaw, CVE-2026-115560, that the October 21 releases do not fix. PHP considers the affected setup unlikely, no exploitation has been reported, and the fix will arrive in the next routine release. Setting session.upload_progress.enabled to 0 mitigates it. Second, reporting now shows exploitation attempts began on October 17, four days before the patches were released. Third, network appliance vendors confirmed that some of their products are affected, including Palo Alto Networks PAN-OS and Cisco Expressway.
Why is a creative studio writing about server security? Because many of the websites, landing pages and campaign microsites behind brand work run on PHP, and the vulnerability sits in the runtime, not in the site’s own code. A perfectly built WordPress or WooCommerce site is still exposed if the server’s PHP version is out of date. Updating plugins alone does not fix it.
If you run a brand website or campaign page, here is what to do now:
Ask your hosting provider or developer which PHP version serves your site, and confirm it is 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor package with the fix backported.
If you are on PHP 8.1 or older, plan an upgrade. Those branches get only minimal source backports or none at all.
Do not forget older campaign microsites that are still live but no longer maintained. These are easy to overlook.
Ask your team to review logs from October 17 onwards, not just from the patch date.
Workarounds and firewalls can reduce risk while you update, but PHP is clear that patching is the only real fix.
At The Quick Craft, we believe good creative deserves a secure home. If we have built a site or campaign page for you and you are unsure of its status, contact our team and we will help you confirm the PHP version and next steps.
