PHP2Shell vulnerabilities: why proactive website maintenance matters

Two critical PHP vulnerabilities made headlines this week. But for one of our website maintenance clients, the timing highlighted the value of work we’d already put in place.

Sometimes, the importance of keeping a website properly maintained becomes clear in a single email.

What are the PHP2Shell vulnerabilities?

On 21 October 2026, two critical security vulnerabilities affecting PHP were publicly disclosed.

Collectively known as PHP2Shell, the vulnerabilities – CVE-2026-109618 and CVE-2026-109619 – affect the underlying PHP software used to power millions of websites and web applications, including WordPress.

Both vulnerabilities could potentially allow an unauthorised attacker to execute malicious code remotely or access sensitive information from PHP process memory.

The PHP development team released emergency security updates to address the vulnerabilities.

The NHS England PHP2Shell security advisory – provides further information about the vulnerabilities, their severity and the recommended action.

For businesses relying on WordPress or other PHP-powered websites, it’s a timely reminder that website security goes well beyond the WordPress dashboard.

Your website might look fine on the surface. That doesn’t necessarily mean everything behind it is up to date.

Which websites and applications are affected by PHP2Shell?

PHP2Shell isn’t specific to WordPress. The vulnerabilities affect PHP, the underlying technology powering millions of websites and web applications worldwide.

This means potentially affected environments include:

• WordPress and WooCommerce websites
• Drupal and Joomla content management systems
• eCommerce platforms built using PHP
• Bespoke websites and web applications developed using frameworks such as Laravel and Symfony
• Customer portals and business systems running on PHP

Importantly, a website can have its content management system, themes and plugins fully updated and still be exposed if the underlying PHP environment remains vulnerable.

The fixed PHP releases include:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

Older, unsupported PHP versions also require attention. Some hosting and operating-system providers supply their own security patches, so it’s important to check the actual server environment rather than relying on the version number alone.

For further technical guidance, the Dutch National Cyber Security Centre’s PHP2Shell resource – provides details of the vulnerabilities, affected environments and available fixes.

If you’re unsure whether your website or application is affected, speak with your website agency or hosting provider and ask them to confirm that the relevant PHP security patches have been applied.

On Proactive maintenance – a real client experience

Earlier this month, we contacted a client whose website we look after under an ongoing maintenance contract.

Their website was running an outdated version of PHP, alongside a number of WordPress and plugin updates that needed attention.

Nothing particularly unusual.

But important work that needed to be carefully managed.

Rather than updating everything directly on the live website, we upgraded the PHP environment and completed the necessary updates in staging first.

That gave us the opportunity to check for compatibility issues, test the website’s functionality and address potential problems before deploying the changes to production.

Once everything had been tested, we moved the updates to the live website with minimal disruption.

A few days later, the PHP2Shell vulnerabilities were disclosed.

By that point, we’d already upgraded the client’s outdated PHP environment and deployed the changes to production. Further server-level security patches were subsequently provided by the hosting provider to address the newly disclosed vulnerabilities.

Then came an email from our client:

It’s exactly the sort of conversation that highlights why ongoing website maintenance matters.

The work we’d completed wasn’t a pre-release fix for PHP2Shell. Those specific security patches came later.

But we’d already taken important steps to bring an outdated environment up to date, reduce compatibility risks and put the website in a better position for further security updates.

That’s what proactive maintenance is about.

Not waiting until something breaks. Not scrambling to address years of outdated software when a vulnerability makes the news.

It’s about maintaining the foundations your website depends on.

And it’s why we believe a new website should never be treated as the end of the investment.

As we explore in why your brand and website need ongoing investment – the work that happens after launch is just as important to long-term business success.

Why website updates aren’t always straightforward

Updating WordPress or PHP can sound like a simple task.

And sometimes it is.

But websites rarely operate in isolation. Themes, plugins, integrations, custom functionality and server environments all need to work together.

An update to one component can affect another.

An older theme might not support a newer PHP version. A custom plugin could rely on outdated functionality. A third-party integration might behave differently after an upgrade.

What looks like a routine update can quickly become a broken website, an enquiry form that stops working or functionality that disappears without warning.

For a business relying on its website to generate enquiries, take bookings or manage customer information, those issues can have a real commercial impact.

This becomes particularly important for businesses using custom integrations, portals and tailored functionality.

Our insight into bespoke web and app development – explores how these more complex digital solutions support business operations, and why the right technical foundations matter.

That’s why our approach is to test before we deploy.

On Testing before deployment

Our website maintenance approach isn’t simply about applying updates as quickly as possible.

It’s about managing change properly.

Where appropriate, that means working through a controlled process:

For urgent security vulnerabilities, the process may need to be accelerated. Delaying critical patches unnecessarily can introduce its own risks.

The goal is to balance security, compatibility and business continuity.

Because website maintenance should protect the investment you’ve made in your website, not introduce avoidable problems.

What should ongoing website maintenance include?

A website isn’t something you build once and leave to run indefinitely.

Technology changes. Security vulnerabilities emerge. Software evolves. And the needs of your business change too.

A sensible website maintenance programme should consider:

• WordPress core, theme and plugin updates to address known issues and maintain compatibility.
• PHP and server updates to keep the underlying environment supported and secure.
• Website backups with a suitable recovery process.
• Security monitoring to identify suspicious activity and potential vulnerabilities.
• Compatibility testing for updates that could affect website functionality.
• Performance checks to identify technical issues that may affect the user experience.
• Ongoing support when functionality, integrations or business requirements change.

The level of maintenance should reflect the complexity and importance of the website.

A straightforward brochure website won’t need the same level of technical management as a bespoke platform with multiple integrations, customer accounts or sensitive data.

But both need looking after.

And security isn’t the only reason to keep your website’s technical foundations in good shape.

Outdated software, unnecessary scripts and poorly managed plugins can also affect speed, reliability and how effectively search engines access your website.

We explore these wider considerations in our guide to technical SEO, website performance and crawlability.

Because better performance doesn’t come from one isolated update. It’s the result of getting the details right, consistently.

On Protecting more than your website

A business website represents an investment in your brand, your customers and your ability to generate new opportunities.

When it isn’t properly maintained, it’s not just the technology that’s potentially at risk.

A broken enquiry form can mean missed leads.

An unavailable website can interrupt business.

A security incident can undermine customer confidence and create a significant amount of unexpected work.

Good maintenance helps reduce those risks.

At HeightOn, we bring together brand, design, web and digital thinking to create better online experiences.

That begins with choosing the right foundations.

Whether that’s a customised WordPress solution or a fully bespoke platform, understanding the trade-offs is part of building something that works for your business.

Our guide to bespoke vs customised website design – explains how we approach those decisions.

But good thinking shouldn’t stop when a website goes live.

A better website needs better foundations, ongoing attention and the right support behind it.

The recent PHP2Shell vulnerabilities are a reminder that staying up to date isn’t simply a technical box to tick.

It’s part of protecting your business.

And sometimes, the value of that work becomes clear in a single email.

FAQs

On Keeping your website working better

Whether you’re investing in a new website or looking after an existing one, the quality of what happens behind the scenes matters just as much as what customers see.

Explore how we approach website design and development – from the first idea through to launch and beyond.

Or start a conversation about maintaining, improving or upgrading your existing website.

Big On Better. From build to beyond launch.