You may have seen headlines this week about “PHP2Shell” or even the “PHP-ocalypse.” The hype is a little dramatic, but the problem is real, and it’s worth ten minutes of your time. Here’s what happened, what we’ve already done for you, and what else in your business might need attention.
What happened
PHP is a programming language that runs behind a huge share of the web. You’ve probably never touched it directly, but it powers WordPress websites, online stores, customer portals, and the web-based admin screens on lots of business equipment.
On October 21, the PHP project released fixes for two critical security flaws, nicknamed PHP2Shell. In plain terms, they let an attacker take over an unpatched server from the internet without needing a password. That’s about as serious as it gets.
Three things make this one urgent:
- Attacks started before the fix. Amazon’s security team saw exploitation attempts as early as October 17, four days before the patches came out.
- The government has flagged it. On October 26, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both flaws to its list of vulnerabilities known to be actively exploited.
- It’s everywhere. Any server that uses PHP to handle web requests is potentially at risk, and the flawed code goes back more than a decade.
Your phone system is covered
If Valentine Systems manages your phone system, you don’t need to do anything. We’ve reviewed and protected the phone systems we support against PHP2Shell. Your calls, voicemail, and phone admin portal are taken care of.
We’re telling you this because the phone system is the PHP-based system we know you have. It probably isn’t the only one.
The rest of your business may not be
PHP shows up in many places small businesses don’t think of as “servers.” If anything on this list is in your office or online under your name, someone needs to confirm it’s been updated:
- Your website. WordPress, Drupal, and Joomla all run on PHP. So do most WooCommerce and similar online stores. Your hosting company may patch PHP for you, but don’t assume. Ask.
- Customer or client portals. Booking systems, payment portals, and intake forms are often PHP behind the scenes.
- File-sharing and collaboration tools you host yourself. Self-hosted tools like Nextcloud or ownCloud run on PHP.
- Webmail. Self-hosted webmail such as Roundcube is PHP-based.
- Help desk, CRM, and business apps. Open-source ticketing, CRM, and inventory tools (osTicket, SuiteCRM, Dolibarr, and others) are commonly built on PHP.
- Database admin tools. phpMyAdmin is a frequent target and is often left exposed to the internet by accident.
- Network and office equipment. Routers, firewalls, VPNs, and storage devices (NAS) sometimes use PHP in their web admin pages. Security camera recorders are worth checking too. Patching these means a firmware update from the manufacturer.
- Old “set it and forget it” servers. That machine in the closet that runs one thing, and that nobody has logged into in three years, is the one that worries us most.
One important catch: older PHP versions aren’t getting official fixes. Versions 7.3 and earlier are past end-of-life and won’t be patched at all. If a system runs very old software, the right fix may be an upgrade or a replacement, not a patch.
What you should do this week
- Make a quick list of anything above that your business uses, including your website and anything a vendor set up for you.
- Ask your website host or developer directly: “Has our PHP been updated for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)?” Get a yes or no, not a “probably.”
- Check your equipment for firmware updates: routers, firewalls, NAS devices, and camera recorders.
- Make sure services were restarted after patching. Installing an update doesn’t protect PHP processes that are already running.
- Take anything you can’t patch off the internet until it’s fixed or replaced.
- Watch for odd behavior going back to October 17: unexpected admin accounts, unfamiliar files on your website, or a sudden slowdown.
We can help
If you’re not sure what’s running in your office, or you’d rather not chase vendors yourself, that’s what we’re here for. Contact Valentine Systems and we’ll help you find your PHP-based systems, confirm they’re patched, and close the gaps.
