Critical PHP Security Alert: What Your Business Needs to Know

Critical PHP Security Alert: What Your Business Needs to Know

Two critical vulnerabilities in PHP, known as PHP2Shell, were disclosed on October 21, 2026. PHP supports many business websites and applications, including WordPress, Drupal, and Joomla. These vulnerabilities could allow attackers to compromise affected servers or access sensitive information without logging in. Security updates are available.

If your business operates a website, customer portal, or web application, confirm with your hosting provider that the appropriate updates have been applied.

What Celito has Done

Celito has already taken action across all the environments we manage:

  • Identifying exposure: Inventorying managed environments to identify PHP installations and their versions.
  • Applying updates: Installing emergency patches as they become available from vendors.
  • Adding interim protections: Deploying web application firewall rules for systems that cannot be patched immediately.
  • Monitoring for threats: Watching for signs of active exploitation across our client base.

These efforts cover systems under Celito’s management. Websites and applications hosted by other providers require confirmation directly from those providers.

What Your Business Should Do

  • Does our website use an affected version of PHP?
  • Have patches for CVE-2026-109618 and CVE-2026-109619 been applied?
  • If patching is pending, what temporary protections are in place?

Updating website themes or plugins alone does not resolve these vulnerabilities. The underlying PHP software must be patched by your hosting provider or server administrator.

If you manage your own web servers or have applications outside Celito’s management, reach out so we can help you understand your exposure and coordinate next steps.

Have Questions? Contact Celito.

We will continue monitoring this situation and sharing updates as new guidance becomes available.

Contact your Celito representative or email support@celito.net for guidance.