The PHP Foundation released emergency patches on October 21, 2026 for two flaws that let an outsider run commands on a web server without logging in. In a client office, a technician sees it first as a question nobody can answer: which PHP version does the company website run on, and who looks after that server?
What ThreatLocker reported
ThreatLocker reported that the PHP Foundation issued a security advisory and emergency patches for two runtime vulnerabilities, grouped under the name PHP2Shell. According to the article, several common ways of serving PHP pages are exposed, among them Apache’s module setup, the FPM process manager, FrankenPHP and LiteSpeed. It cites an estimate that about 70% of websites run on PHP-based systems such as WordPress, Joomla and Drupal.
The flaw comes from how PHP behaves when a request makes it run out of memory. A crafted upload request can leave stale data behind, and a later request can end up running commands the attacker chose.
The PHP Foundation’s advice, as ThreatLocker relays it, is to patch. Temporary settings exist, such as lowering upload size limits and turning off a session upload feature. They cut exposure on specific paths but do not make an outdated install safe.
What it looks like in a client’s office
Nobody on staff sees anything on screen. The website keeps loading and the contact form keeps working. The work happens on the server, where a technician has to find out what is running.
We checked one client’s website for signs of compromise after the disclosure and found none. We still rebuilt the site on a newer, locked-down hosting setup, because the old one was a risk whether or not anyone had touched it. At the client’s request we switched the new site live in the evening, when few people were on the server. It needed no downtime and no reboots.
We warned another client and asked whether their WordPress sites were patched. The patch has to come from whoever manages their server. We told them we could apply it too, if we got host-level access.
Data Cube Systems technicians read earlier tickets first, so the last note about that server often says who holds the keys. Before a major change they take a backup or snapshot, and they usually schedule the work after hours.
Where a website falls through the cracks
A fully updated WordPress site can still sit on a vulnerable foundation. Plugin updates fix plugins. They do not change the PHP underneath, and that belongs to whoever runs the server. Often that is a hosting company, a former web designer or a vendor the office has not spoken to in years.
So each party assumes another one handled it. The owner thinks the host patched. The host thinks the site’s builder did.
The temporary settings add a second trap. They are worth applying while a patch is unavailable, but ThreatLocker’s article is clear that they are not a fix. Once someone ticks that box, the ticket tends to get closed and the server is forgotten.
The cost is time and exposure. ThreatLocker notes that a compromised web application can give an attacker access to sensitive data or systems the web server can reach. A planned upgrade on a quiet evening costs far less than cleaning that up.
What to check this week
Find out who hosts your website and who is responsible for the server. Ask them which PHP version is running and whether it is a fixed release from October 21 or later. Get the answer in writing. “We keep it updated” does not count.
Then ask what happens if the answer is no. Request a date, a backup before the work and a test of the site afterward. Have them check the server’s logs for odd activity too, such as new executable files in upload folders. If nobody owns the site, treat that as your finding. A website without an owner is better rebuilt or retired than left on software with a known hole.