Frequently asked questions

PHP2Shell is the name for two critical vulnerabilities in PHP itself (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2). They may allow attackers to execute malicious code on the server without logging in. Patches have been available since 21 October 2026.

The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Hosts and distributions sometimes apply backports without changing the version number. What matters is the package version or the provider's written confirmation.

No. The vulnerability is in PHP, not in the CMS. A CMS update does not close it. And a PHP patch does not remove malicious code that was planted beforehand.

We work remotely and start as soon as access is in place. Write to us via WhatsApp with your system, PHP version and observation. We will then clarify the approach directly.

Yes. We work directly for businesses, in the background on behalf of agencies, and in coordination with your host if the host manages the server.

If personal data may be affected, Art. 33 GDPR generally sets a reporting deadline of 72 hours from awareness. Whether it applies, you clarify with your data protection officer. We provide the technical documentation for it.

No. The vulnerabilities are in PHP, the programming language that WordPress, Shopware, TYPO3 and many other systems run on. A CMS update therefore does not close them. What matters is the PHP version on the server.

With shared hosting, the provider usually installs the PHP update. You should still get written confirmation that the PHP version you use has been patched and restarted. The update does not answer whether something happened before the patch.

The name describes the consequence: through PHP, an attacker can in the worst case gain a command line, that is a shell, on the server. The official designations are the CVE numbers CVE-2026-109618 and CVE-2026-109619.

Not necessarily. Some providers took websites off the network as a precaution, as the BSI (German Federal Office for Information Security) recommends when an update is not immediately possible. That is a protective measure and not evidence of an attack.

It can be, if the provider confirms the package version in writing and all PHP processes have been restarted. The displayed version number alone is no proof, because distributions apply backports. And a patch does not answer whether the server was attacked beforehand.

Not necessarily. The BSI (German Federal Office for Information Security) recommends taking web servers off the network temporarily if the update cannot be applied immediately. Whether that is necessary in your case, we decide together after the inventory.

No. PHP2Shell is in PHP itself, not in the CMS. A CMS update remains sensible, but it does not close this vulnerability.

The PHP project no longer provides official updates for these versions, only minimal source backports for 7.4, 8.0 and 8.1. We secure the server on an interim basis and plan the move to a supported version with you.

Under Art. 33 GDPR, from the moment the controller became aware of the breach. When that can be assumed in an individual case is a legal assessment. So document precisely who had which information and when.

No. A vulnerability alone is not yet a personal data breach. A report can become mandatory if there are indications that unauthorized persons had or could have had access to such data, and a risk to data subjects results from it.

Art. 33(4) GDPR allows information to be provided in phases if it cannot be provided at the same time. A late notification must be justified. Waiting for complete clarity is therefore generally no reason to let the deadline pass.

The controller is obliged to report, so generally the company that operates the website. A processor such as the host must inform the controller without undue delay under Art. 33(2) GDPR.

To the competent data protection supervisory authority, which for companies is usually the authority of the German federal state where they have their seat. Most authorities offer online forms for this.