PHP Vulnerability: What EU Businesses Must Do Now

If your business has a website – especially one built on WordPress – you need to read this. A critical security flaw discovered in PHP, the programming language that powers the majority of the web, sent governments and cybersecurity agencies scrambling in late October 2026. The short version: check whether your site is affected, and if it is, update immediately or take it offline until you can.

This isn’t just a tech story. For EU businesses, it also has real implications under the NIS2 Directive and GDPR – two laws that can hold you accountable if a breach occurs and you weren’t taking reasonable steps to protect your systems.

Here’s what happened, what it means for you, and exactly what to do.

What is PHP and why does this vulnerability matter for EU businesses?

PHP (PHP: Hypertext Preprocessor) is a programming language that runs on web servers. It’s the engine behind WordPress, Wikipedia, many e-commerce platforms, and a huge portion of the web. According to cybersecurity firm Wiz, which helped uncover the flaw, PHP powers roughly 70% of the world’s websites.

That ubiquity is exactly what makes this vulnerability so serious. The flaws – officially catalogued as CVE-2026-109618 and CVE-2026-109619, and collectively nicknamed “PHP2Shell” – were rated 9.2 out of 10 in severity by researchers. That puts them in the “critical” category.

What makes PHP2Shell particularly alarming is that an attacker doesn’t need any prior access or login credentials to exploit it. Under the right conditions, these bugs allow an attacker to take control of a web server, steal sensitive data, or move deeper into a network – all without ever having had an account or permission on the system.

The flaws were discovered using AI tools developed by OpenAI, and had been lurking in PHP code for over a decade without detection. Patches were rushed out by the PHP Foundation on 21 October 2026, and the patched versions are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.

Is my website affected?

If your website runs on PHP – which, if you’re using WordPress, it does – then your site could be affected. The vulnerability applies to all versions of PHP that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, and LiteSpeed.

The key question is whether you or your hosting company has already applied the patch. Here’s how to find out:

If your website is managed by a hosting company or web agency: Contact them directly and ask whether the PHP security patches for CVE-2026-109618 and CVE-2026-109619 have been applied. Most reputable hosts will have done this already – but it’s worth confirming in writing.
If you manage your website yourself: Log into your server and check your PHP version. If you’re running anything below PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12, update immediately. If you’re on an older, unsupported version of PHP (anything below 8.1), you won’t receive a direct patch – you’ll need to upgrade to a supported version.
WordPress plugin and theme updates are not enough: This is a flaw in PHP itself, not in WordPress or its plugins. Updating WordPress won’t fix it. The patch needs to be applied to the PHP installation on your server.

If you can’t update immediately, both the UK’s National Cyber Security Centre (NCSC) and the US National Security Agency (NSA) recommended taking affected systems offline until the patch can be applied. That’s how serious this is.

What have EU authorities said about PHP2Shell?

The response from cybersecurity authorities across Europe was swift. CERT-EU – the EU’s Computer Emergency Response Team – published Security Advisory 2026-018, advising organisations to patch immediately or isolate internet-facing applications from public networks until a fix could be applied.

The UK NCSC issued a critical alert urging organisations to identify all PHP installations across their infrastructure, prioritise internet-facing systems, and update without delay. The Finnish government, Edinburgh Council, and the Netherlands’ cybersecurity agency all temporarily took their own websites offline as a precaution while they assessed exposure.

In the days after the disclosure, cybersecurity firm Cloudflare reported seeing millions of attempts to exploit the PHP vulnerabilities across its network – a sharp escalation in the hours after the vulnerability was made public. No confirmed successful attacks had been reported as of the time of writing, but experts warned that impact from any successful exploits could take time to become apparent.

What does PHP2Shell mean for NIS2 compliance?

If your business falls under the EU’s NIS2 Directive – the cybersecurity law that came into force across EU member states in October 2024 – this vulnerability is directly relevant to your obligations.

NIS2 applies to “essential” and “important” entities in sectors including digital infrastructure, cloud services, managed IT service providers, energy, transport, healthcare, and public administration. If you operate in one of these sectors or supply critical services to businesses that do, you’re likely in scope.

Under NIS2, you are required to take appropriate technical and organisational measures to manage cybersecurity risks. That includes patching known critical vulnerabilities promptly. Failing to patch a flaw of this severity – rated 9.2 out of 10, with active exploitation attempts confirmed – could be considered a failure of your risk management obligations.

NIS2 also has strict incident reporting deadlines if your systems are compromised:

24-hour early warning: You must notify your national competent authority within 24 hours of becoming aware of a significant incident.
72-hour full notification: A fuller incident report – including an initial assessment of severity, impact, and indicators of compromise – is due within 72 hours.
One-month final report: A comprehensive final report is due no later than one month after the incident notification.

If your business is not yet sure whether it falls under NIS2, check with your national cybersecurity authority – in most EU countries this is the designated NIS2 competent authority. Requirements vary slightly by member state based on how the directive was transposed into national law.

What about GDPR – could a breach trigger a data notification requirement?

Yes, and this is where things get serious for any business that handles personal data – which is almost every business operating in the EU.

If a PHP2Shell exploit allowed an attacker to access your web server and steal personal data (customer records, email addresses, payment information, or anything else that identifies individuals), that would constitute a personal data breach under GDPR.

Under Article 33 of the GDPR, you must notify your national data protection supervisory authority within 72 hours of becoming aware of a breach – unless the breach is unlikely to result in a risk to individuals’ rights and freedoms. If the breach is high risk, you must also notify the affected individuals directly under Article 34.

The clock starts when you become aware – not when you investigate and confirm. So if you discover evidence of a potential intrusion, you should treat it as a breach and begin your notification process while you investigate further. You can file an initial notice within the 72-hour window and update it as you learn more.

Failing to notify within the 72-hour window can itself result in a fine from your supervisory authority, separate from any fine related to the breach itself. For a full guide to what GDPR means for your business day-to-day, see our GDPR for Small Businesses guide.

What should EU businesses and website owners do right now?

Here’s a straightforward action list, in order of priority:

Find out what PHP version your site is running. Ask your hosting provider or web developer. If you manage your own server, check directly.
Update to a patched version immediately. The fixed versions are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. If your host manages PHP for you, confirm in writing that the update has been applied.
If you’re on an unsupported PHP version, upgrade to a supported branch before you can receive patches. This is a good time to do it regardless – older versions of PHP receive no security updates at all.
If you can’t patch right now, consider taking the site offline temporarily. The NSA and NCSC both recommended this for organisations that couldn’t patch immediately.
Check for signs of compromise. If you suspect your server may have been affected before you patched, look for unusual files, backdoors, or unfamiliar admin accounts. If you’re not confident doing this yourself, bring in a cybersecurity professional.
Monitor third-party software. PHP isn’t only used in websites – it’s also embedded in some network appliances, load balancers, and management interfaces. Check with your vendors whether any other tools in your stack run PHP and need updating.
Stay alert to phishing. As tends to happen after a major security event, attackers may send phishing messages referencing PHP2Shell to trick staff into clicking links or revealing credentials. Brief your team.

It’s also worth noting that AI played a central role in both discovering this vulnerability and in accelerating attacker capabilities. The same AI tools that helped researchers find PHP2Shell could help malicious actors develop exploits more quickly. This is a theme we explored in our piece on the EU AI Act – the EU’s attempt to bring governance to AI systems before problems like this become routine.

Quick Answers: PHP Vulnerability and EU Businesses

What is PHP2Shell?
PHP2Shell is the nickname for two critical security vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619), rated 9.2 out of 10 in severity. They can allow an attacker to take control of a web server without needing any login credentials.

Does this affect my WordPress website?
Yes, WordPress runs on PHP, so any WordPress site could be affected. Updating WordPress or its plugins is not enough – the PHP installation on your server needs to be patched separately.

What are the patched PHP versions?
The fixed versions released on 21 October 2026 are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Check with your hosting provider to confirm which version your site is running.

Do I need to notify authorities if my site was breached?
If personal data was accessed, yes. Under GDPR Article 33, you must notify your national data protection supervisory authority within 72 hours of becoming aware of a breach. If you’re subject to NIS2, you also have a 24-hour early warning obligation to your national cybersecurity authority.

Who is responsible for patching – me or my hosting company?
It depends on your hosting arrangement. If you’re on managed hosting, your provider is likely responsible – but confirm this with them in writing. If you manage your own server or VPS, patching is your responsibility.

What if I can’t patch immediately?
Both the UK NCSC and US NSA recommended taking affected systems offline temporarily if an immediate patch is not possible. This is the safer option compared to leaving a vulnerable system exposed.

Has anyone actually been hacked through PHP2Shell?
No confirmed successful attacks had been reported as of late October 2026, though millions of exploitation attempts were recorded in the 24 hours after the vulnerability was made public. The situation may change – experts warned that impact from any successful exploits could take time to surface.

The takeaway

PHP2Shell is the kind of vulnerability that makes security professionals lose sleep – a critical flaw in a foundational piece of technology, affecting a huge portion of the web, with exploitation attempts already in the millions. For most small business owners, the practical action is simple: contact your hosting provider today, confirm the patch has been applied, and keep monitoring.

If you’re subject to NIS2 or GDPR (and if you operate in the EU and handle personal data, you almost certainly are), make sure you understand your reporting obligations before a problem occurs – not after.