On October 21, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent alert about two critical vulnerabilities in PHP, nicknamed “php2shell” (CVE-2026-109618 and CVE-2026-109619).
PHP is the programming language behind WordPress and many other websites. These flaws could let an attacker run their own code on a server without logging in. CISA urged everyone to patch right away.
If your website is hosted by Bernadot Studios, you’re protected. You don’t need to do anything.
What we did the same day
Firewall protection came first. Before a patch was available, our hosting servers rolled out web application firewall (WAF) rules in three waves (Central time):
- 4:08 AM: blocked the known attack pattern and began flagging exploit attempts
- 8:07 AM: blocked the publicly available attack tool and more attack patterns
- 12:17 PM: blocked further variants of that tool and related malformed uploads
Any IP address caught scanning for or attempting this exploit was also challenged and blocked automatically.
The patch followed. By 6:14 PM that evening, patched PHP was installed across all of our servers.
Why your PHP version number might look “wrong”
CISA’s alert listed specific fixed versions, such as PHP 8.3.36 and 8.4.27. Your site may show a lower number, like 8.3.35. That’s expected, and you’re still protected.
The official PHP releases weren’t available to hosting providers yet. So CloudLinux, our servers’ operating system vendor, backported the security fix, meaning it added the fix to the versions we already run. Because the version number stays the same, it can look out of date even though it’s fully patched.
When the official releases come out, we’ll test them and update as needed. The firewall rules stay in place as an extra layer of protection.
The takeaway
Most small businesses never hear about vulnerabilities like this, and they shouldn’t have to. That’s part of the Bernadot Studios Service Suite: guaranteed security, daily updates, nightly backups and free restoration if a breach ever occurs.
Got questions, or wondering whether your current host handled this as quickly? Call 608-790-4000.
FAQ
What is php2shell?
It’s the nickname for CVE-2026-109618 and CVE-2026-109619. These are two critical PHP vulnerabilities, disclosed in October 2026, that allow unauthenticated remote code execution on servers running PHP.
Does it affect WordPress sites?
Yes. WordPress runs on PHP, so any WordPress site on an unpatched server is at risk.
Do Bernadot Studios clients need to do anything?
No. Patches and firewall protections were applied on our servers on October 21, 2026.
My site shows an older PHP version. Am I vulnerable?
Not if you’re hosted with us. The fix was backported into our existing PHP versions, so a lower version number doesn’t mean you’re unprotected.
