While WIRED and CISA, NSA, and FBI are telling everyone “this is not a drill” about the latest PHP flaws (PHP2Shell), my Switzerland-based web sites were already running patched PHP 8.3 (i.e., 8.3.36) before the ink even dried.
What Is PHP2Shell?
Two critical vulnerabilities in the PHP runtime (CVE-2026-109618 and CVE-2026-109619) allow unauthenticated remote code execution. The attack vector: a specially crafted session.upload_progress request that triggers a type confusion in the PHP session handler, leading to arbitrary code execution on the server.
The critical flaw enables remote server hijacking and raw data leaks. Because PHP powers roughly 77% of websites with a known server-side language (and ~44 million internet-facing servers per Qualys), the flaws spared no one — forcing everything from government agencies and global corporate portals to personal sites into a frantic scramble.
Zero-day stress? The 0Day “In the Wild” tracker from Google Project Zero shows exploits discovered in the wild every ~17 days on average. Automated tools and AI are now shrinking the window between vulnerability disclosure and active exploitation down to mere minutes.
Who’s Actually in Danger?
The “scramble” is really two very different situations, and the panic is concentrated in the second group, which comprises nearly 60% of internet-facing PHP servers:
Group 1: Running 8.2+ (the easy case)
Just run a package update. A few minutes of work. This is ~44 million hosts (28% of internet-facing PHP) per Qualys. Annoying but not “on fire.”
Group 2: Running 7.3 or older (the “on fire” case)
There is no patch. Full stop. The PHP project has published zero fixes for these branches. The options are:
| Option | Reality |
|---|---|
| Upgrade to 8.2+ | The “real” fix, but legacy apps (old billing systems, government portals, internal tools) often break on a major version jump. This can take days or weeks of testing. |
| Paid LTS vendor (TuxCare, Zend, Freexian, Ubuntu Pro) | They backport the fix, but you need a contract, and for 7.3 and below the backports are community-contributed, not officially tested. |
| Build from source with community patches | Possible but requires a competent sysadmin and time. |
| Take the site offline | What CISA and CERT-FR literally recommend as the interim step. |
What Governments Did
- Netherlands: MijnOverheid, DigiD, the lower house of parliament’s site, the NCSC’s own portal, and education systems all went offline as a precaution.
- Finland: Government agencies took sites down.
- France: Local-government administrative websites were temporarily disconnected. CERT-FR specifically recommends isolating systems on unsupported PHP before migrating.
- Denmark: A national school communication platform was affected.
These aren’t cases of “oops, run apt upgrade.” These are organizations that had legacy systems running PHP 5.x or 7.x for years, and now face a forced major upgrade with no patch to fall back on — under active exploitation pressure. That’s the “on fire” part.
What We Did (and What You Should Do)
For our web sites, we implemented the patches on our 8.3+ PHP servers before the global panic button was even pressed. Our stack runs on cPanel 138.0.18, which bundles the patched ea-php83 build (8.3.36). On shared hosting, the host handles the PHP update — you just need to confirm they’ve deployed it.
If you’re on 8.2+: Confirm your PHP version is at or above the patched build (8.3.36, 8.4.27, 8.5.12). A quick phpinfo() check does it.
If you’re on 7.3 or older: You have no in-place fix. Plan your upgrade to 8.2+ now, or take the site offline until you can.
If you’re on a cPanel host running 7.4–8.1: cPanel backported the fix into the ea-php packages in their 138.0.18 build. Confirm your host has updated.
Key Takeaways
- PHP2Shell affects every PHP version from 5.4 onward. The fix exists for 8.2+; for 7.3 and older, the fix is an upgrade.
- ~60% of internet-facing PHP servers are on unsupported legacy versions. That’s the majority of the exposed population.
- Day-one patching separates secure, resilient architecture from emergency firefighter mode.
- A .ch domain has a structural advantage: U.S. courts have ruled ccTLDs are not attachable property under U.S. law, and the Swiss registry (SWITCH) operates outside U.S. jurisdiction — an extra layer of protection that .com domains simply don’t have.
