A website can look perfectly normal on the outside while facing a serious security risk behind the scenes. That is why website security is not just about having a strong password or an SSL certificate. It also means keeping the software running your website up to date.
On 21 October 2026, the PHP development team released emergency security updates to fix two critical security vulnerabilities, collectively known as PHP2Shell. These vulnerabilities could allow attackers to run harmful code on affected web servers without logging in.
At Makura Creations, we took this issue seriously. Our team reviewed the security updates and applied the necessary patches to our managed VPS and shared hosting servers to address the vulnerability. For our clients, the important message is simple: we identified the issue, took action, and continue to take website security seriously.
What Is PHP, and Why Should Website Owners Care?
PHP is a programming language used to build and run websites. It is widely used by WordPress websites, online stores, booking systems, business websites, and many custom web applications. If your website uses WordPress or WooCommerce, for example, there is a good chance PHP plays an important role in running it.
You do not need to understand PHP to own a website, just as you do not need to understand how a car engine works to drive a car. However, the software running your website needs regular maintenance to keep it reliable and secure.
When a weakness is discovered in PHP itself, the risk can extend beyond a single website. Multiple websites running on vulnerable server software may be affected, even if their designs, content, and features are completely different.
What Happened? Understanding the PHP2Shell Vulnerability
PHP2Shell refers to two critical security vulnerabilities identified as CVE-2026-109618 and CVE-2026-10961. Both vulnerabilities received a severity rating of 9.2 out of 10 under the CVSS 4.0 scoring system, placing them in the critical category.
In simple terms, these weaknesses could allow an attacker to send specially crafted requests to a vulnerable server and exploit problems in how PHP handles certain internal operations.
The two vulnerabilities involve different technical problems:
- CVE-2026-109618: A problem with how PHP handles memory when a request uses too much memory under particular circumstances.
- CVE-2026-109619: A problem involving memory that PHP may continue to reference after it has been released. Certain application and session-handling conditions can make this weakness exploitable.
You do not need to remember these technical details. What matters is the possible outcome: an attacker could potentially execute harmful instructions on an affected server without needing a valid account. This is more serious than an ordinary website bug because the consequences could extend beyond a broken page or a minor error.
How Could Attackers Exploit the Vulnerability?
To understand the risk, imagine your website as a shop. Your website has a front door that visitors use to browse products, read information, or submit enquiries. Behind that door is the system that processes their requests and retrieves information from your database.
PHP helps perform many of these tasks. Under normal circumstances, the server receives a request, processes it, and returns the appropriate response. The PHP2Shell vulnerabilities introduced a way for an attacker to exploit specific weaknesses in that process.
A successful attack could potentially allow the attacker to:
1. Run unauthorised instructions
An attacker could attempt to make the server run instructions that were never intended by the website owner.
2. Access sensitive information
Depending on the extent of the compromise, information stored on the server, including business or customer data, could be exposed.
3. Change website content
An attacker who gains sufficient control could modify website pages, insert unwanted content, or interfere with normal website operations.
4. Use the server for other harmful activities.
A compromised server could potentially be used to run malicious programs, attack other systems, or carry out activities without the owner’s knowledge.
These are potential consequences of successful exploitation, not proof that every website running PHP was compromised. The actual risk depends on the PHP version, server configuration, and whether an attacker successfully exploited the vulnerability.
Timeline: How the PHP Security Issue Unfolded
Understanding the timeline helps explain why website owners and hosting providers needed to respond quickly.
August 2026: Security research identifies weaknesses.
Security researchers identified serious weaknesses in PHP during August 2026. The findings were investigated and reported through the responsible security disclosure process so that fixes could be prepared.
17 October 2026: An early exploitation attempt is detected.
Amazon’s threat intelligence team later reported detecting an attempt to exploit the vulnerabilities in its honeypot network on 17 October, four days before the public disclosure.
A honeypot is a system designed to attract and record suspicious activity so security researchers can study how attackers behave.
This finding was important because it suggested that attempts to exploit the vulnerabilities may have begun before the public announcement.
20 October 2026: Details emerge ahead of schedule.
Information about the vulnerabilities became public earlier than the planned coordinated disclosure. This increased the urgency for PHP developers, hosting providers, and website administrators to prepare for the security release and update affected systems.
21 October 2026: Emergency security updates are released.
The PHP development team released security updates addressing both critical vulnerabilities. The fixed versions included PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Security organisations also began publishing guidance, while infrastructure providers reported attempts to exploit the weaknesses.
23 October 2026: Further security guidance emerges.
Security agencies continued warning about exploitation attempts. PHP also disclosed a separate security concern involving a particular session-handling configuration. This reinforced an important lesson: security maintenance does not end with a single software update. Website operators need to keep following relevant security advisories and apply additional fixes when necessary.
The timeline above reflects public reporting available as of 26 October 2026. Security findings and guidance may continue to evolve.
What Does This Mean for Businesses in Nepal?
For many businesses in Nepal, a website is more than an online brochure. It may be the primary source of customer enquiries, online sales, bookings, payments, or business information. A security incident could interrupt these activities and damage customer trust.
Consider a few common examples:
- An online store: If an attacker compromises the server, the store could become unavailable, or customer information could be exposed.
- A travel and trekking company: A compromised booking website could disrupt enquiries, reservations, and communication with international customers.
- A financial or service business: A website compromise could expose sensitive information or create opportunities for fraud.
- A small business website: Even a relatively simple website could be altered, taken offline, or used to distribute harmful content if its underlying server is compromised.
A smaller business is not automatically protected simply because it has fewer visitors. Automated tools can search the internet for vulnerable servers without knowing who owns them. That is why timely security updates matter to businesses of every size.
What Did Makura Creations Do About PHP2Shell?
When a critical vulnerability affects widely used website software, the response should be practical, timely, and focused on reducing risk. At Makura Creations, we took action on the affected server environments we manage.
1. Reviewed the security issue and available patches
We reviewed the PHP security announcements and the available updates to understand the nature of the vulnerabilities and the appropriate response for our managed environments.
2. Applied security patches to our managed VPS servers
We applied the relevant security patches to our managed Virtual Private Server (VPS) environments. A VPS is a virtual server that runs websites and their supporting software. Keeping its underlying software updated is an important part of protecting the websites hosted on it.
3. Applied patches to our shared hosting servers
We also applied the relevant patches to our shared hosting servers. Shared hosting allows multiple websites to operate on the same server infrastructure. Because those websites may depend on the same underlying PHP installation, server-level security updates are especially important. Updating an individual website’s content or plugins is not enough when the vulnerability exists in the PHP software running on the server.
4. Focused on the underlying server, not just the website
A security problem in the server software cannot necessarily be fixed by changing a WordPress plugin, updating a theme, or modifying a website’s design. Our response therefore included the relevant server-level patches, rather than relying solely on changes to individual websites.
5. Continued treating security as ongoing maintenance
Applying a patch is an important step, but responsible website maintenance also involves keeping software current and responding to new security advisories as they emerge. We encourage our clients to see security as an ongoing responsibility rather than a one-time task.
Our priority was to address the vulnerability at the server level across the managed VPS and shared hosting environments under our care.
Does This Mean Every Website Is Automatically Safe?
No responsible technology company should promise that any website is completely immune to every possible attack. Applying the relevant PHP security patches addresses the vulnerabilities covered by those updates.
However, overall website security also depends on other factors, including application code, plugins, passwords, access permissions, server configuration, and the presence of any earlier compromise. A website that was vulnerable before a patch was installed may also require further investigation if there are signs that an attacker gained access. This is why keeping software updated and checking for suspicious activity are both important.
For our clients, we have taken the necessary patching steps in the managed VPS and shared server environments we maintain. We will continue to follow relevant security guidance as it develops.
What Can Website Owners Do to Stay Protected?
You do not need to be a technical expert to take a few useful precautions, which include:
- Keep your website software updated: Make sure your website’s content management system, plugins, themes, and other components receive appropriate security updates.
- Use strong passwords: Avoid reusing passwords across accounts. Enable two-factor authentication wherever it is available.
- Maintain regular backups: Keep reliable backups of your website and database so you have a recovery option if something goes wrong.
- Choose a hosting provider that takes security seriously: Ask how server software is updated and how security issues are handled.
- Pay attention to security notifications: If your website developer or hosting provider contacts you about an urgent update, do not ignore it.
- Ask for help when something seems unusual: Unexpected redirects, unfamiliar website content, suspicious login activity, or unexplained downtime should be investigated.
If your website is hosted by another provider, ask them whether the relevant PHP security patches have been applied. Updating your website’s plugins alone does not necessarily fix a vulnerability in the underlying PHP installation.
A Final Word from Makura Creations
The PHP2Shell incident is a reminder that website security requires attention even when everything appears to be working normally. For business owners, the technical details can be difficult to follow. You should not have to become a server administrator to run your business successfully. You should, however, be able to rely on your technology partner to take security concerns seriously and respond when they arise.
At Makura Creations, we applied the relevant security patches to our managed VPS and shared hosting servers to address this issue. We understand the importance of protecting the websites and business operations entrusted to us. If your website is under our care, you can rest assured that we took this security issue seriously and acted to address it.
We will continue to maintain the systems we manage, follow important security updates, and help our clients keep their websites reliable and secure. If you are unsure whether your website is running on an updated PHP version, contact your developer or hosting provider and ask for confirmation. A simple question today can help prevent a much bigger problem tomorrow.
