PHP2Shell: Website Down or PHP Upgrade Failed?

On 20 October 2026, the PHP project announced urgent security updates. Fixes for two critical vulnerabilities were released on 21 October.

The vulnerabilities are identified as:

• CVE-2026-109618
• CVE-2026-109619

Together, they are known as PHP2Shell. Both were rated critical, with a CVSS v4.0 score of 9.2.

The flaws concern internal memory and state handling in the PHP runtime. In certain circumstances, processing a web request can cause PHP to access invalid memory or memory that has already been freed.

This is more than an ordinary application error. Under suitable conditions, an attacker could exploit the vulnerabilities to execute code on an affected server, potentially without authentication.

The underlying defects are in PHP itself, not in one particular website or extension. An up-to-date CMS, modern theme or security plugin therefore cannot replace the necessary PHP runtime update.

Which PHP versions contain the security fixes?

The PHP project released the following fixed versions on 21 October 2026:

This table records the security release of 21 October 2026. For an actual upgrade, use the latest available, appropriately patched version supported by your provider.

Official security support for PHP 8.2 also ends on 31 December 2026.

The position is more complicated for older, end-of-life PHP branches. Linux distributions, hosting providers or commercial maintenance services may provide backported security fixes.

A provider backport may retain the same PHP version number. We therefore check the package release, build date and vendor advisory as well; the version number alone does not establish whether the fixes are installed.

A backport can help in the short term. It does not automatically put the entire application on a sustainable technical foundation.

Important: A vulnerable PHP version is not evidence that your website has already been compromised. A hosting suspension does not prove a successful attack either; it may be precautionary.

A hosting notice may say that a PHP version can no longer be used safely, that an upgrade is required or that the website has been temporarily disabled. The technical causes behind these situations can differ.

Situation 1: The existing PHP version is no longer adequately protected.

We establish which version actually runs on the server, what security updates are available and whether the hosting provider has supplied appropriate fixes.

Situation 2: PHP has been updated, but the website no longer works.

The security update may already have been installed successfully. The application itself may be incompatible with the new PHP version. Its code, extensions, dependencies and error messages need to be investigated.

Situation 3: There are signs of a possible security incident.

A version update alone is not enough. Potential modifications, unusual files, suspicious access and affected credentials must be investigated according to the specific risk.

A security update closes a vulnerability. It does not automatically undo changes an attacker may already have made.

What to avoid initially

Do not make random changes to PHP versions, extensions or database settings on the production website.

Where possible, preserve the current state and relevant error messages, and find out what protective measures your host has taken. If compromise is suspected, the investigation needs appropriate evidence preservation and documentation.

Above all, do not permanently re-enable a known vulnerable PHP version simply to make the homepage appear again.

A working website is only good news if it is not also creating an unnecessary security risk.

PHP has evolved substantially over the years. Functions have been removed, language behaviour has changed, security mechanisms have improved and technical requirements have moved on.

An application originally written for PHP 5.6 or PHP 7.4 will not necessarily run correctly on PHP 8.3, 8.4 or 8.5.

Old libraries, database access methods, CMS extensions and custom modules can introduce further compatibility constraints.

Common symptoms include:

• A blank page with no visible content.
• HTTP 500 errors after switching PHP versions.
• An administration area that can no longer be reached.
• Broken forms, booking features or shopping baskets.
• Errors caused by PHP functions that are no longer supported.
• Database connection or query problems.
• Extensions that do not work with the current PHP version.

Some problems can be fixed through targeted code changes. Others require larger version upgrades, replacement dependencies or structural modernisation.

Selecting the newest PHP version in a hosting panel and hoping for the best is therefore not a reliable plan.

An up-to-date runtime is only part of the requirement. The entire application needs to work reliably with it.

Older Contao installations may require additional technical work when PHP must be updated.

Contao is an established content management system used for business websites, portals and custom web applications. Long-running installations often include numerous extensions, customised templates and project-specific modules.

If the system has not been comprehensively maintained for some time, a direct move to a current PHP version may fail.

ProWebSolutions also takes over Contao websites built by other developers and agencies.

We inspect the installed Contao version, extensions and dependencies, then develop an appropriate upgrade path.

This includes considering:

• Existing pages, content and navigation.
• Customised templates and modules.
• Forms and administration features.
• Database structures.
• Existing URLs and redirects.
• Compatibility with a supported PHP version.

Where technically practical, larger upgrades are carried out in a separate test environment first.

The goal is a maintainable Contao installation that can be operated reliably while preserving the existing design and functionality as far as possible.

A security update does not automatically have to become a complete website relaunch.

Not every website uses a mainstream CMS. Many businesses rely on custom administration tools, customer portals, booking systems or other PHP applications that have performed important tasks for years.

Difficulties arise when the original developer is unavailable, documentation is missing or nobody has a dependable picture of the application's dependencies. An essential PHP upgrade can then seem impossible.

Existing code is a technical foundation to understand and assess, not something to discard automatically.

ProWebSolutions takes over, develops and modernises established PHP systems. We analyse program structures, database access, libraries and integrations to assess what can remain and where changes are necessary.

That may mean replacing individual obsolete functions, updating larger dependencies or carefully replacing specific technical areas.

Applications without complete documentation can often be understood progressively. What matters is a traceable approach that does not put business-critical functionality at unnecessary risk.

A website can be technically outdated and still have substantial business value.

Its design may work well. Its content may have built up search visibility over many years. Its application may support particular workflows that standard software cannot handle.

These assets should not be abandoned lightly.

When a PHP upgrade becomes necessary, we first assess whether modernisation is technically and economically sensible. That may involve updating individual components, adapting existing PHP functions or upgrading the CMS.

A complete rebuild can be the right choice when the architecture, condition or required scope of change warrants it. The decision should follow a technical assessment, not simply the age of the PHP version.

Not every website needs a new face. Sometimes its technical foundation needs to be brought back to a dependable standard.

We start with the existing system and the actual problem, not a standard relaunch proposal.

1. Assess the technical position

We establish the PHP version, the application it runs and the reported symptoms. The assessment considers the host, server environment, installed dependencies and available error messages.

2. Prioritise risks and actions

Immediate security and operational risks come first. We distinguish urgent measures from later improvements and identify what is genuinely necessary for reliable continued operation.

3. Prepare backups and a controlled test path

Before substantial changes, we review the available backups and prepare a suitable way to test the upgrade. Where the environment allows it, we use a separate test installation first.

4. Update PHP and the application

We carry out the required upgrades and adapt incompatible application components. The scope includes CMS versions, libraries, extensions and database access, not PHP alone.

5. Test functionality and stabilise operation

A successful upgrade means more than a visible homepage. We check essential features, integrations and business workflows, with controlled deployment and suitable recovery options.

Ongoing maintenance and regular security updates can be provided where needed.

The effort depends on how the application is built and which changes are actually required.

A smaller website with few dependencies can be comparatively straightforward to upgrade. A substantial CMS with many extensions or a custom application developed over many years may require significantly more investigation and development.

A fixed price without understanding the system would not be a responsible promise.

Our approach is to define the necessary work transparently and preserve existing investment where that makes sense.

We assess the starting position, explain the required measures and discuss the likely scope and effort.

If a few targeted changes are sufficient, the work does not need to become a large development project. If broader modernisation is appropriate, you should know early, before avoidable costs arise.

At the latest, review your technical strategy when the PHP branch in use no longer receives official support.

PHP 7.4 and PHP 8.1 no longer receive regular security updates from the official PHP project, although individual providers may supply their own fixes.

PHP 8.2 is also approaching the end of official security support on 31 December 2026.

Modernisation should therefore address more than the immediate vulnerability. Choose a PHP version that is compatible with the application, actively supported through an appropriate maintenance arrangement and sustainable for ongoing operation.

This helps prevent the next required update from immediately becoming another emergency.

A security incident, an unavailable website or a failed PHP upgrade is difficult enough already.

What you need is a clear technical assessment, not an automatic demand to replace the entire application.

ProWebSolutions GmbH in Leipzig, Germany, helps businesses take over, secure and modernise established PHP websites.

Whether you run Contao, custom PHP software or another established web solution, we investigate the situation, explain the viable options and plan a path towards dependable operation.

Briefly describe your system, the information supplied by your host and the problems you are seeing. We do not need credentials or confidential technical information for an initial enquiry.

ProWebSolutions GmbH — understand established software, modernise deliberately and keep it operating reliably.

Technical information reviewed: 8 November 2026.