On 21 October 2026, two critical security flaws in PHP were disclosed, known as “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619). Attackers can use them to run malicious code on web servers without a password and take over websites.

Every website that runs on PHP and hasn't been updated yet. That includes most sites built with WordPress, Joomla, TYPO3, Drupal, Shopware or PrestaShop.

What should I do now?

Ask your hosting provider or web developer whether PHP has been updated. PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 and newer are safe. PHP 8.1 and older no longer get official updates.

Breaking: PHP2Shell

Is your website affected by the PHP flaw?

Our free quick check shows in seconds whether your website runs on PHP and what to do next.

PHP2Shell in three sentences (as of 22 October 2026)

What happened?: On 21 October 2026, two critical security flaws in PHP were disclosed, known as “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619). Attackers can use them to run malicious code on web servers without a password and take over websites.
Who is affected?: Every website that runs on PHP and hasn't been updated yet. That includes most sites built with WordPress, Joomla, TYPO3, Drupal, Shopware or PrestaShop.
What should I do now?: Ask your hosting provider or web developer whether PHP has been updated. PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 and newer are safe. PHP 8.1 and older no longer get official updates.

What the press is saying

Millions of attacks after serious PHP flaws were published (Der Standard, 22 October 2026, in German)
Millions of attacks, some even before the official disclosure. Servers without the update are at risk.
What it means for you Attackers aren't waiting. If PHP hasn't been updated yet, get it done today, not next week.
Cinema chain Cineplexx takes its website offline (Kronen Zeitung, 22 October 2026, in German)
Austrian companies are playing it safe too.
What it means for you If even large companies go offline as a precaution, small businesses should ask their hosting provider today whether PHP has been updated.
Many websites restricted after security flaw discovered (DIE ZEIT, 22 October 2026, in German)
In Germany, too, many websites are restricted or offline.
What it means for you Hospitals and public authorities are affected too. The flaw hits every industry, not just IT companies.
PHP2Shell: AI models found the mega security flaw (Trending Topics, 21 October 2026, in German)
How the flaws were found with the help of AI, and why many websites in Austria went offline.
What it means for you AI helps find flaws, for attackers as well. You stay safe by updating constantly, or by not running PHP on your server at all.
Serious PHP security flaw threatens millions of websites (SRF, 21 October 2026, in German)
Swiss public broadcaster: websites in Switzerland went offline as a precaution too. The fix only exists for PHP 8.2 to 8.5.
What it means for you There's no update for PHP 8.1 and older. If your website still runs on it, it needs to be switched over or rebuilt.
NÖN, OTS and other Lower Austrian websites offline (MeinBezirk, 21 October 2026, in German)
In Lower Austria, the newspaper NÖN and the press release service OTS were among those that went offline as a precaution.
What it means for you Regional organisations are affected too. Being small or well known doesn't protect you.
php2shell: critical flaws allow code injection in PHP (heise online, 21 October 2026, in German)
Germany's leading IT news site: both flaws sit in PHP's memory management. Versions all the way back to PHP 5 are affected.
What it means for you A WordPress or plugin update won't help. Your hosting provider has to install the update on the server.
“PHP2Shell”: security flaws put websites at risk (ORF, 21 October 2026, in German)
CERT.at, Austria's national computer emergency team, issues a warning. The University of Vienna, TU Wien and the regional newspaper NÖN temporarily took their websites offline.
What it means for you When CERT.at issues a warning, it's serious. The quick check above shows in seconds whether your website runs on PHP.

Explainer videos

PHP2Shell - Pflichtvideo für Admins: So kannst Du dich in Zukunft besser schützen (YouTube, Linux Guides)
In German: how to check whether a server is affected and close the gap.
php2shell What to do: Are You Affected and How to Patch Fast (YouTube, Aikido Security)
A short guide to checking whether you're affected and patching quickly.
PHP2Shell Explained: The Vulnerabilities, the Risk, and Remediation (YouTube, Sonatype)
What the two flaws are, how big the risk is and how to fix them.
PHP2Shell Explained: The PHP Bug That Put 70% of Websites at Risk (YouTube, SimplyExplain)
Explained simply, and it also corrects some exaggerated headlines.

Two options, but only one of them lasts.

Short term: Update PHP

Closes this hole. But PHP, WordPress and every plugin need constant updates. If nobody keeps doing that, you'll be exposed again when the next flaw comes along.

Long term: A new website without PHP

Your website is built in advance and served as simple files. No program runs on the server that attackers could exploit. No PHP updates, no plugins.

No PHP, no plugins, nothing to patch
Loads much faster
Optimised for Google and AI search such as ChatGPT
You keep your content and your web address
Edit your own text in a simple content editor
Your contact form keeps working

Three steps to a website without PHP

Quick check: Free, at the top of this page. You'll see right away whether your website runs on PHP.
Call and quote: 15 minutes with Markus, booked directly online. Afterwards you get a no-obligation quote.
Your new website goes live: We move your content and handle the switch. Old links are redirected so you keep your Google ranking.

Frequently asked questions

What is PHP2Shell?

PHP2Shell is the name for two critical security flaws in PHP (CVE-2026-109618 and CVE-2026-109619), published on 21 October 2026. They let attackers run their own code on a web server without logging in.

How do I find out whether my website is affected?

Use our quick check at the top of this page. It shows whether your website shows signs of PHP and whether an outdated version is visible. For certainty, ask your hosting provider whether the PHP2Shell update has been installed.

Which PHP versions are safe?

PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 and newer. PHP 8.1 and older no longer get official updates and should be replaced.

Isn't updating PHP enough?

For this flaw, yes. But a PHP website needs constant updates: PHP itself, the CMS and every plugin. A website without PHP doesn't have that problem.

What does “a website without PHP” mean?

The pages are built in advance and served as simple files, a bit like a PDF. No PHP and no CMS runs on the server, so there's nothing to attack. joize.at is built this way too.

Can I still edit the text myself?

Yes. You get a simple online content editor. It runs separately from your website, so it isn't a way in for attackers.

Will I lose my Google ranking?

No. Your web address stays the same, and we redirect old links to the new pages. Rankings often improve, because the site loads faster.

Is the quick check legal and safe?

Yes. We load your homepage once, like a normal visitor, and look at what is publicly visible. We don't attack anything and we don't change anything.

Contact

Rather talk right away? 15 minutes with Markus. Free and no obligation. Just pick a time that suits you. Book a call (Markus Bruckgraber, Co-Founder)

Joize FlexCo, Vorarlberg, Austria. Email: hello@joize.at