PHP2Shell: What It Means for Your Cyber Insurance

PHP2Shell is a pair of critical PHP flaws fixed on 21 October 2026; update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then check your cyber policy's patching and notification conditions. It matters for insurance because cover for an attack through a known, unpatched vulnerability can depend on your policy's security conditions and on notifying your insurer in time.

Part of: Cyber insurance UK guide

PHP2Shell is two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2, that can let an attacker run code on a web server without logging in. Fixed versions came out on 21 October 2026. WordPress and other CMS sites depend on the server's PHP, so updating plugins is not enough. Ask your host or IT provider in writing whether you are patched and have checked for compromise. Cyber insurance commonly covers the response to an attack, but cover can depend on your patching conditions. If you see signs of compromise, read your notification clause and tell your insurer promptly.

What happened with PHP2Shell?

Last updated 22 October 2026.

PHP2Shell is the name security researchers have given to two critical flaws in PHP, the programming language that runs a large of the web, including WordPress, Drupal, Joomla and Magento sites. Our PHP2Shell wiki entry has the short definition. The timeline so far:

20 October 2026: the PHP project pre-announced an emergency security release for two critical vulnerabilities after details leaked.

21 October 2026: PHP released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 ( php.net security advisory ). The same day, the UK's National Cyber Security Centre published an alert telling UK organisations to prepare to update immediately .

21 to 22 October 2026: several security firms reported exploitation attempts, and firewall rules were being deployed by network providers ( Help Net Security, 21 October 2026, updated 22 October ). It was not in the US CISA Known Exploited Vulnerabilities catalogue as of 21 October 2026, and no confirmed public breach had been attributed to it at the time of writing.

The two flaws are CVE-2026-109618 (remote code execution via out-of-memory corruption) and CVE-2026-109619 (remote code execution via stale global state). Both are rated CVSS v4.0 9.2, which is critical. In plain English: an attacker who has never logged in may be able to send requests to your website that let them run their own code on the server. That can lead to stolen data, defaced or redirected sites, ransomware or the server being used to attack others.

Am I affected by PHP2Shell?

If your website, web app, customer portal or online shop runs on PHP and serves web requests, assume you are affected until someone confirms the server is on a fixed version. php.net says all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest for mod_php, where an unauthenticated request can trigger the attack before any application code runs.

A version number alone can mislead. A Linux distribution package can carry the fix under an older-looking version, so ask whoever runs the server to confirm the fix is applied rather than relying on the number you see. Our guide on how to check your website PHP version walks through where to look.

Why WordPress and other CMS sites depend on the server

WordPress, Drupal, Joomla, Magento and other PHP applications run on top of the server's PHP. Updating the CMS, theme or plugins does not fix PHP2Shell; PHP itself has to be updated. We cover this in more detail in PHP2Shell and WordPress sites: what to do .

Shared hosting versus your own server

Shared or managed hosting: the host usually controls the PHP build and applies the patch. You often choose which PHP version your site uses in the hosting control panel, so you may need to move to a supported branch.

Your own server, VPS or cloud instance: you, your IT provider or your developer are responsible for updating PHP and restarting the services that use it.

Software and appliances: the NCSC warns that third-party products and services can bundle PHP, so check vendor updates too.

Being hosted elsewhere does not move the business risk away from you. See do I need cyber insurance if my website is hosted .

What to do in the 24 hours

This checklist puts the NCSC and php.net guidance into plain English. Apex is an insurance broker, not an IT security firm, so the technical steps belong with your host, IT provider or developer.

List everything that runs PHP , starting with anything facing the internet: websites, shops, booking systems, client portals and intranets.

Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor package that contains the fix. php.net says: "There are no complete mitigations, updating is the only safe choice."

Treat stop-gaps as stop-gaps. Server settings such as disabling session upload progress or lowering post size limits reduce exposure to specific attack paths but do not make an installation safe.

If a system cannot be fixed, consider taking it offline until it can, as the NCSC suggests.

Monitor for malicious activity on internet-facing PHP systems, and keep watching for updates from software vendors whose products bundle PHP.

Ask your host or IT provider in writing whether your servers are patched, on what date, and whether they have checked for signs of compromise. Keep the . If something does go wrong, a dated record helps both the technical response and any insurance claim.

Look at your cyber policy for conditions on patching, notification and incident response, and save the insurer's incident helpline number if there is one.

Does cyber insurance cover a PHP2Shell attack?

Often yes, but it depends on your policy wording. A cyber policy does not usually name individual vulnerabilities; it responds to the consequences of a cyber incident, such as a hack, data breach or ransomware attack, subject to its terms, conditions, exclusions and excess. The covers commonly found in UK cyber policies are:

For a fuller breakdown see what cyber insurance actually pays for , first-party versus third-party cyber cover and what cyber insurance does not cover .

Known, unpatched vulnerabilities

Now that a fix exists, cover for an attack through a known, unpatched flaw can turn on the policy's security conditions. Some wordings require reasonable steps to keep systems updated, some set a period within which critical patches should be applied, and some contain exclusions or reduced cover for unpatched vulnerabilities. Others say little on the point. The wording and what you told the insurer on your proposal both matter. We explain this in does cyber insurance cover unpatched vulnerabilities . The practical point is simple: patch promptly and keep evidence of when you did.

Do I need to tell my insurer PHP2Shell?

If you have found signs of compromise, almost certainly yes, and quickly. If you were simply running a vulnerable version and have now patched with no sign of attack, it depends on your wording.

Claims-made policies: professional indemnity policies, and many cyber policies, are written on a claims-made basis , so the policy in force when you notify is the one that responds. Late notice can cause problems.

Notification of circumstances: many policies let you, or require you to, notify circumstances that might give rise to a claim, even before anything has gone wrong. See notification of circumstances: what and when .

Read your notification clause: check who to tell, how fast, and whether you must use the insurer's incident helpline before appointing your own IT experts. Our guide to cyber and PI notification obligations explains the common traps.

Regulators run on a separate clock: if personal data has been breached and a risk to people is likely, UK GDPR Article 33 requires notice to the ICO without undue delay and, where feasible, within 72 hours of becoming aware.

Apex clients should call us. We will help you work out whether and how to notify, and get the notice to the insurer quickly and correctly. For the first days of a live incident, see cyber incident: the first 72 hours and your insurance .

If you don't have cyber insurance

Patching comes first. Cyber insurance is there for the costs that follow if something still goes wrong. Cyber policies are generally not designed to cover incidents that have already happened or that you knew before cover started, so the time to arrange it is before you need it.

A quote is quicker if you have this ready:

business activity, turnover and number of staff;

what data you hold and roughly how many customer records;

how your website is built and hosted, and who maintains it;

your security basics: multi-factor authentication, backups, and how quickly critical updates are applied (including the date PHP was patched);

any cyber incidents or claims.

Our cyber proposal form walkthrough explains the questions, and Cyber Essentials and cyber insurance covers how certification fits in. If you are weighing it up, start with what cyber insurance is and whether a small business needs it or our cyber insurance UK guide , or go straight to a cyber insurance quote .

Apex is an independent UK insurance broker. We do not patch or scan systems, and we cannot guarantee cover or claims, but we can help with the insurance side:

Check your current cyber policy for its conditions on patching and security, notification and incident response.

Help Apex clients notify their insurer of an incident or circumstance quickly and correctly.

Arrange cyber cover if you have none , through our cyber proposal .

Arrange technology PI and cyber for web agencies, developers, hosting providers and MSPs.

Give a free second opinion on your renewal , and run our contract insurance clause check .

For web agencies, developers and hosts

php.net: Security advisory, critical remote code execution vulnerabilities (21 October 2026)

php.net: PHP 8.4.27 released (21 October 2026)

NCSC: Critical security issue affecting PHP (21 October 2026)

ICO: UK GDPR data breach reporting

UK GDPR Article 33, legislation.gov.uk

Help Net Security: PHP2Shell, critical PHP vulnerabilities patched (21 October 2026)

Am I affected by PHP2Shell?

If your website or web app runs on PHP and the server has not been updated since 21 October 2026, assume so. All PHP installations serving web requests are at risk, including PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed. Ask your host or IT provider to confirm in writing that the fix is applied.

What PHP version fixes CVE-2026-109618?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026, fix both CVE-2026-109618 and CVE-2026-109619. PHP 8.1 and older get no official release, though some Linux distributions and long-term support vendors ship patched packages under older-looking version numbers.

Does updating WordPress fix PHP2Shell?

No. PHP2Shell is a flaw in PHP itself, which WordPress runs on. Updating WordPress, themes or plugins does not fix it. The server's PHP must be updated, usually by your host on shared hosting, or by you or your IT provider on your own server.

Does cyber insurance cover PHP2Shell?

A cyber policy commonly covers incident response, forensics, data restoration, business interruption, extortion, notification costs, regulatory defence and liability after an attack, subject to its wording. Cover for an attack through a known, unpatched vulnerability can depend on the policy's security conditions, so patch promptly and keep evidence.

Do I need to tell my insurer PHP2Shell?

If you see signs of compromise, notify quickly under your policy's notification clause. If you patched with no sign of attack, whether to notify a circumstance depends on your wording. PI policies and many cyber policies are claims-made, so late notice can cause problems. Apex clients should call us.

Is PHP2Shell being exploited?

As of 21 to 22 October 2026, several security firms reported exploitation attempts. It was not in the US CISA Known Exploited Vulnerabilities catalogue as of 21 October 2026, and no confirmed public breach had been attributed to it at the time of writing. Update regardless.

Can I still buy cyber insurance after PHP2Shell?

Generally yes, though insurers may ask how quickly you apply critical updates and whether you have patched PHP. Cyber policies are not usually designed to cover incidents already known before cover starts, so patch first, then arrange cover with your security details ready.

Get cyber cover in place, or check the policy you have

Start a cyber quote online in a few minutes, or ask a broker to check your current policy's patching and notification conditions. Or call 0117 325 0027.

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.