A hálózat csapdájában

A kiberbiztonságról, mikro- és kisvállalkozásoknak

When the invisible engine stops: What does the 2026 PHP2Shell vulnerability teach us?

Imagine that the central locking system fitted to your car breaks down overnight. Anyone walking past your car in the car park could open the door at the touch of a button, get behind the wheel and drive off with it. This is exactly what happened to the vast majority of websites on the internet in October 2026, when security researchers discovered a vulnerability dubbed PHP2Shell.

Many business leaders think of their own website as a printed leaflet which, once displayed in the shop window, never needs touching again. A modern website, however, is much more like a lorry. It needs oil changes, MOTs and the replacement of worn-out parts. If we neglect this, the vehicle will sooner or later break down and leave us stranded by the side of the road.

What is PHP, and why does it affect your business too?

When a customer visits your company’s website, an invisible engine is working in the background. This engine is called PHP. According to W3Techs’ October 2026 figures, approximately 70 per cent of all websites worldwide use this technology. If your company’s website or online shop is built on the popular WordPress platform, then this PHP engine is almost certainly running in the background.

On 21st October, 2026, developers disclosed two serious vulnerabilities in this engine (listed in the official register as CVE-2026-109618 and CVE-2026-109619). These two vulnerabilities have been named PHP2Shell.

Why is this security vulnerability such a major problem?

Experts rate the severity of security vulnerabilities on a scale of 1 to 10. PHP2Shell received a rating of 9.2, which falls into the ‘critical’ category.

The danger lies in the fact that attackers do not need a password to gain access. The flaw lies in the system’s memory management. When a criminal sends a specially crafted request to the website, the server’s memory becomes corrupted. Through this vulnerability, the attacker can execute their own commands on the server or read sensitive data stored in memory, such as customers’ passwords and the keys used for credit card payments.

The most alarming detail for small business owners is that the website’s own security measures are of no help here. Even if you have paid for the most up-to-date security plugins on your WordPress site, the PHP2Shell vulnerability executes on the server before the website’s own security system even has a chance to activate.

How much damage has it caused so far? What do the surveys show?

A note on the figures: As the vulnerability was only recently disclosed, on 21 October 2026, no aggregate reports on global financial losses are yet available. In such a short space of time, no research institute is able to accurately assess the losses in terms of forints or dollars. However, we already have precise data on the scale of the threat and the attempted attacks.

On 22 October 2026, the international cyber security firm Qualys published a comprehensive survey in which 167 million PHP installations were examined worldwide:

  • 99 per cent of the systems examined were vulnerable at the time of the report.
  • 71 per cent of the systems are running on an outdated version for which the manufacturer no longer issues automatic updates. These websites were effectively left defenceless.

The attacks began immediately. According to data from Cloudflare, cybercriminals had already started scanning unprotected servers hours before the official patch was released. Hungary’s National Cyber Security Institute (NKI) issued a warning as early as 22 October regarding active attack attempts, whilst the US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its list of confirmed exploited vulnerabilities on 26 October. In Europe, several government and business websites had to be temporarily taken offline whilst defences were being put in place.

There is, however, some good news. The Sansec analysis firm has shown that, for a successful attack, cybercriminals must know the exact configuration of the specific server in question. For this reason, blind, mass infections are less likely to succeed than in the case of similar major vulnerabilities in previous years. This is the only reason why the majority of websites have not yet crashed: system administrators have been given a little breathing space to apply the patch.

The most important lesson: Updating is the cheapest form of insurance

The story of PHP2Shell highlights a fundamental business risk. The vulnerability affects all PHP engines from version 5.4 onwards. Those businesses that have regularly updated their systems in recent years (and are therefore using version 8.2 or later) can now patch the vulnerability with a single quick update.

However, those companies that haven’t touched their website’s engine for five or six years are now in a bind. No simple patch has been released for their outdated systems. They now have to rush to rebuild the foundations of their websites – paying for expensive developer hours – or take their sites offline until the new version is ready.

What can you do today if you’re not tech-savvy?

  1. Call your web developer or hosting provider! Ask them: “Which version of PHP is my website running on, and has it already received the security update dated 21 October 2026?” (The secure version numbers are: 8.2.35, 8.3.36, 8.4.27 or 8.5.12).
  2. Follow the principle of regular maintenance! Sign a monthly or quarterly maintenance contract with a reliable specialist. A monthly monitoring fee of a few thousand forints is a fraction of the damage that a hacked online shop, stolen customer data and regulatory fines could cause.

In the digital world, inaction poses the greatest threat. Don’t wait until your company’s website breaks down in the middle of the motorway: ensure you carry out regular software updates today!

Sources used:

Vélemény, hozzászólás?