INSIGHT

PHP2Shell: What Business Leaders Should Ask About the Software They Can’t See 

Jon Parrish, Josh Schmidt • October 28, 2026

Services: Cybersecurity Services

---

On October 21, 2026, the team that maintains PHP released emergency fixes for two critical security flaws, now known as PHP2Shell. PHP is the programming language behind a large share of the world’s websites, as well as many online stores, client portals, and the content management platforms that run them. Within hours, cybersecurity agencies in the U.S., the U.K., New Zealand, and elsewhere were urging organizations to patch immediately or take vulnerable systems offline.  

If your company has a website, a customer portal, or relies on software vendors (and nearly every company does), this news applies to you, even if no one on your team has ever written a line of PHP. Here is what happened, why it matters to your business, and the questions to ask your IT team and vendors now.  

What Happened  

The two flaws sit inside PHP itself, not in any single website or application built on top of it. According to the official PHP advisory, they can let an attacker run their own code on a web server without logging in, and every PHP installation that serves web requests is at risk. In practical terms, the business impact of cyberattacks like this one could include an altered website, exposed data on connected systems, or a server used as a foothold into the rest of your network. The fixes cover the four versions of PHP that are still supported.

Versions 8.1 and older no longer receive updates from the PHP project, which means organizations running older software face a harder path than simply installing a patch.  The situation is still developing. When the Cybersecurity and Infrastructure Security Agency (CISA) issued its alert, it had not observed exploitation of the flaws. A day later, New Zealand’s National Cyber Security Centre said it was aware of reports of active exploitation. Either way, the guidance from government agencies is consistent: act now.  

Why This Is a Business Issue, Not Only an IT Issue  

You May Be Running PHP Without Knowing It  

CISA notes that PHP is often a component of other software, so its presence may not be obvious. Your marketing website, an online payment page, an intranet, or a client login portal could all depend on it. The Dutch National Cyber Security Centre has pointed out that PHP is also embedded in network devices, appliances, and management interfaces, where your own team may not be able to update it directly, creating the kind of cybersecurity blind spots attackers look for.

Your Vendors’ Exposure Can Become Yours  

Many of the cloud services and hosted platforms you rely on run PHP behind the scenes. Fixing those systems is your vendor’s responsibility, but if a vendor holding your data is compromised, the operational, contractual, and regulatory fallout lands on your business. The U.K. National Cyber Security Centre specifically advises organizations to keep watching for security updates from third-party vendors, including those whose products bundle PHP.  

Older Systems Have No Easy Fix  

Applications built years ago, and never updated, are the hardest problem here. For unsupported versions, the choices narrow to upgrading, obtaining a fix from a specialized vendor, or taking the system offline. CISA advises that organizations unable to update should take PHP-based systems offline until they can be patched.  

Patching Does Not Undo a Break-In  

New Zealand’s cybersecurity agency cautions that installing the fix will not remove an attacker who is already inside. The U.K. agency similarly recommends checking systems for signs of compromise and for hidden “backdoors” an attacker may have left behind.  

“Most of the companies we talk to this week can tell us their website is patched. Far fewer can tell us every place PHP is running, including inside the vendor tools and devices they depend on,” said Joshua Schmidt, Partner, Cyber and IT Advisory at BPM. “Getting that inventory is the hard part, but doing that work matters every time an issue like PHP2Shell or Log4j surfaces.”  

Five Questions to Ask Your IT Team and Vendors Now  

You do not need to understand the technical details to lead your company’s response or decide how to prepare for a cyberattack. Start with these questions:  

• Where are we running PHP? Ask for a list of systems that use it, starting with anything that faces the internet, such as your website, portals, and online forms.  
• Have those systems been updated? Confirm that each one is running a fixed version, and get a date for any that are not.  
• Are any of our systems too old to patch? If so, decide whether to upgrade, replace, or take them offline, and who owns that decision.  
• Have our key vendors confirmed they are protected? Reach out to providers that host your website, store your data, or supply your network equipment, and ask for written confirmation.  
• Have we checked for signs that someone already got in? Ask whether exposed systems have been reviewed for unusual activity since the flaws became public.  

One more precaution: high-profile security news tends to attract scammers. Remind your colleagues to be wary of unexpected emails or calls urging them to “install an urgent patch” or click a link to check whether they are affected, and to verify any such request directly with your IT team or provider.  

The Lesson That Outlasts This Incident  

PHP2Shell will eventually fade from the headlines, but the gaps it exposed will not close on their own. Organizations that responded quickly this week tended to share three things: an accurate inventory of their software, a plan for retiring systems that no longer receive security updates, and clear expectations of their vendors when something goes wrong. If any of those were hard to produce on short notice, that is the place to invest before the next critical flaw arrives.  

How BPM Can Help  

BPM’s cybersecurity services help companies understand where their exposure lies and stay on top of it.We can help you build an inventory of internet-facing systems and the software they depend on, assess older applications that can no longer be patched, review vendor security commitments, and check exposed systems for signs of compromise. 

For companies that want ongoing support, our Managed IT services keep updates, monitoring, and documentation current so the next emergency patch is a routine task. Connect with BPM’s Cybersecurity team to find out where your organization stands.