Blog Security
PHP2Shell: keeping a legacy PHP site safe when no official fix existed
PHP2Shell has no official fix for PHP 7.3 and older. Here's how we patched a client's PHP 7.2 site and had it back online the same day.
- Published
- Reading time
- 2 min
- Written by
- Alex Tweedie
On 21 October 2026, PHP released emergency fixes for PHP2Shell (CVE-2026-109618 and CVE-2026-109619). The two critical flaws let an attacker take over a web server without logging in. Attacks were seen in the wild within hours.
The new releases only cover supported versions: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. For PHP 7.4, 8.0 and 8.1, PHP's security team also published source-code patches for people who build PHP themselves. Anything older, right back to PHP 5, is vulnerable too but gets nothing. That leaves a lot of long-running business websites exposed.
One of our clients was in exactly that position. Their busy directory site runs on PHP 7.2, which has been out of support since 2020, and a replacement platform is still being built. Here's how we got them patched and back online the same day.
What we did
Closed the site first. We put up a branded holding page and blocked all public access to PHP, so there was nothing for attackers to hit while we worked.
Checked for a break-in. We reviewed the logs, recently changed files, running processes and scheduled tasks. We found no sign of a compromise.
Reviewed an unofficial patch line by line. With no official fix for PHP 7.2, we turned to a community-written backport and checked it line by line. It closes both vulnerabilities and does nothing else. It didn't fit the client's PHP build exactly, though, so we corrected it without losing any part of the fix.
Built and tested on a replica. On a copy of the production server, we compiled the patched PHP and ran automated tests. They confirmed the attack was blocked and that uploads, sessions and normal pages all still worked. We also prepared a rollback that would take about a minute.
Installed it behind the holding page. We backed everything up, installed the patch with the public still kept out, and tested the real site privately from end to end.
Reopened and monitored. In the first half hour the site served more than 5,000 requests with no errors.
Lessons for site owners
- Know your PHP version. If it's older than 8.2, there's no official release with the fix. 7.4 to 8.1 have an official source patch, and 7.3 and older have nothing.
- Close first, fix second. A few hours offline costs far less than a hacked server.
- Unofficial patches can work, but only after careful review and testing.
- Always have a rollback ready before you change anything.
- Patching buys time. Modernising is the real cure.