PHP2Shell is patched on every site I maintain

PHP2Shell is the name given to two serious flaws in PHP, the programming language behind most websites. PHP released the fix on 21 October 2026, and every production and staging server I manage for clients is now running the fixed version, PHP 8.5.12.

What was PHP2Shell?

The flaws were in PHP itself, not in Statamic or any other software built with it. Security researchers at Wiz found them in August 2026 and reported them to the PHP security team, who prepared a fix in private.

In the worst case, someone could send a request to a website and make its server run their own code, without logging in. They could also read parts of the server's memory, which can hold passwords and keys.

In October 2026, Wiz estimated that PHP powers around 70% of websites, so this affected far more than Statamic sites. WordPress, Drupal and Laravel sites all needed the same fix.

Wiz estimated that PHP powers around 70% of websites,

https://www.wiz.io/blog/php2shell-php-rce

What I did for sites on my maintenance plans

This was one of the critical patches that can't wait for the monthly update. Once the fixed PHP was built for Ubuntu, the operating system on my servers, I:

1. Saved a copy of each server's logs, a record of every visit while the flaw was known but not yet fixed.

2. Installed the fix on every production and staging server I look after.

3. Confirmed each server was running PHP 8.5.12.

4. Restarted PHP and the background tasks that run alongside each site, so nothing was left running the old version.

5. Double checked only the latest version of PHP was running on each server.

6. Checked the servers for unusual files or activity that could point to a break-in. Nothing turned up.

7. Restarted servers that had other security updates waiting, or arranged a time to do it with the client's IT team.

8. Checked that every site and its Control Panel worked as before.

Updating PHP was the only complete fix, and every site I look after now has it.

Why did the PHP update take most of the evening?

The fix itself was quick to install. The wait was for the files. After PHP released it, the updated package for Ubuntu took nearly three hours to build, and then what felt like every PHP server in the world tried to download it at once.

Because I already had access to every server I look after, I could install it the moment it was ready, retrying each download until it came through. Nobody had to find a password or wait for a hosting company to act.

Because I already had access to every server I look after, I could install it the moment it was ready.

Were any sites attacked?

No attacks using PHP2Shell had been reported when the fix was released. Although I fully expect we will start to see the impact of this security vulnerability very soon. Not everyone can update their software as quickly. What mattered was installing the fix quickly, and that is done.

What if your site isn't on a maintenance plan?

Ask whoever looks after your server which version of PHP it runs. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or anything newer in the same series. Older versions such as PHP 8.1 didn't get an official release, so a site on one of those needs a PHP upgrade.

The PHP security team's advisory and Wiz's PHP2Shell site have the full technical detail. For why a Statamic update alone could never have fixed this, see Critical PHP Security Update Incoming.

Fixes like this are a large part of what a website maintenance plan is for. When the next one comes, sites on a plan get it as soon as it is available, without their owners having to ask.