{"id":67867,"date":"2026-10-22T15:56:01","date_gmt":"2026-10-22T14:56:01","guid":{"rendered":"https:\/\/www.nettl.com\/uk\/?p=67867"},"modified":"2026-10-23T12:13:13","modified_gmt":"2026-10-23T11:13:13","slug":"php2shell","status":"publish","type":"post","link":"https:\/\/www.nettl.com\/uk\/php2shell\/","title":{"rendered":"PHP2Shell: what happened and how we protected your websites"},"content":{"rendered":"<div id='familiarity'  class='avia-section av-2qwy3ht-8a2c23e8b96a4ca6a0ee5518929c44bc main_color avia-section-default avia-no-border-styling  avia-builder-el-0  avia-builder-el-no-sibling  avia-bg-style-scroll container_wrap sidebar_right'  ><div class='container av-section-cont-open' ><main  role=\"main\" itemprop=\"mainContentOfPage\"  class='template-page content  av-content-small alpha units'><div class='post-entry post-entry-type-page post-entry-67867'><div class='entry-content-wrapper clearfix'>\n\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-jp009ut1-c2a891abf735c7eb7a5c24d037e4b61f\">\n.flex_column.av-jp009ut1-c2a891abf735c7eb7a5c24d037e4b61f{\nborder-radius:0px 0px 0px 0px;\npadding:0px 0px 0px 0px;\n}\n<\/style>\n<div  class='flex_column av-jp009ut1-c2a891abf735c7eb7a5c24d037e4b61f av_one_fifth  avia-builder-el-1  el_before_av_three_fifth  avia-builder-el-first  first flex_column_div av-hide-on-mobile av-zero-column-padding  '     ><\/div>\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-28z32gh-8306082e681bdb1a559cb023abad5737\">\n.flex_column.av-28z32gh-8306082e681bdb1a559cb023abad5737{\nborder-radius:0px 0px 0px 0px;\npadding:0px 0px 0px 0px;\n}\n<\/style>\n<div  class='flex_column av-28z32gh-8306082e681bdb1a559cb023abad5737 av_three_fifth  avia-builder-el-2  el_after_av_one_fifth  el_before_av_one_fifth  flex_column_div av-zero-column-padding  '     ><section  class='av_textblock_section av-1txvxe9-3461d3daee65744295e6faf23d8cd461 '   itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/BlogPosting\" itemprop=\"blogPost\" ><div class='avia_textblock'  itemprop=\"text\" ><h1>PHP2Shell<\/h1>\n<p>\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-v4g6ak-1d639df38b074c4c8eeb90b09a79d152\">\n.av_font_icon.av-v4g6ak-1d639df38b074c4c8eeb90b09a79d152 .av-icon-char{\nfont-size:1em;\nline-height:1em;\n}\n<\/style>\n<span  class='av_font_icon av-v4g6ak-1d639df38b074c4c8eeb90b09a79d152 avia_animate_when_visible av-icon-style- avia-icon-pos-left av-no-color avia-icon-animate'><span class='av-icon-char' aria-hidden='true' data-av_icon='\ue862' data-av_iconfont='entypo-fontello' ><\/span><\/span>\u00a0<em><strong>approx 3 minute read<\/strong><\/em><\/p>\n<\/div><\/section><br \/>\n\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-jp00gvdr-98d064f8eb1dbe52dc1f9fd3cb904193\">\n#top .hr.hr-invisible.av-jp00gvdr-98d064f8eb1dbe52dc1f9fd3cb904193{\nheight:50px;\n}\n<\/style>\n<div  class='hr av-jp00gvdr-98d064f8eb1dbe52dc1f9fd3cb904193 hr-invisible  avia-builder-el-5  el_after_av_textblock  el_before_av_textblock '><span class='hr-inner '><span class=\"hr-inner-style\"><\/span><\/span><\/div><br \/>\n<section  class='av_textblock_section av-1txvxe9-8-b9e674f23433555b7746fd54c5ce5564 '   itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/BlogPosting\" itemprop=\"blogPost\" ><div class='avia_textblock'  itemprop=\"text\" ><h2>What happened and how we protected your websites.<\/h2>\n<p>On 20 October, details of two critical security flaws in PHP leaked online before a fix was ready.<\/p>\n<p>PHP is the software behind most of the world&#8217;s websites, including every WordPress site.<\/p>\n<p>If your website is hosted with Nettl, we had protection in place within 80 minutes of the first reported attacks, and every site was fully patched by 4:30am the next morning.<\/p>\n<p>This post explains what happened, how we responded, and what keeps your site safe long term.<\/p>\n<\/div><\/section><br \/>\n\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-qmamij-79159e27bd3853956f90368a4b15b42a\">\n#top .hr.hr-invisible.av-qmamij-79159e27bd3853956f90368a4b15b42a{\nheight:50px;\n}\n<\/style>\n<div  class='hr av-qmamij-79159e27bd3853956f90368a4b15b42a hr-invisible  avia-builder-el-7  el_after_av_textblock  el_before_av_image '><span class='hr-inner '><span class=\"hr-inner-style\"><\/span><\/span><\/div><br \/>\n\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-h2771v5-428d17b6c90f53710144c332616e3263\">\n.avia-image-container.av-h2771v5-428d17b6c90f53710144c332616e3263 img.avia_image{\nbox-shadow:none;\n}\n.avia-image-container.av-h2771v5-428d17b6c90f53710144c332616e3263 .av-image-caption-overlay-center{\ncolor:#ffffff;\n}\n<\/style>\n<div  class='avia-image-container av-h2771v5-428d17b6c90f53710144c332616e3263 av-styling- avia-align-  avia-builder-el-8  el_after_av_hr  el_before_av_hr '   itemprop=\"image\" itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/ImageObject\" ><div class=\"avia-image-container-inner\"><div class=\"avia-image-overlay-wrap\"><img decoding=\"async\" fetchpriority=\"high\" class='wp-image-67873 avia-img-lazy-loading-not-67873 avia_image ' src=\"https:\/\/www.nettl.com\/uk\/wp-content\/smush-webp\/2026\/10\/php2shell-developer-thinking-about-wordpress-900.jpg.webp\" alt='php2shell response' title='php2shell-developer-thinking-about-wordpress-900'  height=\"672\" width=\"900\"  itemprop=\"thumbnailUrl\" srcset=\"https:\/\/www.nettl.com\/uk\/wp-content\/smush-webp\/2026\/10\/php2shell-developer-thinking-about-wordpress-900.jpg.webp 900w, https:\/\/www.nettl.com\/uk\/wp-content\/smush-webp\/2026\/10\/php2shell-developer-thinking-about-wordpress-900-300x224.jpg.webp 300w, https:\/\/www.nettl.com\/uk\/wp-content\/smush-webp\/2026\/10\/php2shell-developer-thinking-about-wordpress-900-80x60.jpg.webp 80w, https:\/\/www.nettl.com\/uk\/wp-content\/smush-webp\/2026\/10\/php2shell-developer-thinking-about-wordpress-900-768x573.jpg.webp 768w, https:\/\/www.nettl.com\/uk\/wp-content\/smush-webp\/2026\/10\/php2shell-developer-thinking-about-wordpress-900-705x526.jpg.webp 705w\" sizes=\"(max-width: 900px) 100vw, 900px\" data-smush-webp-fallback=\"{&quot;src&quot;:&quot;https:\\\/\\\/www.nettl.com\\\/uk\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/php2shell-developer-thinking-about-wordpress-900.jpg&quot;,&quot;srcset&quot;:&quot;https:\\\/\\\/www.nettl.com\\\/uk\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/php2shell-developer-thinking-about-wordpress-900.jpg 900w, https:\\\/\\\/www.nettl.com\\\/uk\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/php2shell-developer-thinking-about-wordpress-900-300x224.jpg 300w, https:\\\/\\\/www.nettl.com\\\/uk\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/php2shell-developer-thinking-about-wordpress-900-80x60.jpg 80w, https:\\\/\\\/www.nettl.com\\\/uk\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/php2shell-developer-thinking-about-wordpress-900-768x573.jpg 768w, https:\\\/\\\/www.nettl.com\\\/uk\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/php2shell-developer-thinking-about-wordpress-900-705x526.jpg 705w&quot;}\" \/><\/div><\/div><\/div><br \/>\n\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-jp00gvdr-7-147b7810a280ff852f1ddc3e99afdfac\">\n#top .hr.hr-invisible.av-jp00gvdr-7-147b7810a280ff852f1ddc3e99afdfac{\nheight:50px;\n}\n<\/style>\n<div  class='hr av-jp00gvdr-7-147b7810a280ff852f1ddc3e99afdfac hr-invisible  avia-builder-el-9  el_after_av_image  el_before_av_textblock '><span class='hr-inner '><span class=\"hr-inner-style\"><\/span><\/span><\/div><br \/>\n<section  class='av_textblock_section av-1txvxe9-6-f7d4ad8b15571b7347af45f7dbbe01cb '   itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/BlogPosting\" itemprop=\"blogPost\" ><div class='avia_textblock'  itemprop=\"text\" ><h2>What happened<\/h2>\n<p data-lfile-container=\"e49f0062-57e6-480d-af08-3166c7f4ae82\" data-pm-slice=\"1 1 &#091;&#093;\">PHP is the programming language that runs on the server behind your website. Every time someone loads a page on a WordPress site, PHP is doing the work.<\/p>\n<p>The two flaws were found in PHP itself, not in a single plugin or theme. Security experts rated both 9.2 out of 10 for severity.<\/p>\n<p>In plain terms, they could let an attacker take control of the server a website runs on. Early reports suggest the weakness had gone unnoticed for around 10 years.<\/p>\n<p>The details were meant to stay private until the fix was released.<\/p>\n<p>Instead they leaked a day early, which gave attackers a head start.<\/p>\n<p>Before the fix was even out, Cloudflare reported seeing the first attacks. The story made the BBC&#8217;s front page, and some companies took websites offline altogether while they waited.<\/p>\n<\/div><\/section><br \/>\n\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-1co60jf-8aea441432d6d22c75419cb674408476\">\n#top .hr.hr-invisible.av-1co60jf-8aea441432d6d22c75419cb674408476{\nheight:50px;\n}\n<\/style>\n<div  class='hr av-1co60jf-8aea441432d6d22c75419cb674408476 hr-invisible  avia-builder-el-11  el_after_av_textblock  el_before_av_textblock '><span class='hr-inner '><span class=\"hr-inner-style\"><\/span><\/span><\/div><br \/>\n<section  class='av_textblock_section av-mvjntuer-278a82365e141ca637a465843c995148 '   itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/BlogPosting\" itemprop=\"blogPost\" ><div class='avia_textblock'  itemprop=\"text\" ><h2>How we protected your website<\/h2>\n<p data-lfile-container=\"e49f0062-57e6-480d-af08-3166c7f4ae82\" data-pm-slice=\"1 1 &#091;&#093;\">Cloudflare reported the first attacks at 8:45am on 21 October.<\/p>\n<p data-lfile-container=\"e49f0062-57e6-480d-af08-3166c7f4ae82\" data-pm-slice=\"1 1 &#091;&#093;\">By 10:05am, our team had protective blocks in place across every site we host, keeping your website shielded while we waited for the official fix.<\/p>\n<p>PHP released the fix at 3pm UK time on 21 October. Our team worked through the night to roll it out, and by 4:30am on 22 October every site we host was fully patched, including those on older versions of PHP.<\/p>\n<p>With the patches in place, we lifted the temporary restrictions.<\/p>\n<p>Some hosting companies left their customers to apply these changes themselves.<\/p>\n<p><strong>We did the opposite.<\/strong> The patches were applied for you, and because they&#8217;re backward compatible, your website still runs on the same version of PHP with nothing for you to change.<\/p>\n<\/div><\/section><br \/>\n\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-jp00gvdr-5-8b94cf24fcc37d8b52de611c4c57331e\">\n#top .hr.hr-invisible.av-jp00gvdr-5-8b94cf24fcc37d8b52de611c4c57331e{\nheight:50px;\n}\n<\/style>\n<div  class='hr av-jp00gvdr-5-8b94cf24fcc37d8b52de611c4c57331e hr-invisible  avia-builder-el-13  el_after_av_textblock  el_before_av_codeblock '><span class='hr-inner '><span class=\"hr-inner-style\"><\/span><\/span><\/div><br \/>\n<br \/>\n\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-wybn7f-ea3bcaf6636aabfd6b03e0344dde4d2b\">\n#top .hr.hr-invisible.av-wybn7f-ea3bcaf6636aabfd6b03e0344dde4d2b{\nheight:50px;\n}\n<\/style>\n<div  class='hr av-wybn7f-ea3bcaf6636aabfd6b03e0344dde4d2b hr-invisible  avia-builder-el-15  el_after_av_codeblock  el_before_av_textblock '><span class='hr-inner '><span class=\"hr-inner-style\"><\/span><\/span><\/div><br \/>\n<section  class='av_textblock_section av-1txvxe9-4-f7df570bbc59abb6a0e8ff6fc07551bf '   itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/BlogPosting\" itemprop=\"blogPost\" ><div class='avia_textblock'  itemprop=\"text\" ><h2>Why this matters beyond this week<\/h2>\n<p>Attacks like this are getting faster. AI tools now help attackers find and use a weakness within hours of it going public. The same tools also help us spot and respond to threats sooner.<\/p>\n<p>This flaw appears to have gone undetected for around a decade. No one can fix a weakness before it&#8217;s found, but you can make sure someone is ready to act the moment it is.<\/p>\n<p>This week&#8217;s fix was for PHP. Your website also runs WordPress, a theme and a set of plugins, and each of them gets security updates through the year. A site that misses those updates is the easiest kind to break into.<\/p>\n<\/div><\/section><br \/>\n\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-jp00gvdr-3-8020f9be6fdcef52e32a5b5acd548019\">\n#top .hr.hr-invisible.av-jp00gvdr-3-8020f9be6fdcef52e32a5b5acd548019{\nheight:50px;\n}\n<\/style>\n<div  class='hr av-jp00gvdr-3-8020f9be6fdcef52e32a5b5acd548019 hr-invisible  avia-builder-el-17  el_after_av_textblock  el_before_av_textblock '><span class='hr-inner '><span class=\"hr-inner-style\"><\/span><\/span><\/div><br \/>\n<section  class='av_textblock_section av-mvjnxla9-14a7def7eccb38fd58ccf55abea598bc '   itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/BlogPosting\" itemprop=\"blogPost\" ><div class='avia_textblock'  itemprop=\"text\" ><h2>How a Care Plan keeps you covered<\/h2>\n<p>That&#8217;s the job of our <a href=\"https:\/\/www.nettl.com\/uk\/care-plans\/\" target=\"_blank\" rel=\"noopener\">Care Plans<\/a>. Your site&#8217;s software is kept up to date and monitored for you, including the version of PHP it runs on.<\/p>\n<p>Care Plan sites also get priority support from our technical team when something like this happens.<\/p>\n<p>It means someone is looking after your website&#8217;s security, so you can get on with running your business.<\/p>\n<p>If your site isn&#8217;t on a Care Plan yet, ask <a href=\"https:\/\/www.nettl.com\/uk\/studio-locator\" target=\"_blank\" rel=\"noopener\">your local Nettl studio<\/a> about adding one.<\/p>\n<\/div><\/section><br \/>\n\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-jp00gvdr-2-e0757191eb24c036ba193ee969f20a5e\">\n#top .hr.hr-invisible.av-jp00gvdr-2-e0757191eb24c036ba193ee969f20a5e{\nheight:50px;\n}\n<\/style>\n<div  class='hr av-jp00gvdr-2-e0757191eb24c036ba193ee969f20a5e hr-invisible  avia-builder-el-19  el_after_av_textblock  el_before_av_button '><span class='hr-inner '><span class=\"hr-inner-style\"><\/span><\/span><\/div><br \/>\n<div  class='avia-button-wrap av-jinlazj9-f47f8387f79c7df52db169272c375004-wrap avia-button-center  avia-builder-el-20  el_after_av_hr  avia-builder-el-last '><a href='https:\/\/www.nettl.com\/uk\/studio-locator'  class='avia-button av-jinlazj9-f47f8387f79c7df52db169272c375004 av-link-btn avia-icon_select-yes-left-icon avia-size-large avia-position-center avia-color-theme-color'  ><span class='avia_button_icon avia_button_icon_left' aria-hidden='true' data-av_icon='\ue803' data-av_iconfont='entypo-fontello'><\/span><span class='avia_iconbox_title' >Find your nearest Nettl<\/span><\/a><\/div><\/p><\/div>\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-jp00a0tr-ca081bd21a4ac0057905c2c9922a0c55\">\n.flex_column.av-jp00a0tr-ca081bd21a4ac0057905c2c9922a0c55{\nborder-radius:0px 0px 0px 0px;\npadding:0px 0px 0px 0px;\n}\n<\/style>\n<div  class='flex_column av-jp00a0tr-ca081bd21a4ac0057905c2c9922a0c55 av_one_fifth  avia-builder-el-21  el_after_av_three_fifth  avia-builder-el-last  flex_column_div av-hide-on-mobile av-zero-column-padding  '     ><\/div><\/div><\/div><\/main><!-- close content main element --><\/div><\/div><div id='after_section_1'  class='main_color av_default_container_wrap container_wrap sidebar_right'  ><div class='container av-section-cont-open' ><div class='template-page content  av-content-small alpha units'><div class='post-entry post-entry-type-page post-entry-67867'><div class='entry-content-wrapper clearfix'>\n","protected":false},"excerpt":{"rendered":"<p>Two critical PHP flaws leaked online on 20 October, and attacks followed within hours. Here\u2019s what happened, how we protected every site we host overnight, and how a Care Plan keeps yours covered.<\/p>\n","protected":false},"author":234,"featured_media":67875,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"iawp_total_views":93,"footnotes":""},"categories":[16],"tags":[],"class_list":["post-67867","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.nettl.com\/uk\/wp-json\/wp\/v2\/posts\/67867","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.nettl.com\/uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.nettl.com\/uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.nettl.com\/uk\/wp-json\/wp\/v2\/users\/234"}],"replies":[{"embeddable":true,"href":"https:\/\/www.nettl.com\/uk\/wp-json\/wp\/v2\/comments?post=67867"}],"version-history":[{"count":7,"href":"https:\/\/www.nettl.com\/uk\/wp-json\/wp\/v2\/posts\/67867\/revisions"}],"predecessor-version":[{"id":67889,"href":"https:\/\/www.nettl.com\/uk\/wp-json\/wp\/v2\/posts\/67867\/revisions\/67889"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.nettl.com\/uk\/wp-json\/wp\/v2\/media\/67875"}],"wp:attachment":[{"href":"https:\/\/www.nettl.com\/uk\/wp-json\/wp\/v2\/media?parent=67867"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.nettl.com\/uk\/wp-json\/wp\/v2\/categories?post=67867"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.nettl.com\/uk\/wp-json\/wp\/v2\/tags?post=67867"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}