October 21, 2026

Two critical PHP vulnerabilities, known as “php2shell”, were disclosed publicly today. They can let an unauthenticated attacker run code on a web server with a single crafted request, and exploit attempts are already being seen. PHP runs a large share of the internet, so the impact is very broad.

Who is affected
Any server running PHP to serve web pages, including PHP-FPM and Apache mod_php. This covers WordPress, Magento, and custom PHP applications.

What to do
Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or newer, then restart PHP services. PHP 8.1 and older get no upstream fix and must be upgraded. A web application firewall (WAF) such as Cloudflare or AWS WAF can reduce exposure while you plan. Cloudflare has published rules for this. A WAF is a short-term stopgap, not a fix.

What DCI support plans cover

• Operating system updates: Covered on all servers.
• Plesk servers: Covered. We manage the Plesk environment, so we can update and patch the PHP versions Plesk provides.
• PHP application on non-Plesk servers: Call us at 949-215-1200. Application-level software is typically the client’s responsibility.
• Custom code and websites: Typically not covered. Your web development team owns compatibility with newer PHP versions.

How we can help
Our engineers are eager to help with any of the above, at our standard rates. We can update PHP on non-Plesk servers, patch your application code, or move them to a supported PHP version. Let us know how you want to proceed and we will accommodate.

Please coordinate any PHP upgrade with us. A newer PHP can break older code, and if it is updated without your developers knowing, your site may stop working. Your web development team should start reviewing now.

What we are doing
We are inventorying all systems we host. Each client will get a customized notice listing which servers and websites are exposed.

To get started, open a ticket at portal.dynamic.com or call us at 949-215-1200.

Sources: PHP security release, Cloudflare, Plesk advisory.