On 21 October 2026, less than 45 minutes after the official patches were released, 98% of our websites had received the necessary PHP2Shell fixes.
We shared this update in our newsletter of 22 October. Here, we explain what was at stake, how we responded and why everyday maintenance makes a difference when a critical security alert arises.
PHP2Shell: a vulnerability in the underlying web environment
PHP powers many websites and web applications, including WordPress. PHP2Shell refers to two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, which can allow remote code execution without authentication on an affected environment.
The issue lies in PHP itself. A website can therefore remain exposed even when WordPress and its plugins are up to date, if the PHP runtime used by its hosting has not been patched. The response must also address the server environment.
Our priority: applying the PHP patches
As soon as the official patches became available on 21 October, we took action to apply them on our servers. The result shared in our newsletter was clear: 98% of our websites had received the necessary fixes in under 45 minutes.
This figure describes the deployment status at that specific point in time. It concerns the PHP2Shell patches and is not a promise of absolute protection against every threat. We also added extra layers of security, as outlined in our communication to clients.
A rapid response starts with everyday maintenance
Acting quickly depends on a maintained environment: servers running supported, up-to-date versions, management tools that enable efficient patch deployment, and regular maintenance of websites, WordPress and their plugins.
This preparation helps shorten the time between a patch becoming available and being applied. It also helps anticipate compatibility constraints. When an older website relies on components that are no longer maintained, changes to its environment can require more adjustments.
Several layers of protection, supported over time
Website security depends on the whole technical stack: hosting, the PHP runtime, the CMS, themes, plugins and custom code. Additional protection or a web application firewall can help, but does not replace patching a vulnerability in PHP.
PHP2Shell also underlines the value of planning the modernisation of older websites. Responding to an urgent issue and maintaining a website over time are both part of ongoing support: reducing immediate exposure and keeping an environment that can continue to evolve.
Keeping you informed is part of our work
Our newsletter had a simple purpose: to explain the action taken and make the technical work behind your website visible. That vigilance is part of our everyday support.
Have a question about website maintenance, or noticed unusual behaviour? Contact our team at webteam@wikafi.be. We will take the time to explain the situation and the next steps suited to your environment.