Last week the PHP project disclosed two critical security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, nicknamed "PHP2Shell". Both are rated 9.2 out of 10 for severity and, in the worst case, could let an attacker run their own code on a web server without needing to log in. Because they sit in PHP itself, they affect almost every PHP website on the internet, including the ones we build and look after.

The short version: every site we host has been patched, and you don't need to do anything. Here's how it played out.

The timeline

All times are UTC on Wednesday 21 October unless stated.

• 09:12 – Before the full details were public, all file upload requests were blocked across every site we host as a precautionary first line of defence.

• 14:00 – The PHP project released its fixes in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

• 14:54 – Our hosting infrastructure was prepared and ready to roll out patched builds as soon as the official PHP images landed.

• 17:33 – Patched PHP versions went live for all sites running PHP 8.2 and above.

• Friday 23 October – The fix was backported to all legacy PHP versions, meaning every site running PHP 7.4 or newer is now secure.

Blocking multipart form submissions, the type of request used for file uploads, was a deliberate precaution. Early information pointed to these requests as a likely route for an attack, so switching them off closed that door while we waited for the official fix. It meant uploads and some forms were briefly unavailable, but it kept sites protected during the window before the patches were released. Once patched PHP versions were live, normal form submissions were restored.

We haven't seen any indication that any of our clients' sites were compromised.

Do you need to do anything?

No. If we host your site, the patches have already been applied.

That said, this is a good reminder of why staying on a supported version of PHP matters. PHP 8.1 and older no longer receive official security updates, and PHP 8.2 reaches end of life on 31 December 2026. Legacy sites were only covered this time because of a special backport, and that isn't something to rely on in future.

Stay protected with Shape

Vulnerabilities like this are a reminder that a website is never "done". If you'd rather not think about security at all, Shape Support keeps your site safe in the background with uptime monitoring, regular Craft CMS and plugin updates, security scans and backups. If you want more than security, Shape Support adds a monthly retainer with priority support, so we can keep improving your site as well as protecting it. Get in touch and we'll find the right fit for you.