PHP2Shell: How Evermade prepared for and handled PHP’s historic critical vulnerability

In October, two critical vulnerabilities were discovered in the PHP programming language that affected nearly all web services running on PHP. As a precautionary measure, we took the services we maintain offline until a fix was available. All of our customers’ websites have been updated to use patched versions of PHP, and the sites are now operating normally again.

What happened?

In August 2026, cybersecurity researchers used artificial intelligence (Wiz, Calif, OpenAI) to discover two critical vulnerabilities in the PHP programming language (CVE-2026-109618 and CVE-2026-109619). Approximately 70% of websites run on PHP, including WordPress, Drupal, and many online stores. The vulnerabilities were rated as critical (9.2/10), triggering what is perhaps the most significant coordinated update process in the history of the internet.

In September, the PHP security team began implementing fixes and coordinating their distribution.

Information about the vulnerabilities was leaked to the public on Tuesday, October 20, before a fix was available. That same evening, PHP announced that it would release the patched versions on Wednesday, October 21, at 5:00 p.m. Finnish time.

On Tuesday morning, website administrators around the world woke up feeling anxious. The gravity of the situation began to dawn on them as information trickled in from cybersecurity firms, industry discussion groups, and media sources. Administrator teams assessed the necessary measures based on the criticality of the situation and the known timeline.

Why are these vulnerabilities critical?

These vulnerabilities could allow an attacker to execute their own code on the server without logging in. The flaw lies in PHP itself, so it affects all services running on PHP worldwide, not just a single content management system or plugin. Standard security plugins do not protect against vulnerabilities inherent in the programming language itself.

The National Cyber Security Center issued a bulletin about the vulnerabilities on the morning of October 21. According to the bulletin, there were no known active exploits at that time, but the situation could change quickly. According to PHP, an update was the only complete solution, and neither firewalls nor temporary safeguards made the installation secure.

The EU’s cybersecurity team, CERT-EU, as well as many other cybersecurity authorities around the world, recommended considering taking websites offline if patches cannot be installed immediately. Cybersecurity firms estimate that attacks will begin shortly after the patches are released. According to some reports, the first attack attempts were observed worldwide just hours before the release, as a result of the aforementioned leaks.

Evermade’s Measures

We decided to shut down all the online services we maintain as a precautionary measure on Wednesday at 12:00 p.m., before the fixes were released. This measure ensured that the vulnerability could not be exploited in our customers’ services while the fix was not yet available. Later in Finland, for example, the Government ICT Centre Valtori reached the same conclusion and shut down a large portion of the government’s public online services as a precaution, as did many other players in our industry globally. 

Here’s what we did:

• Assessment: Together with our information security team, we assessed the severity of the situation based on the information available and reviewed various possible courses of action.
• Communication: We informed our customers about the situation and the outage, explaining the reasons behind it, and we proactively provided updates on the situation both while it was ongoing and afterward. 
• Actions Taken: We took our clients’ websites offline and assisted them with follow-up measures.
• Update: We installed the fixes after they were released and gradually restored services online once we had verified that they were working properly.
• Monitoring: We are monitoring news coverage of the incident and keeping a close eye on our services following the update to detect any unusual activity. So far, we have not observed any signs of attacks on our services. We will continue to monitor the situation closely over the next few days.

Official fixes were released for PHP versions 8.2–8.5 (8.2.35, 8.3.36, 8.4.27, and 8.5.12). Unofficial fixes are available for older versions, so we will discuss updating services that use them separately.

We apologize for the outage and for the short notice of this announcement. We believe that a preventive shutdown was the right decision in light of such a widespread and serious vulnerability. 

The security of our clients’ websites is always our top priority.