After PHP2Shell, is PHP still the right choice for your website?
Tom Houdmont
on
If your website runs on WordPress, Drupal, Joomla or Magento, PHP2Shell has probably made you ask whether the technology underneath it is still safe to rely on. Our answer is yes, as long as it’s kept up to date. PHP2Shell, a pair of critical flaws in PHP itself, put millions of sites at risk and took government websites offline in several countries as a precaution. Here’s what happened, what you should do now, and why we still recommend PHP for most of the web projects we build.
What is PHP2Shell?
PHP2Shell is the name given to two vulnerabilities in the PHP engine, rated 9.2 out of 10 for severity. They let an attacker send a crafted request to a server and read sensitive data from its memory, and in some cases run their own code on it, without logging in.
Because the flaws sit in PHP rather than in any one application, a fully up-to-date WordPress or Drupal site was still exposed until the PHP version on its server was updated. Every version of PHP back to 5.4, released in 2012, was affected.
Fixed versions were released on 21 October 2026, and attackers are actively exploiting unpatched servers. Take-up in the UK has been slow, with reports suggesting only around a quarter of organisations had patched in the first days.
What should you do now?
The fix is to update PHP on your servers to a patched release: 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later. Updating your CMS or plugins on their own won’t close the gap. If your site ran an unpatched version of PHP at any point, assume the passwords and API keys it uses, such as database logins and keys for payment or email services, may have been read, and change them: patching stops new attacks, but it doesn’t undo a leak that has already happened.
If your site is hosted by a provider or looked after by an agency, ask them which PHP version is running and when it was last updated. If the answer is a version older than 8.2, it no longer receives security fixes, and this is the moment to plan an upgrade. The next flaw won’t be fixed for you.
What did we do for our clients?
On the day the fixes were released, we identified every client affected and contacted them. Every impacted system we look after has been patched. Where clients run servers themselves, we gave them guidance on what to update and how to check them.
Talk to one of our digital experts
Pete Withers-Jones
Head of Development
Do you have an idea or a project you need support with?
Pete Withers-Jones leads Box UK’s Development Practice, and has over 20 years of experience in software development, working across various industries and technologies.
No. PHP runs roughly 70% of websites whose server-side language can be identified. A flaw this severe in any technology used that widely would have had the same global impact. The headlines tell you how much of the web depends on PHP. They don’t tell you PHP is uniquely fragile.
It’s also worth being clear about where security risk is heading. PHP2Shell was found with the help of AI. Security firm Calif uncovered the flaws while auditing PHP with OpenAI’s models, and Wiz Research found them separately using its own AI tools. Wiz says AI let one researcher do in about a week what would previously have taken a specialist team months.
Attackers have the same tools, which shortens the time between a fix being published and someone using it against servers that haven’t applied it. PHP won’t be the last major platform to have a bad month. In fact, recently Anthropic reported that its Mythos model and around 50 partner organisations had found more than 10,000 high- or critical-severity flaws in widely used software in a single month.
Switching to a different language doesn’t remove that risk. What protects you is keeping your software up to date, and having someone clearly responsible for doing it quickly when a fix is released.
How has the PHP Foundation responded?
The PHP Foundation, which oversees the language, has been open about its own part in this. It acknowledged that early signs of the problem surfaced in a 2024 audit, and that the delay in acting on them came down to how its security team made decisions and how thinly it was resourced. It is now moving to majority-based decisions and is asking companies and governments to help fund PHP’s maintenance.
We’d rather rely on a project that says that plainly and changes how it works than one that doesn’t.
Why do we still recommend PHP?
You can find people to build and support it
PHP has one of the largest developer communities of any language. For you, that means more choice when you need to grow a team, and less risk of being tied to one supplier or a handful of specialists who are hard to replace. That matters now, and it matters in five years’ time, when your site still needs looking after.
Hosting is flexible and straightforward
PHP runs on almost any web host, from simple shared hosting to managed cloud platforms. That gives you more choice of provider and price, and fewer moving parts to manage than many alternatives.
You’re not paying to reinvent the wheel
Packagist, the main library of reusable PHP code, hosts over 400,000 packages and handles around 100 million installs a day. Long-established frameworks such as Symfony and Laravel sit on top of it. Common features already exist as tested, maintained components, so more of your budget goes on the parts of your project that are specific to your organisation.
The leading content management systems run on it
WordPress is used by around 40% of all websites, far ahead of any other CMS. Drupal and Joomla, the other major open-source CMSs, are also built on PHP. Drupal is particularly strong with larger organisations, running on 6 to 7% of the top 10,000 websites. Choosing PHP keeps the most widely used and best-supported publishing platforms open to you.
Modern PHP isn’t the PHP of 2010
Recent versions are considerably faster than older ones, and they give developers tools to catch mistakes before code reaches your live site. If your impression of PHP was formed a decade ago, it’s out of date.
Should you move away from PHP?
No. PHP2Shell was serious, and it needed fixing quickly. It wasn’t a reason to abandon one of the most widely used and best-supported platforms on the web.
The lesson is to keep the platform up to date and to make sure someone is accountable for doing it. If you’re not sure which version of PHP your site is running, or whether it has been patched, get in touch and we’ll check it for you.
Is your website’s technical foundation secure?
PHP security is just one part of keeping a website safe and reliable. Our Technical Architecture Review assesses your codebase, infrastructure and security risks, helping you identify weaknesses, understand what needs attention and plan for the future.
As CTO at Box UK, Tom brings 12 years of experience delivering ambitious digital products. He specializes in scalable architecture, high-traffic websites, and practical AI adoption.
You might also be interested in…
Blog
When should a council commission a technical architecture review?
Read more: When should a council commission a technical architecture review?