Security Alert: Important PHP website vulnerability (PHP2Shell) you should know about
On October 21, 2026, the PHP development team disclosed two critical vulnerabilities that let attackers run unauthorized code on affected web servers. Patches are available now. Details: https://www.php.net/index.php#2026-10-21-5
Website owners: take action now. Update your PHP environment to the latest secure release: 8.2.35, 8.3.36, 8.4.27, or 8.5.12 (or later). If you're running older PHP versions such as 7.4, 8.0, or 8.1, upgrade to a supported PHP release or apply any security fixes provided by your operating system vendor or hosting provider. Delaying updates could leave your website vulnerable to attacks, service disruptions, and data theft.
Not sure if you're affected? Use the PHP2Shell Risk Assessment Tool to quickly identify potential exposure, understand your security risk, and get guidance on the next steps to help protect your website.
Users: what you should do. While this vulnerability affects websites, and website owners must act immediately, consumers should also be prepared:
- 1. Change your password if an organization whose website you use tells you it was impacted by this issue.
- 2. Be vigilant against scammers. Cybercriminals may take advantage of this situation. If you receive a text or email claiming a security issue and directing you to a link, don’t click it right away. Go directly to the company’s site or contact the company another way to verify.
- 3. Check your digital health. Make sure your apps and security software are up to date on all devices.
- 4. Use technology to protect yourself. Trend Micro ScamCheck can help you verify suspicious messages. Trend Micro Mobile Security (mobile) or Trend Micro Maximum Security (laptops and desktops) can help keep you safe.
For more details on affected PHP versions, potential risks, and recommended protection measures, visit TrendLife Support article.