Beyond Key Urges Businesses to Patch PHP Now as Critical: “PHP2Shell” Flaws Put Websites at Risk

Beyond Key, a global IT consulting and software services company, is urging organizations that run PHP-based websites and applications to confirm their systems are fully patched. In October, two serious vulnerabilities, dubbed PHP2Shell, triggered major outages and a wave of attack attempts across the web. Two serious PHP bugs, CVE-2026-109618 and CVE-2026-109619, could allow attackers to take over a server without logging in.

The UK’s National Cyber Security Center says they corrupt PHP memory. For a closer look at how these flaws work and their potential impact, read our PHP2Shell Vulnerability Analysis.

Beyond Key’s Take on the PHP2Shell Vulnerabilities and Why They Matter

The fixes were originally planned for a coordinated release later in the week, but details leaked early. The PHP Foundation brought its emergency security updates forward to Wednesday, October 21, one day after the leak. Attackers moved quickly. Attacks reportedly began soon after, and Wikipedia went offline for a time, with the Wikimedia Foundation confirming the outage was tied to the PHP flaws. The exposure is significant. A lot of the web is built on PHP, from content management systems to online stores to bespoke business applications.

A vulnerability at this level can be much more significant than just a single website. Many organizations were busy determining which of their systems were affected, and the speed of the subsequent attacks allowed little time for preparation. For many businesses, the challenge is not applying a single update. It is knowing where PHP actually runs. PHP powers content management systems, online stores and custom web services, and the NCSC notes it is also built into a range of other products.

How Beyond Key Helps Businesses Respond to PHP Security Risks

Beyond Key recommends that organizations follow the NCSC’s guidance and act now:

• Find every system that runs PHP, starting with those reachable from the internet.
• Install the latest fixed PHP version, and move off older unsupported versions.
• Watch for updates from vendors whose products include PHP.
• Take systems offline if they cannot be fixed quickly, and check any that could not be updated right away for signs of a break-in.

“The PHP2Shell flaws are a reminder that the software underneath a website matters as much as what visitors see,” said Milin Dholakia, COO at Beyond Key. “Our teams help clients find where PHP is running, patch quickly and safely, and modernize legacy applications so they are not left exposed the next time a critical flaw appears.”

Beyond Key’s engineers can support organizations with PHP application audits, patch planning and testing, and migration of legacy applications to supported platforms. Businesses that rely on a hosting provider should also ask that provider to confirm the fix has been applied.

About Beyond Key

Beyond Key is an IT consulting company and Microsoft Solutions Partner that helps companies do more with their technology. Beyond Key is urging businesses to find all PHP systems, install the latest emergency patches and get rid of old versions.

]With millions of servers exposed and very few patched within the first day, Beyond Key offers PHP audits, patch planning, web application penetration testing and legacy application modernization to help organizations close the gap quickly and safely.