{"id":67867,"date":"2026-10-22T15:56:01","date_gmt":"2026-10-22T14:56:01","guid":{"rendered":"https:\/\/www.nettl.com\/uk\/?p=67867"},"modified":"2026-10-22T16:07:24","modified_gmt":"2026-10-22T15:07:24","slug":"php2shell","status":"publish","type":"post","link":"https:\/\/www.nettl.com\/uk\/php2shell\/","title":{"rendered":"PHP2Shell: what happened and how we protected your websites"},"content":{"rendered":"<div id='familiarity'  class='avia-section av-2qwy3ht-8a2c23e8b96a4ca6a0ee5518929c44bc main_color avia-section-default avia-no-border-styling  avia-builder-el-0  avia-builder-el-no-sibling  avia-bg-style-scroll container_wrap sidebar_right'  ><div class='container av-section-cont-open' ><main  role=\"main\" itemprop=\"mainContentOfPage\"  class='template-page content  av-content-small alpha units'><div class='post-entry post-entry-type-page post-entry-67867'><div class='entry-content-wrapper clearfix'>\n\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-jp009ut1-c2a891abf735c7eb7a5c24d037e4b61f\">\n.flex_column.av-jp009ut1-c2a891abf735c7eb7a5c24d037e4b61f{\nborder-radius:0px 0px 0px 0px;\npadding:0px 0px 0px 0px;\n}\n<\/style>\n<div  class='flex_column av-jp009ut1-c2a891abf735c7eb7a5c24d037e4b61f av_one_fifth  avia-builder-el-1  el_before_av_three_fifth  avia-builder-el-first  first flex_column_div av-hide-on-mobile av-zero-column-padding  '     ><\/div>\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-28z32gh-8306082e681bdb1a559cb023abad5737\">\n.flex_column.av-28z32gh-8306082e681bdb1a559cb023abad5737{\nborder-radius:0px 0px 0px 0px;\npadding:0px 0px 0px 0px;\n}\n<\/style>\n<div  class='flex_column av-28z32gh-8306082e681bdb1a559cb023abad5737 av_three_fifth  avia-builder-el-2  el_after_av_one_fifth  el_before_av_one_fifth  flex_column_div av-zero-column-padding  '     ><section  class='av_textblock_section av-1txvxe9-3461d3daee65744295e6faf23d8cd461 '   itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/BlogPosting\" itemprop=\"blogPost\" ><div class='avia_textblock'  itemprop=\"text\" ><h1>PHP2Shell<\/h1>\n<p>\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-v4g6ak-1d639df38b074c4c8eeb90b09a79d152\">\n.av_font_icon.av-v4g6ak-1d639df38b074c4c8eeb90b09a79d152 .av-icon-char{\nfont-size:1em;\nline-height:1em;\n}\n<\/style>\n<span  class='av_font_icon av-v4g6ak-1d639df38b074c4c8eeb90b09a79d152 avia_animate_when_visible av-icon-style- avia-icon-pos-left av-no-color avia-icon-animate'><span class='av-icon-char' aria-hidden='true' data-av_icon='\ue862' data-av_iconfont='entypo-fontello' ><\/span><\/span>\u00a0<em><strong>approx 3 minute read<\/strong><\/em><\/p>\n<\/div><\/section><br \/>\n\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-jp00gvdr-98d064f8eb1dbe52dc1f9fd3cb904193\">\n#top .hr.hr-invisible.av-jp00gvdr-98d064f8eb1dbe52dc1f9fd3cb904193{\nheight:50px;\n}\n<\/style>\n<div  class='hr av-jp00gvdr-98d064f8eb1dbe52dc1f9fd3cb904193 hr-invisible  avia-builder-el-5  el_after_av_textblock  el_before_av_textblock '><span class='hr-inner '><span class=\"hr-inner-style\"><\/span><\/span><\/div><br \/>\n<section  class='av_textblock_section av-1txvxe9-8-b9e674f23433555b7746fd54c5ce5564 '   itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/BlogPosting\" itemprop=\"blogPost\" ><div class='avia_textblock'  itemprop=\"text\" ><h2>What happened and how we protected your websites.<\/h2>\n<p>On 20 October, details of two critical security flaws in PHP leaked online before a fix was ready.<\/p>\n<p>PHP is the software behind most of the world&#8217;s websites, including every WordPress site.<\/p>\n<p>If your website is hosted with Nettl, we had protection in place within 80 minutes of the first reported attacks, and every site was fully patched by 7am the next morning.<\/p>\n<p>This post explains what happened, how we responded, and what keeps your site safe long term.<\/p>\n<\/div><\/section><br \/>\n\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-qmamij-79159e27bd3853956f90368a4b15b42a\">\n#top .hr.hr-invisible.av-qmamij-79159e27bd3853956f90368a4b15b42a{\nheight:50px;\n}\n<\/style>\n<div  class='hr av-qmamij-79159e27bd3853956f90368a4b15b42a hr-invisible  avia-builder-el-7  el_after_av_textblock  el_before_av_image '><span class='hr-inner '><span class=\"hr-inner-style\"><\/span><\/span><\/div><br \/>\n\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-h2771v5-428d17b6c90f53710144c332616e3263\">\n.avia-image-container.av-h2771v5-428d17b6c90f53710144c332616e3263 img.avia_image{\nbox-shadow:none;\n}\n.avia-image-container.av-h2771v5-428d17b6c90f53710144c332616e3263 .av-image-caption-overlay-center{\ncolor:#ffffff;\n}\n<\/style>\n<div  class='avia-image-container av-h2771v5-428d17b6c90f53710144c332616e3263 av-styling- avia-align-  avia-builder-el-8  el_after_av_hr  el_before_av_hr '   itemprop=\"image\" itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/ImageObject\" ><div class=\"avia-image-container-inner\"><div class=\"avia-image-overlay-wrap\"><img decoding=\"async\" fetchpriority=\"high\" class='wp-image-67873 avia-img-lazy-loading-not-67873 avia_image ' src=\"https:\/\/www.nettl.com\/uk\/wp-content\/smush-webp\/2026\/10\/php2shell-developer-thinking-about-wordpress-900.jpg.webp\" alt='php2shell response' title='php2shell-developer-thinking-about-wordpress-900'  height=\"672\" width=\"900\"  itemprop=\"thumbnailUrl\" srcset=\"https:\/\/www.nettl.com\/uk\/wp-content\/smush-webp\/2026\/10\/php2shell-developer-thinking-about-wordpress-900.jpg.webp 900w, https:\/\/www.nettl.com\/uk\/wp-content\/smush-webp\/2026\/10\/php2shell-developer-thinking-about-wordpress-900-300x224.jpg.webp 300w, https:\/\/www.nettl.com\/uk\/wp-content\/smush-webp\/2026\/10\/php2shell-developer-thinking-about-wordpress-900-80x60.jpg.webp 80w, https:\/\/www.nettl.com\/uk\/wp-content\/smush-webp\/2026\/10\/php2shell-developer-thinking-about-wordpress-900-768x573.jpg.webp 768w, https:\/\/www.nettl.com\/uk\/wp-content\/smush-webp\/2026\/10\/php2shell-developer-thinking-about-wordpress-900-705x526.jpg.webp 705w\" sizes=\"(max-width: 900px) 100vw, 900px\" data-smush-webp-fallback=\"{&quot;src&quot;:&quot;https:\\\/\\\/www.nettl.com\\\/uk\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/php2shell-developer-thinking-about-wordpress-900.jpg&quot;,&quot;srcset&quot;:&quot;https:\\\/\\\/www.nettl.com\\\/uk\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/php2shell-developer-thinking-about-wordpress-900.jpg 900w, https:\\\/\\\/www.nettl.com\\\/uk\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/php2shell-developer-thinking-about-wordpress-900-300x224.jpg 300w, https:\\\/\\\/www.nettl.com\\\/uk\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/php2shell-developer-thinking-about-wordpress-900-80x60.jpg 80w, https:\\\/\\\/www.nettl.com\\\/uk\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/php2shell-developer-thinking-about-wordpress-900-768x573.jpg 768w, https:\\\/\\\/www.nettl.com\\\/uk\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/php2shell-developer-thinking-about-wordpress-900-705x526.jpg 705w&quot;}\" \/><\/div><\/div><\/div><br \/>\n\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-jp00gvdr-7-147b7810a280ff852f1ddc3e99afdfac\">\n#top .hr.hr-invisible.av-jp00gvdr-7-147b7810a280ff852f1ddc3e99afdfac{\nheight:50px;\n}\n<\/style>\n<div  class='hr av-jp00gvdr-7-147b7810a280ff852f1ddc3e99afdfac hr-invisible  avia-builder-el-9  el_after_av_image  el_before_av_textblock '><span class='hr-inner '><span class=\"hr-inner-style\"><\/span><\/span><\/div><br \/>\n<section  class='av_textblock_section av-1txvxe9-6-f7d4ad8b15571b7347af45f7dbbe01cb '   itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/BlogPosting\" itemprop=\"blogPost\" ><div class='avia_textblock'  itemprop=\"text\" ><h2>What happened<\/h2>\n<p data-lfile-container=\"e49f0062-57e6-480d-af08-3166c7f4ae82\" data-pm-slice=\"1 1 &#091;&#093;\">PHP is the programming language that runs on the server behind your website. Every time someone loads a page on a WordPress site, PHP is doing the work.<\/p>\n<p>The two flaws were found in PHP itself, not in a single plugin or theme. Security experts rated both 9.2 out of 10 for severity.<\/p>\n<p>In plain terms, they could let an attacker take control of the server a website runs on. Early reports suggest the weakness had gone unnoticed for around 10 years.<\/p>\n<p>The details were meant to stay private until the fix was released.<\/p>\n<p>Instead they leaked a day early, which gave attackers a head start.<\/p>\n<p>Before the fix was even out, Cloudflare reported seeing the first attacks. The story made the BBC&#8217;s front page, and some companies took websites offline altogether while they waited.<\/p>\n<\/div><\/section><br \/>\n\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-1co60jf-8aea441432d6d22c75419cb674408476\">\n#top .hr.hr-invisible.av-1co60jf-8aea441432d6d22c75419cb674408476{\nheight:50px;\n}\n<\/style>\n<div  class='hr av-1co60jf-8aea441432d6d22c75419cb674408476 hr-invisible  avia-builder-el-11  el_after_av_textblock  el_before_av_textblock '><span class='hr-inner '><span class=\"hr-inner-style\"><\/span><\/span><\/div><br \/>\n<section  class='av_textblock_section av-mvjntuer-278a82365e141ca637a465843c995148 '   itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/BlogPosting\" itemprop=\"blogPost\" ><div class='avia_textblock'  itemprop=\"text\" ><h2>How we protected your website<\/h2>\n<p data-lfile-container=\"e49f0062-57e6-480d-af08-3166c7f4ae82\" data-pm-slice=\"1 1 &#091;&#093;\">Cloudflare reported the first attacks at 8:45am on 21 October.<\/p>\n<p data-lfile-container=\"e49f0062-57e6-480d-af08-3166c7f4ae82\" data-pm-slice=\"1 1 &#091;&#093;\">By 10:05am, our team had protective blocks in place across every site we host, keeping your website shielded while we waited for the official fix.<\/p>\n<p>PHP released the fix at 3pm UK time on 21 October. Our team worked through the night to roll it out, and by 7am on 22 October every site we host was fully patched, including those on older versions of PHP.<\/p>\n<p>With the patches in place, we lifted the temporary restrictions.<\/p>\n<p>Some hosting companies left their customers to apply these changes themselves.<\/p>\n<p><strong>We did the opposite.<\/strong> The patches were applied for you, and because they&#8217;re backward compatible, your website still runs on the same version of PHP with nothing for you to change.<\/p>\n<\/div><\/section><br \/>\n\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-jp00gvdr-5-8b94cf24fcc37d8b52de611c4c57331e\">\n#top .hr.hr-invisible.av-jp00gvdr-5-8b94cf24fcc37d8b52de611c4c57331e{\nheight:50px;\n}\n<\/style>\n<div  class='hr av-jp00gvdr-5-8b94cf24fcc37d8b52de611c4c57331e hr-invisible  avia-builder-el-13  el_after_av_textblock  el_before_av_codeblock '><span class='hr-inner '><span class=\"hr-inner-style\"><\/span><\/span><\/div><br \/>\n<br \/>\n\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-wybn7f-ea3bcaf6636aabfd6b03e0344dde4d2b\">\n#top .hr.hr-invisible.av-wybn7f-ea3bcaf6636aabfd6b03e0344dde4d2b{\nheight:50px;\n}\n<\/style>\n<div  class='hr av-wybn7f-ea3bcaf6636aabfd6b03e0344dde4d2b hr-invisible  avia-builder-el-15  el_after_av_codeblock  el_before_av_textblock '><span class='hr-inner '><span class=\"hr-inner-style\"><\/span><\/span><\/div><br \/>\n<section  class='av_textblock_section av-1txvxe9-4-f7df570bbc59abb6a0e8ff6fc07551bf '   itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/BlogPosting\" itemprop=\"blogPost\" ><div class='avia_textblock'  itemprop=\"text\" ><h2>Why this matters beyond this week<\/h2>\n<p>Attacks like this are getting faster. AI tools now help attackers find and use a weakness within hours of it going public. The same tools also help us spot and respond to threats sooner.<\/p>\n<p>This flaw appears to have gone undetected for around a decade. No one can fix a weakness before it&#8217;s found, but you can make sure someone is ready to act the moment it is.<\/p>\n<p>This week&#8217;s fix was for PHP. Your website also runs WordPress, a theme and a set of plugins, and each of them gets security updates through the year. A site that misses those updates is the easiest kind to break into.<\/p>\n<\/div><\/section><br \/>\n\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-jp00gvdr-3-8020f9be6fdcef52e32a5b5acd548019\">\n#top .hr.hr-invisible.av-jp00gvdr-3-8020f9be6fdcef52e32a5b5acd548019{\nheight:50px;\n}\n<\/style>\n<div  class='hr av-jp00gvdr-3-8020f9be6fdcef52e32a5b5acd548019 hr-invisible  avia-builder-el-17  el_after_av_textblock  el_before_av_textblock '><span class='hr-inner '><span class=\"hr-inner-style\"><\/span><\/span><\/div><br \/>\n<section  class='av_textblock_section av-mvjnxla9-14a7def7eccb38fd58ccf55abea598bc '   itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/BlogPosting\" itemprop=\"blogPost\" ><div class='avia_textblock'  itemprop=\"text\" ><h2>How a Care Plan keeps you covered<\/h2>\n<p>That&#8217;s the job of our <a href=\"https:\/\/www.nettl.com\/uk\/care-plans\/\" target=\"_blank\" rel=\"noopener\">Care Plans<\/a>. Your site&#8217;s software is kept up to date and monitored for you, including the version of PHP it runs on.<\/p>\n<p>Care Plan sites also get priority support from our technical team when something like this happens.<\/p>\n<p>It means someone is looking after your website&#8217;s security, so you can get on with running your business.<\/p>\n<p>If your site isn&#8217;t on a Care Plan yet, ask <a href=\"https:\/\/www.nettl.com\/uk\/studio-locator\" target=\"_blank\" rel=\"noopener\">your local Nettl studio<\/a> about adding one.<\/p>\n<\/div><\/section><br \/>\n\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-jp00gvdr-2-e0757191eb24c036ba193ee969f20a5e\">\n#top .hr.hr-invisible.av-jp00gvdr-2-e0757191eb24c036ba193ee969f20a5e{\nheight:50px;\n}\n<\/style>\n<div  class='hr av-jp00gvdr-2-e0757191eb24c036ba193ee969f20a5e hr-invisible  avia-builder-el-19  el_after_av_textblock  el_before_av_button '><span class='hr-inner '><span class=\"hr-inner-style\"><\/span><\/span><\/div><br \/>\n<div  class='avia-button-wrap av-jinlazj9-f47f8387f79c7df52db169272c375004-wrap avia-button-center  avia-builder-el-20  el_after_av_hr  avia-builder-el-last '><a href='https:\/\/www.nettl.com\/uk\/studio-locator'  class='avia-button av-jinlazj9-f47f8387f79c7df52db169272c375004 av-link-btn avia-icon_select-yes-left-icon avia-size-large avia-position-center avia-color-theme-color'  ><span class='avia_button_icon avia_button_icon_left' aria-hidden='true' data-av_icon='\ue803' data-av_iconfont='entypo-fontello'><\/span><span class='avia_iconbox_title' >Find your nearest Nettl<\/span><\/a><\/div><\/p><\/div>\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-jp00a0tr-ca081bd21a4ac0057905c2c9922a0c55\">\n.flex_column.av-jp00a0tr-ca081bd21a4ac0057905c2c9922a0c55{\nborder-radius:0px 0px 0px 0px;\npadding:0px 0px 0px 0px;\n}\n<\/style>\n<div  class='flex_column av-jp00a0tr-ca081bd21a4ac0057905c2c9922a0c55 av_one_fifth  avia-builder-el-21  el_after_av_three_fifth  avia-builder-el-last  flex_column_div av-hide-on-mobile av-zero-column-padding  '     ><\/div><\/div><\/div><\/main><!-- close content main element --><\/div><\/div><div id='after_section_1'  class='main_color av_default_container_wrap container_wrap sidebar_right'  ><div class='container av-section-cont-open' ><div class='template-page content  av-content-small alpha units'><div class='post-entry post-entry-type-page post-entry-67867'><div class='entry-content-wrapper clearfix'>\n","protected":false},"excerpt":{"rendered":"<p>Two critical PHP flaws leaked online on 20 October, and attacks followed within hours. Here\u2019s what happened, how we protected every site we host overnight, and how a Care Plan keeps yours covered.<\/p>\n","protected":false},"author":234,"featured_media":67875,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"iawp_total_views":2,"footnotes":""},"categories":[16],"tags":[],"class_list":["post-67867","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.nettl.com\/uk\/wp-json\/wp\/v2\/posts\/67867","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.nettl.com\/uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.nettl.com\/uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.nettl.com\/uk\/wp-json\/wp\/v2\/users\/234"}],"replies":[{"embeddable":true,"href":"https:\/\/www.nettl.com\/uk\/wp-json\/wp\/v2\/comments?post=67867"}],"version-history":[{"count":6,"href":"https:\/\/www.nettl.com\/uk\/wp-json\/wp\/v2\/posts\/67867\/revisions"}],"predecessor-version":[{"id":67869,"href":"https:\/\/www.nettl.com\/uk\/wp-json\/wp\/v2\/posts\/67867\/revisions\/67869"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.nettl.com\/uk\/wp-json\/wp\/v2\/media\/67875"}],"wp:attachment":[{"href":"https:\/\/www.nettl.com\/uk\/wp-json\/wp\/v2\/media?parent=67867"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.nettl.com\/uk\/wp-json\/wp\/v2\/categories?post=67867"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.nettl.com\/uk\/wp-json\/wp\/v2\/tags?post=67867"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}