PHP2Shell – our client websites have been patched and protected
Recent reports about PHP2Shell have understandably raised concerns for website owners. We want to reassure our clients that the security patch was applied across our managed client websites by 9:00pm BST on 21 October 2026, protecting them against these vulnerabilities.
What is PHP2Shell?
PHP2Shell is the name associated with two critical security vulnerabilities in PHP, the technology that powers many websites, including those built with WordPress and many other content management system. The vulnerabilities affect the underlying software running on a website’s server. If successfully exploited on an unpatched system, they could allow an attacker to run malicious code or access sensitive information.
Why was this such big news?
Because PHP is used so widely, the discovery prompted an urgent response across the hosting and website industry. The PHP development team released security updates on 21 October and advised users to update immediately.
What do I need to do?
For our managed clients, that patching work is complete. By 9:00pm BST on 21 October, the required security patch had been applied, addressing the PHP2Shell vulnerabilities within the hosting environment.
For other website owners, an important distinction is that updating WordPress, themes or plugins alone does not resolve this issue. PHP2Shell affects PHP itself, so the fix must be applied within the hosting environment. The PHP team confirms that installing the security update is the complete solution to these vulnerabilities.
Clients whose websites are hosted and managed by us do not need to install this patch themselves. If you have seen the headlines and are concerned about your website, please contact our team and we will be happy to help.
For businesses whose websites are hosted elsewhere, we recommend asking your hosting provider to confirm that the relevant PHP security updates have been installed. Keeping a website secure requires attention to both the website and the software supporting it, and this incident demonstrates why timely hosting updates matter.
