Skip to content
PHP2Shell: as a precaution, we are taking client sites offline until the 16:00 CEST security update is installed.
CodeIQ

Notice · Updated live

PHP2Shell: critical PHP vulnerability, update today at 16:00 CEST

Today at 16:00 CEST, PHP is releasing an emergency update for two critical security vulnerabilities. As a precaution, we are taking the websites and applications we manage offline until that update has been installed and tested. Here you can read what is going on, what we are doing and what it means for you.

Status
Client sites temporarily offline
Last updated

Updates

Newest first

  1. 16:33

    Resolved, all services back online

    Within 38 minutes of the fix being released, all systems we manage have been updated, checked and brought back online. We also reviewed for any suspicious activity and found none. If your service is reachable again, the flaw has been closed.

  2. 15:49

    The fix is out, we are updating systems

    The official PHP fix is now available. We are installing the update across all systems we manage, checking that everything works, and bringing the services back online. If your website or application was offline with us, that is only for a short time. Once your service is reachable again, the update has been applied and the flaw is closed.

    Still running an older PHP version (8.1 or earlier)? There is no regular fix for those. In that case we will contact you separately to look at isolating or upgrading together.

  3. 15:20

    We blijven paraat tot reparatie

    De officiële PHP-reparatie wordt om 16:00 verwacht. De diensten die we uit voorzorg offline hebben gehaald, blijven offline tot de update is geïnstalleerd en getest. We staan klaar om direct bij te werken zodra de reparatie beschikbaar is.

  4. 12:30

    Client sites took down

    As a precaution, we are taking the websites and applications we manage offline until the 16:00 CEST update has been installed and tested. You do not need to do anything. We will let you know as soon as your site is back online.

  5. 08:30

    Beveiligingslek in PHP bekendgemaakt

    A serious security flaw in PHP was disclosed today, known as PHP2Shell. PHP is the technology that many websites and web applications run on. The official fix is due this afternoon at 16:00 CEST. Because the information leaked early, we are acting today and will keep you updated here.

The full story

What is going on

PHP is the programming language that runs a large part of the web, including most of the websites and applications we build and manage. Today at 16:00 CEST, PHP is releasing an emergency update for two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. They have become known as PHP2Shell and both score 9.2 out of 10.

They allow remote code execution: in the worst case, someone on the outside can run their own code on a server. The details leaked early on Tuesday evening. That is why PHP moved the release forward by a day, and security researchers expect attackers to start looking for unpatched servers right after 16:00.

Why we are taking client sites offline

The vulnerability is in PHP itself, not in a plugin or framework. According to early reports, it is triggered while processing forms and uploads, which PHP does before any website code runs. A security plugin, Laravel or WordPress will not stop it.

Until the update is out, no measure fully closes the hole. So we are taking the safest route: the websites and applications we manage go offline until the update has been installed and tested. We would rather be unreachable for a few hours than run a server someone else can get into.

What we do from 16:00

  1. We read PHP's official advisory and establish which versions are affected.
  2. We install the update on every server we manage and restart PHP and everything running on it, such as background jobs and queues.
  3. We check that nothing suspicious has happened: changed files, new accounts or connections that should not be there.
  4. We test that forms, uploads and logins work.
  5. Then we bring the sites back online, one by one.

We keep track of our progress on this page.

What it means for you

Is your website or application hosted with CodeIQ? You do not need to do anything. Your site will be unreachable for a few hours and we will let you know when it is back online.

Is your site hosted elsewhere? Ask your hosting provider whether they are installing the update today. Note: PHP 8.1 and older are not expected to get an update. Those need to be shielded or upgraded.

Not sure who is handling this? Call +31 10 318 0515 or email info@codeiq.nl and we will take a look today.

What is not known yet

Until 16:00, PHP has only confirmed that there are two critical vulnerabilities, how severe they are and when the update is coming. Which versions are affected and how the vulnerability works will be published by PHP at 16:00. What is written above about the cause comes from researchers' reports and may turn out differently. We will update this page as soon as more is known.

Frequently asked questions

Has anyone broken in?

There is no indication of that. As of Wednesday morning, no exploitation of the vulnerability had been seen anywhere. We are taking sites offline precisely to keep it that way, and after the update we check every server.

How long will my site be offline?

Until the 16:00 update has been installed and tested. We start right after the release and bring sites back one by one. You can follow our progress above.

Will I lose data or orders?

No. The site and the database stay as they are; they are just temporarily unreachable. Forms or orders that visitors try to send during that time will not come through, though.

My site runs on WordPress, Laravel or something else. Am I safe?

The vulnerability is in PHP itself, so the framework does not matter. Every site running on PHP needs to be updated. Sites that do not run on PHP, such as a Shopify store, are not affected.

Can I test whether my server is vulnerable myself?

Leave that to whoever manages your server. Be careful with test scripts going around: researchers warn that some of them are malicious themselves.

Got a question?