PHP2Shell: what UK businesses should check in their Spanish web operations

What is PHP2Shell?

CVE-2026-109618 and CVE-2026-109619 affect PHP memory handling and request state. Both have a critical CVSS score of 9.2. PHP confirms unauthenticated remote code execution and memory disclosure under vulnerable conditions.

Demonstrated cases involve Apache mod_php and PHP-FPM, with different requirements. Do not assume that every deployment is equally exploitable or that a single request is always sufficient.

INCIBE reports attacks before patch publication. CISA stated that it had not observed exploitation when its 21 October alert was published. Those observations do not establish whether successful intrusions have occurred.

Which Spanish web systems should your team check?

PHP commonly runs WordPress, WooCommerce, PrestaShop, Joomla and Drupal. It can also power internal applications. Updating their plugins does not update the server runtime.

• Company websites, shops, booking systems and PHP-based intranets.
• CRM, browser-based ERP and guest Wi-Fi portals where PHP is actually used.
• Appliance administration panels only when the manufacturer confirms affected PHP components.
• Windows is not an exemption: a Windows server running vulnerable PHP needs checking. Systems that do not run or expose vulnerable PHP are not directly affected by these flaws.

What has iDeo done on its hosting servers?

The operational position supplied by iDeo on 22 October is that interim settings have been applied across its hosting servers, covering PHP versions from 5.6. These steps are not a full fix.

• session.upload_progress.enabled = 0 disables a demonstrated session attack path.
• session.use_strict_mode = 1 is additional session hardening, not an established complete PHP2Shell mitigation.
• iDeo is progressively applying PHP 7.4-and-later updates distributed through Plesk and cPanel.
• For PHP 7.3 and older websites, we will arrange migration planning with the customer.

What should you ask the hosting company to confirm?

Ask for the exact PHP version, the vendor package containing the complete fix and confirmation that PHP workers have restarted. Request this in writing so your UK team can record the outcome.

For systems we maintain, our user support centre reviews PHP installations, prioritises Internet-facing services, checks logs and obtains confirmation from external hosting providers. We document patched systems and outstanding work. Restarts and any interruption are coordinated; there is no universal one-minute duration.

Which PHP versions contain the fixes?

Use the patched branch version or a vendor package with a documented complete backport. An exceptional backport does not restore regular support for an old branch.

PHP 8.1 and earlier have no regular upstream support. Exceptional source patches exist for 7.4, 8.0 and 8.1: check your vendor package and plan a supported upgrade. PHP 8.2 security support ends on 31 December 2026.

What if patching has to wait?

PHP states that no interim configuration change is complete. Disabling upload progress blocks one demonstrated path; request limits and a WAF may reduce particular exposures, but cannot replace the patch.

Apply settings administratively on the server and restart workers. An instruction inside WordPress is not sufficient. Agree temporary exposure restrictions with the technical owner.

What if you find unexpected changes?

Contact your technical team and preserve files and logs. If personal data is involved, assess the breach with your privacy lead. For the Spanish operation, a notifiable GDPR breach generally requires reporting to the competent authority within 72 hours of awareness, unless it is unlikely to risk individuals’ rights and freedoms. Do not assume every incident has the same notification duty.