Internet Armageddon: 7 in 10 Websites Just Got a Wake-Up Call

Technical update: PHP has released emergency fixes for CVE-2026-109618 and CVE-2026-109619 (“PHP2Shell”), two critical flaws that could let attackers execute code remotely on web servers without logging in. Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, restart PHP-FPM or your web server, and confirm the version your site is actually serving, not just what php -v says. Anything on 8.1 or older needs an upgrade, not just a patch.

What this means if you’re not technical

PHP is the engine behind most websites. If your site runs on WordPress, WooCommerce, Magento or a custom web app, it almost certainly uses PHP, even if you’ve never heard the name.

This week, researchers found two serious flaws in that engine. In plain terms, they could let a stranger on the internet take control of the server your website runs on, with no password needed. Security researcher Kevin Beaumont called it one of the biggest vulnerabilities in years.

The good news is that a fix is out. The catch is that it only helps if someone actually applies it. Updating your plugins or themes won’t do it, because the fix has to happen on the server itself.

Who’s affected

The short answer is a lot of the internet.

PHP runs about 7 in 10 websites whose technology can be identified. That includes most WordPress sites, many online stores, and countless customer portals and internal business tools.

Every PHP installation that serves web requests is affected, so if your website runs on PHP, it’s in scope until it’s updated.

The most worrying group is websites on older versions. Only about 62% of PHP websites run PHP 8. The rest, more than a third, run PHP 7 or older, and those versions don’t get an official fix. Some early PHP 8 versions are in the same boat. If your site was built several years ago and nobody has upgraded it since, there’s a real chance it’s in this group.

Why it matters to your business

A security flaw like this isn’t only an IT problem. If someone gets into the server behind your website, the consequences land on the business:

• Customer data such as names, emails and order history could be exposed.
• Your website could go down, or start showing things you never published.
• Your reputation takes the hit, because customers don’t care whose software had the bug.
• The rest of your systems could be next, since a compromised website is often how bigger attacks begin.

What we did for our clients

For the businesses whose infrastructure we manage, this was handled within minutes the patch came out. We applied the fix, confirmed it was live, and checked for anything unusual. Our clients didn’t have to lift a finger, and most only heard about PHP2Shell when we told them it was already taken care of.

That’s how an emergency like this should feel: like a non-event.

Three questions to ask this week

You don’t need to be technical to protect your business. Ask whoever looks after your website, whether that’s an agency, a hosting provider or someone in-house:

1. Have all our sites been updated to the patched version of PHP?
2. Are any of our sites or apps running an old version that didn’t get the fix?
3. Who is responsible for keeping our systems up to date going forward?

If the answers are vague, or there isn’t a clear answer to the last one, it’s worth a closer look.

The real takeaway: it’s time to update your stack

This won’t be the last emergency like this. AI is making it faster than ever to build great software, and it’s also making it faster than ever to find weaknesses in old software. Attackers can now scan huge numbers of websites in hours, looking for exactly the kind of outdated systems many businesses still rely on.

A few signs your stack might be overdue for an update:

• Your website was built years ago and hasn’t been substantially updated since.
• Nobody on your team knows which version of anything you’re running.
• Small changes take longer and cost more than they should.
• The person or agency who built it has moved on.

Patching gets you through this week. A modern stack gets you through the next one, and it’s also easier to secure, faster for your customers, and simpler to build on as your business grows.

Not sure where you stand?

Productshop is a Montréal-based software and product studio. We build modern software, manage infrastructure, and work alongside leadership teams as technical advisors. We can check your site, tell you plainly whether you’re exposed, and help you plan a move to a stack that’s secure, fast and easy to keep current. Reach out to us for a free stack check: hello@productshop.io or Contact Us