PHP2Shell: What Founders and Small Businesses Should Do Now

What happened

On Wednesday, 21 October 2026, the PHP team released emergency patches for two critical bugs, nicknamed PHP2Shell. PHP is the software behind a huge share of the web, and some estimates say more than 70% of websites use it. The worst case is simple: an attacker takes control of your server, steals your data or defaces your site. Government sites in the Netherlands and Finland went offline as a precaution, and Amazon says attackers started going after the bugs on 17 October, four days before the patches. We wrote this for founders and small business owners, not server engineers. Plain words first, developer notes near the end.

Why this is about your website, even if you never touch code

PHP sits on your hosting server and builds your web pages every time someone visits. WordPress runs on it, and WordPress powers about 43% of all websites, according to W3Techs figures quoted by Reuters. If your site is on WordPress, it runs on PHP. Here is the part that catches people out. Updating WordPress does not fix this. Wordfence says automatic updates will not apply the fix, and BusinessDay's guide for Nigerians notes that updating the WordPress dashboard does not necessarily update the PHP runtime. Ghana's cyber agency says the same about themes and plugins. So the fix lives with your host. On shared hosting, you do not manage the server yourself, and Reuters reports that security experts expect such sites to take longer to patch.

What it looks like in Nigeria and across Africa

The Nigerian response we could find is an alert on X, while Kenya and Ghana gave their government bodies instructions and, in Ghana's case, a deadline. As of 23 October, none of the Nigerian reports we found names a Nigerian site that was hit.

Who	What they did	Source
ngCERT (Nigeria)	Posted a PHP2Shell alert on X on 21 October. It ended with "Patch Now!"	ngCERT X account
Kenya's ICT ministry and ICT Authority	Advisory dated 21 October: government agencies should apply updates, and restrict external access or take systems offline if they cannot secure them	TechTrends Kenya
Ghana's Cyber Security Authority and NITA	Told government institutions to fix the flaws within seven days, and warned about fake messages offering a "PHP security update"	GhanaWeb
Afrihost and Xneelo (South African hosts)	Patched or mitigated customer servers	MyBroadband

One Nigerian outlet, Technext, criticised the ngCERT post for giving no technical instructions. You can read it here That is their opinion, and we are noting it, not endorsing it.

What to do today: ask your host two questions

Message your hosting provider through their support channel and ask:

1. What PHP version is my website running?
2. Have you applied the 21 October PHP security update (CVE-2026-109618 and CVE-2026-109619)?

BusinessDay's guide adds a few more worth asking. Is any action needed from me as the site owner? Who monitors security alerts, keeps backups and handles incidents? It also warns that a hosting subscription does not automatically cover every security responsibility, and that shared hosting needs particular attention. While you wait for an answer:

• Use unique passwords and multi-factor authentication on your hosting, domain registrar and business email accounts.
• Keep a recent backup of your files and database, with one copy stored away from your live site. A backup only counts if you can restore from it.
• Be careful with messages offering a "PHP security update". Ghana's cyber agency warned about exactly this. Get updates only from your host or official sources.

For developers and server owners

The PHP Project's own fixes are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Versions older than 8.2 no longer receive updates from the PHP Project, so on those branches you need either an upgrade or a vendor backport. cPanel has released patched EasyApache 4 builds from PHP 7.4 upward. For anything older than 7.4, cPanel points to TuxCare Extended Lifecycle Support. Its article also has the update steps and a command to confirm a package is patched.

cPanel EasyApache 4 package	Patched build
ea-php74	7.4.33-19
ea-php80	8.0.30-12
ea-php81	8.1.34-5
ea-php82	8.2.35
ea-php83	8.3.36
ea-php84	8.4.27
ea-php85	8.5.12

If you cannot patch right away:

• Treat firewall rules as a stopgap. Cloudflare's CTO said its mitigations are "a STOPGAP only", and Kenya's advisory calls firewalls supplementary to patching.
• Technext, citing Qualys and Armis guidance, lists disabling PHP's built-in upload progress tracker and tightening request-size and upload limits as interim steps.
• Restart PHP-FPM or Apache after updating so the new binaries load, per the same guide.

After patching, check your logs. Amazon reports first attempts on 17 October, so look back that far. Technext also advises rotating database credentials and payment gateway keys held on internet-facing PHP servers, naming Paystack, Flutterwave and Monnify webhooks.

What we still do not know

The public reports do not yet give a clear picture of how many sites were actually broken into. Amazon says the flaws are now broadly exploited in the wild, but it is unclear how many attacks succeeded. Dataminr says activity stayed limited to scanning, fingerprinting and non-working exploits, with no known compromises. Those two reports are from the same day, and we are treating both as open. We also have no count of Nigerian sites running affected versions. Profiled Nigeria says it found no published figure for Nigeria, and we have not found one either. There is also a dispute over how the fix got out. PHP says Chainguard published fixed images more than six hours before the coordinated release; Chainguard's CEO says the company did not leak and he would not change the decision. That does not change what you need to do, but it explains the rush. This story is moving quickly, so check the sources below for the latest.

Need a second pair of eyes?

If you are not sure what your website runs on, we can help you make sense of it. Our Website Audit is a good place to start, or tell us what slows your business down: nforshifu234dev.com/contact.

Sources

All pages below were opened and read for this post. Information is current as of 23 October 2026.

• The Record: PHP says AI review of critical bugs first sparked alarm in August
• The Register: PHP blames Chainguard for putting huge chunks of the web at risk
• CNBC (Reuters): Government websites in Europe and elsewhere go dark as software flaw sparks security scramble
• BleepingComputer: Amazon says PHP2Shell exploitation began 4 days before patches
• cPanel Support: Critical PHP Security Release, CVE-2026-109618 and CVE-2026-109619
• Technext: What Nigerian businesses and users must do beyond ngCERT's tweet
• BusinessDay: How Nigerians can protect their websites from critical PHP vulnerabilities
• Profiled Nigeria: PHP2Shell vulnerability, what every Nigerian should know
• TechTrends Kenya: Kenya warns government agencies over exposed systems
• GhanaWeb: CSA and NITA give government agencies seven days to fix PHP flaws
• MyBroadband: South African companies scrambled to protect customers from critical PHP security flaw