Agency Advisory | 22 Oct 2026 (NZT)

Advisory at a glance

If your agency built or still looks after PHP websites, some of your clients are likely to be exposed right now and may not know it.

• What: Two critical flaws in PHP itself, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), both rated 9.2 out of 10.

• Who: Any site running PHP 5.4 through 8.5.11. That covers most WordPress, Drupal and Joomla builds, plus custom PHP sites.

• The catch: Fixes exist only for PHP 8.2 and above. Sites on PHP 8.1, 8.0, 7.x or 5.x get no official patch.

• What to do: Find every PHP site you've touched, check its version, patch or upgrade this week, and plan a long-term move off legacy stacks.

• Blutui agency users: Our team has checked and confirmed that no Blutui agency site is affected. No action is needed on your side.

What has been disclosed

On 21 October 2026, PHP shipped emergency fixes for two flaws in its core engine. Details had leaked online the day before, so attackers had a head start.

The flaws sit in PHP itself, not in WordPress or a plugin. Wiz Research, who found them, showed that even a simple "Hello World" page on an affected version can be vulnerable. They demonstrated full takeover of WordPress, Drupal and Joomla sites with no login needed.

Two outcomes matter for your clients:

• Server takeover. An attacker can run their own code on the server, then steal data, plant malware or deface the site.

• Memory leaks. An attacker can read live server memory, which can hold passwords, login tokens, API keys and certificates.

There is a new twist. Wiz used frontier AI models to find these flaws and build working exploits in days. The bugs had sat in PHP for over a decade. AI has made old, complex weaknesses cheap to exploit, and that changes the risk for every legacy site on the web.

Why agencies may not know they're exposed

Most agencies don't keep a live register of every site they've ever shipped. That's where the risk hides.

• Handed-over builds. Sites delivered years ago, now hosted by the client or a third party nobody checks in with.

• Retainer gaps. Sites still on your books, but on hosting nobody has updated since launch.

• Old PHP versions. In April 2026, roughly 55% of the top million PHP sites ran an end-of-life version. Those sites get no fix for PHP2Shell.

• Plugin lock-in. Older themes and plugins break on newer PHP, so upgrades get parked. Now the parked upgrade is the open door.

• Campaign microsites. Short-lived sites that outlived the campaign and still sit live on a forgotten server.

If one of these sites is breached, the client calls the agency whose name sits in the footer. Your reputation is on every site you've built, whoever hosts it today.

Quick self-check: are your clients exposed?

Answer yes to any of these and you have work to do.

• Have we built or maintained a WordPress, Drupal, Joomla, Magento or custom PHP site in the last ten years?

• Do we know which PHP version each of those sites runs today?

• Are any of them on PHP 8.1 or older?

• Are any hosted somewhere we don't control or can't log into?

• Are any campaign or event microsites still live after the campaign ended?

• Has any client site shown odd behaviour since 20 October: repeated 500 errors, unexplained slowdowns, strange session cookies?

What to do this week

1. List every PHP site your agency has built or still touches, live or handed over.

2. Check the PHP version on each one, with the client's host if you don't hold the keys.

3. Patch what you can. Sites on 8.2 or above move to the fixed release now: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP-FPM needs patching too.

4. Shield what you can't patch yet. Ask the host about firewall rules. Cloudflare, Fastly, Akamai and the major clouds have released protections for sites that can't update straight away.

5. Rotate secrets on any site that may have been exposed: passwords, API keys and tokens. Memory leaks mean these could already be out.

6. Tell your clients. A short, calm note beats a breach they hear about first from someone else.

7. Plan the exit for legacy sites. Sites stuck on 8.1 or older won't get a fix. Upgrading them often means rebuilding plugins and themes anyway, so treat it as a migration decision, not a patch.

Where Blutui agency users stand

Blutui agency users are not affected by PHP2Shell, and there is nothing for you to patch.

As soon as the advisory landed, our team reviewed the full Blutui Agency Web Ecosystem and confirmed no client site is exposed. That's the point of managed infrastructure built for agencies:

• One ecosystem, looked after centrally. Hosting, security and updates are handled by Blutui. No agency is left chasing server versions across dozens of hosts.

• No plugin sprawl. Sites aren't held together by third-party plugins that block upgrades.

• createControl. Your front-end team keeps full control of code, frameworks and the experience. Blutui carries the infrastructure risk.

The long-term fix: move legacy sites to Blutui

Patching closes this hole. It won't close the next one. AI has made old code cheap to attack, and legacy PHP sites will keep turning up in the next advisory, and the one after.

Moving client sites onto the Blutui Agency Web Ecosystem takes the problem off your desk for good:

• Infrastructure risk becomes our job. Hosting, updates and security are managed centrally across every site.

• The client stays yours. Blutui is white-label. Your agency remains the trusted partner; we power delivery behind the scenes.

• Migration is quicker than you'd think. Agentic tooling and Canopy 2.0 Blocks speed up rebuilds, and clients can edit content without uncontrolled technical access.

• A better conversation with clients. Instead of a breach apology, you lead with a proactive upgrade.

Not sure how many legacy sites you're carrying? Talk to us. We'll help you map your exposure and plan a simple migration path. Book a time here.

Sources

• Wiz Research: PHP2Shell

• Google Cloud: responding to the PHP vulnerabilities

• Huntress: rapid response

• HeroDevs: PHP end-of-life dates

• 365i: PHP 8.1 end of life