PHP2Shell: what you can do as an internet user

A familiar website can become a risk if its server has a security flaw. That is what PHP2Shell is about.

PHP2Shell is the name given to two critical flaws in PHP. PHP runs on the servers behind many websites, handling tasks such as sign-ins and forms. Under certain conditions, attackers can exploit the flaws to take over servers or read data. The PHP team released security updates on 21 October. Website operators and hosting providers now need to install them. PHP security advisory

The flaw is on the server.

1. Affected websiteUnpatched PHP processes a malicious request.
2. Under certain conditionsAn attacker can run commands on the server.
3. Possible consequencesChanging content or reading data processed there.

As a visitor, you should know that even a normally trustworthy service can be affected. On a compromised server, attackers could change content or steal data processed there. The general warning alone does not tell us whether this has happened at any particular service.

What does this have to do with AI?

Researchers at Calif and Wiz found the flaws independently with AI assistance. The models helped examine PHP’s source code and look for vulnerabilities. People checked the findings; the PHP team developed the security updates. OpenAI helped coordinate the disclosure. OpenAI on the coordinated security work

Here, AI was a tool for security research. The vulnerability itself is in PHP on the website’s server, not in your AI chat. An affected service can therefore pose a risk even if you never use AI yourself. The operator’s security update remains essential.

Five things you can do

1. Keep your devices and browser up to date. Install security updates through their built-in settings. This protects against other known flaws; the website operator has to install the PHP update.

2. Ask about your own website. Ask your hosting provider to confirm that the PHP2Shell security fix is active. A general statement about a firewall is no substitute for the update.

3. Protect your important accounts. Use passkeys where they are available. Otherwise, use unique passwords stored in a password manager and turn on two-factor authentication, especially for your email account. These measures protect sign-ins; they do not close a server vulnerability.

4. Check warning emails independently. Open the provider’s known web address yourself. Do not enter your login details through an unsolicited “PHP security update” link. Scammers can also use the news to send fake warnings. NCSC: spotting scams

5. Back up important data. Keep an extra copy of your photos and documents, and check that you can restore a file. A backup helps you recover from data loss.

The general advice on updates, account security and backups follows the NCSC’s basic security tips. The UK’s National Cyber Security Centre also explicitly recommends passkeys.

Which protection helps where?

• PHP updateHost / operator
  Closes the PHP2Shell vulnerabilities on the server.
• Passkeys / 2FAYou
  Protect sign-ins. No substitute for the PHP update.
• BackupsYou
  Help you recover from data loss. Do not prevent a server attack.

What we checked at Hexpex

Our magazine pages consist of ready-made HTML files. After checking the files and active server rules, we found that they do not use PHP. Our hosting provider, STRATO, now confirms that it has installed the official security update on all hosting platforms it operates itself. That patch confirmation comes from the provider; we have not separately measured the exact PHP version running on the server. STRATO notice on its customer login page

Sources

1. PHP · Security advisory, 21 October 2026

   Primary source on the two flaws and security updates; checked 22 October 2026.

2. OpenAI · Coordinated disclosure of critical vulnerabilities

   Primary source on the independent discoveries by Calif and Wiz with AI assistance; checked 22 October 2026.

3. NCSC · Top tips for staying secure online

   Basic advice on updates, account security and backups; checked 22 October 2026.

4. NCSC · Passkeys

   Recommendation to use passkeys; checked 22 October 2026.

5. STRATO · Public notice on the customer login page

   Read in Safari on 22 October 2026: the official update has been installed on all platforms operated by STRATO itself. Provider confirmation, not our own measurement of the PHP patch version. The login-page notice may change.

6. NCSC · Phishing: How to spot and report scam emails, texts and calls

   General advice on recognising suspicious messages and checking them independently; checked 22 October 2026.