The PHP Vulnerability, Explained Like You're Five

A client phoned me this week. He'd seen the headlines about a PHP vulnerability and asked me to explain it like he was five. Fair. Here it is.

What PHP is

PHP is an engine. It's the software running quietly behind a huge share of websites, doing the real work every time someone loads a page or submits a form. You never see it. How huge a share? WordPress alone runs about 40% of every website on the internet, and WordPress is built on PHP. Pile on everything else that runs on PHP and you're at most of the web. Odds are very good yours is on it too.

It isn't something your developer wrote. It's the shared engine underneath, built and maintained by someone else, that your site sits on top of. So when a hole turns up in the engine, everyone running on it is exposed at once. That's what happened this week.

What went wrong

Two serious flaws were found in PHP itself. They've been nicknamed PHP2Shell (officially CVE-2026-109618 and CVE-2026-109619). In plain terms, they let a stranger run their own commands on your server. No password. No login.

That's the scary part. Most break-ins at least need to get past a login first. This one doesn't. Picture finding out that a certain brand of front-door lock opens for anyone who knows a trick, no key needed. And the flaw sits in nearly every version of PHP, going back years. So nearly every PHP site on earth was exposed.

Why this one actually matters

Two reasons it's worse than the usual noise.

It needs no key. There's no "they'd have to crack our password first" to fall back on.

It's already being used. Attackers were caught probing for it before it was even public. The people who do this for a living had it in hand first. This is not theoretical, and the clock is running.

The fix is boring, which is the good news

The people who make PHP already shipped the fix. On Wednesday they released patched versions: 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Installing one of those closes the hole completely. No clever workaround, no half-measure. Update PHP and you're done.

So your whole job as the owner is one question.

The one call to make today

Ask whoever runs your site, your host or your developer: "Have we updated PHP to the patched version from this week?"

There are three answers.

"Already done." Good. Decent managed hosts patched this before most owners heard about it. Confirm it anyway.

"On it today." Also good. This is a same-day job. "Soon" is the wrong answer.

Silence, or "what vulnerability?" That's an answer too, and it's the one that needs you to push. If nobody can tell you it's done, it isn't.

The engine most of the web runs on had a hole that let strangers walk in without a key. The fix already exists. Your only job is making sure it's on your site. Make the call today.