26/10/2026
PHP has just patched two critical flaws, and plenty of businesses wonโt hear about it from whoever looks after their website.
On 21 October, PHP released fixes for PHP2Shell, two vulnerabilities rated 9.2 out of 10. Either one can let an attacker run commands on a server without logging in. Details had leaked before the fix was ready.
The catch is where the problem sits. Itโs in PHP itself, not in your plugins or your siteโs code. WordPress, Drupal, Magento and Laravel all run on it, so updating your CMS wonโt fix it. The server needs the fixed PHP version, and the service has to be restarted.
Often the real gap isnโt technical. The site was built by one company, hosted by another, and watched by nobody. When news like this lands, no one owns the response.
Thatโs what a technical partner is for. Someone who knows what you run, hears about issues early, patches and restarts, keeps watching afterwards, and tells you plainly what happened.
If youโre not sure who is looking after the platform behind your website, start there.
Full breakdown, including what to ask your vendors this week:
https://www.aryal.com.au/insights/php2shell