Critical PHP vulnerability: our response
.avif)
What this means for your website
A critical security vulnerability known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619) has been disclosed, affecting PHP, one of the technologies most widely used to power websites and web-based applications.
Both vulnerabilities have been given a CVSS critical severity score of 9.2, and can potentially allow an unauthenticated attacker to execute code on a vulnerable system. Because PHP runs such a large share of the web, this is a global issue. Sky News has reported on the scale of it.
What’s affected?
The vulnerability affects PHP itself, so it has the potential to impact a broad range of websites and internet-facing applications that rely on vulnerable versions of PHP. Potentially affected systems include:
- Websites running PHP
- WordPress and other PHP-based websites
- PHP-based web applications
- Internet-facing applications that depend on or embed PHP
- Servers running vulnerable PHP versions
The security fixes are included in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
What Flotek is doing
As part of our ongoing security management, Flotek is proactively applying the necessary security patches across the environments we manage. Our technical teams are:
- Identifying services running PHP
- Checking PHP versions across our managed environments
- Prioritising internet-facing websites and applications
- Applying the newly released PHP security updates where required
- Updating PHP versions to patched releases
- Continuing to monitor managed environments for signs of attempted exploitation
On 22 October 2026, the majority of websites Flotek manage had already been updated, and we expected all affected websites and applications under Flotek management to be fully patched by 4pm that day. It’s part of the proactive protection that comes with our managed IT support.
No action is required from you for websites, applications or environments managed by Flotek.
If Flotek doesn’t manage your website or application
PHP2Shell is a global vulnerability. If your website, hosting environment or web application isn’t managed by Flotek, we strongly recommend you:
- Contact your website developer, hosting provider or application supplier
- Ask them to confirm whether your website or application uses PHP
- Ask which version of PHP is currently running
- Ask them to confirm that the latest PHP2Shell security patches have been applied
- Make sure internet-facing PHP systems are prioritised for remediation
How Flotek can help
If you’re unsure whether a website or application is affected, or you’re concerned about an environment that isn’t currently managed by Flotek, our team can help you identify whether PHP is in use, check the version currently running and advise on the remediation or patching required. Find out more about our cyber security services.
We’re continuing to monitor the situation closely and will contact any partners directly should we identify anything requiring specific action. For further technical information, see the NCSC advisory on this PHP security issue.
Concerned about a website or application? Speak to Flotek.
Further reading
Free dark web scan is back: check whether your business emails and passwords are exposed online.
Who is responsible for cyber security?: who owns security in your business, and why it matters.
CyberGuard: managed detection and response, powered by a human-led security operations centre.
.jpg)
Want it fixed and kept that way? From just £14 a month, we verify your domain and monitor it 24/7, so your email lands and nobody else can send as you.
.avif)
.avif)
%20(1).avif)