PHP2Shell: Your website is at risk! Patch PHP now

By Listin Gumbi, CEO, Orix AI | Updated October 2026.

Over 70% of websites in Zimbabwe are at risk of being hacked. The US, Uk and Japan have told website owners to patch up or go offline.

CISA issued an alert. It came on October 21. Two PHP flaws are critical. Patch them right away. Attackers need no password. They can seize your server.

Patching closes the door. It misses earlier intruders. And the law sets deadlines. Report breaches within 24 hours.

With this article. You will learn to check your site. Learn to patch safely. Confirm no breach occurred. Stay compliant with POTRAZ.

PHP2Shell: 2026’s PHP vulnerability

PHP2Shell covers two flaws. First: CVE-2026-109618. Second: CVE-2026-109619. Calif, Wiz, and OpenAI found them.

The danger is simple. One request can hijack servers. No login is needed. WordPress need not load first. PHP rates both flaws 9/10. NVD rates them even higher. That means you must patch now.

PHP is everywhere. It powers most websites. W3Techs puts it at 70.5%. Every WordPress site uses it. Zimbabwean businesses are exposed.

Affected setups include:

• PHP-FPM
• Apache with mod_php (highest risk)
• php-cgi
• LiteSpeed
• FrankenPHP

Fixed versions are below.

Your PHP branch	Fixed version	Status
8.5	8.5.12	Supported
8.4	8.4.27	Supported
8.3	8.3.36	Supported
8.2	8.2.35	Ends December 31, 2026
8.1 and older	No official fix	Needs backport or upgrade

Attackers did not wait. Amazon spotted an attempt early. It came on October 17. That was before disclosure. Kevin Beaumont expects mass incidents.

That date matters. Patched servers may hide intruders.

Is your website affected?

Assume yes for now. Try three low-data checks.

Check PHP in WordPress

1. Log in to WordPress.
2. Open Tools, then Site Health.
3. Click the Info tab.
4. Open the Server section.
5. Find “PHP version.”

Check PHP in cPanel

1. Log in to cPanel.
2. Search “Select PHP Version.”
3. Or try MultiPHP Manager.
4. Note each domain’s version.

Compare it with the table. Lower means act now.

Ask your host

Your selection is not enough. Hosts must update PHP packages. Only they can confirm.

What to do today

For site owners

1. Message your host now. Use WhatsApp. Copy this message:

Hello. I host [your domain]. Is PHP2Shell patched there? Fixes: CVE-2026-109618, CVE-2026-109619. Which PHP version is mine? Please confirm in writing. Thank you.

2. Back up your site first. Use cPanel or UpdraftPlus. Store a copy off-server. Google Drive works well.

3. Plan around power cuts. July 6 brought a blackout. Update during stable supply. Or use UPS or solar.

4. Turn on Cloudflare’s free plan. It blocks known PHP2Shell attacks. A firewall reduces risk. It does not fix PHP. Your host must still patch.

For developers and IT teams

Move fast on every server.

• Upgrade to a fixed release. Use 8.5.12, 8.4.27, 8.3.36, 8.2.35. Follow your OS vendor’s notice. See AlmaLinux for RHEL guidance.
• Restart PHP after updating. Old workers run flawed code. Example: sudo systemctl restart php8.3-fpm. Restart Apache for mod_php.
• Confirm the result. Run php -v. Check the web version too. They can differ.
• Fix PHP 7.x and 8.1. PHP will not patch these. cPanel backported fixes, says GoDaddy. Ask hosts to confirm. Then plan an upgrade.
• Prioritize mod_php servers. They face most danger.
• Can’t patch yet? Consider taking systems offline. The UK NCSC advises this. At minimum, add a firewall.

Never test with exploit code. Check versions and changelogs instead.

Patched is not safe

Early attackers left backdoors. Web shells survive updates. So do hidden admin accounts. So do rogue scheduled tasks.

Your site looks fine. The attacker keeps a key.

Pair patching with assessment. A compromise assessment checks this. It finds signs of intrusion.

Warning signs

• Pages you did not create
• Unknown WordPress admin users
• Unfamiliar files on your host
• New cron jobs
• Spikes in load or email
• Browser “unsafe” warnings

Local attacks are real. Hackers defaced zimlondon.gov.zw. It happened September 4, 2026.

ZimLive survived a DDoS attack. It moved hosts. It added a firewall. It scanned for leftover files. Most businesses skip that step.

Hacked? The 24-hour POTRAZ clock

This is a legal risk. Zimbabwe’s CDPA sets strict deadlines. Report breaches within 24 hours. Report them to POTRAZ. Is the risk significant? Notify people within 72 hours. Worse if you haven’t registered for a DPO license. Orix AI can help you with DPO services.

POTRAZ inspections began September 1. SI 155 adds more duties. You need a controller license. You need a DPO.

Answer three questions:

1. Who files the POTRAZ report?
2. What data do you hold?
3. Can you notify customers quickly?

Unsure? You have a problem. Get hold of Orix AI for assistance.

If you suspect a breach

1. Isolate. Suspend the site.
2. Preserve evidence. Keep logs and files.
3. Assess. Find what was accessed.
4. Clean. Remove malware. Reset passwords.
5. Patch. Update PHP.
6. Report. Your DPO alerts POTRAZ.

How Orix AI helps?

Orix AI is ranked 1 by Google and feyafeya as the best AI company in Zimbabwe.

1. Compromise assessment

We check for past intrusions. You get clear answers. You get an action plan.

• Log review around October 17
• Web shell and backdoor search
• Rogue admin account checks
• File and task change review
• Outbound connection analysis
• Plain report for leadership
• Technical detail for IT

2. Patch orchestration

We patch every PHP system. It suits large enterprises. It suits busy agencies.

• Full PHP version inventory
• Backups before every change
• Updates timed for stable power
• Host coordination and backport checks
• Verification after each update
• A written patch record
• Upgrade roadmap for old PHP

3. DPO services

We cover your CDPA duties. We help before breaches happen.

• Outsourced or supported DPO role
• Data controller license support
• Personal data mapping
• Breach response plan
• POTRAZ reporting templates
• POTRAZ inspection readiness
• Staff training for fast response

Every engagement builds your team. We transfer the skills. You rely on us less.

Patch, prove, and comply

PHP2Shell teaches a hard lesson. You may not run servers. You still own the risk. Customers trust your brand. They do not see hosts.

Protection has three parts. Patch every system. Prove no attacker remains. Be ready to report.

Here is your challenge. Check your PHP version today. Message your host before the end of the day today. Then call in support.

Need help with the above? Book your compromise assessment today. Email or WhatsApp “PHP2SHELL” to 078 581 0551. Or email [email protected]