10/22/2026
You may have heard recent and dire warnings about critical flaws (dubbed “php2shell") in PHP that affect most of the Internet’s websites and web apps. The Byers Web Team worked overnight to make sure all websites hosted on our servers are updated and patched, so you can breathe easy.
What is the Issue?
Basically, vulnerabilities were discovered in PHP which could allow someone to gain access to a website or web app's systems and underlying data. Bugs and security flaws are not uncommon, but these two flaws are especially dangerous, as they allow unauthenticated remote code ex*****on on affected servers. Using these flaws, a bad actor can execute code without prior access or credentials.
Security issues are rated on the Common Vulnerability Scoring System (CVSS), a scale of 0 through 10. The php2shell vulnerabilities are rated at 9.2, which means they are Critical. A Critical ranking generally means bad actors can potentially crash or hijack affected systems and can use access to steal, alter or wipe data. The issues are present in all versions of PHP from 5.4 through 8.5.11.
What is PHP?
PHP (Hypertext Preprocessor) is a widely used, server-side programming language that powers many websites, content management systems (including WordPress), and many web applications. It is estimated that PHP powers 70% of the world’s websites, so these vulnerabilities are very wide-spread.
What Should I Do?
While all the websites on Byer’s servers have already been patched, you may need to do some checking and updating if you have websites and web apps that are hosted on other servers. If your website or web app runs PHP, check your PHP version and update it immediately if it hasn’t already been updated. The patched versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
If you happen to be running an older major version of PHP which has reached End of Life (EOL), you will need to upgrade to at least 8.2.35 to be protected. Older EOL versions of PHP will not be patched. If your website or web app has compatibility issues with more modern PHP versions, you may need to think about temporarily taking your website or web app offline until it can be safely upgraded.