For immediate release
In-Touch IT Urges Businesses to Check Websites, Vendors, and Devices After Critical “PHP2Shell” Flaws
Amazon, Microsoft, and Google have issued guidance; In-Touch IT outlines who to call for systems it doesn’t manage
ATLANTA, Ga., October 22, 2026 — In-Touch IT is advising its business clients to act quickly on PHP2Shell, two critical security flaws in PHP, the programming language behind a large share of business websites, online stores, client portals, and web-based software. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, can let an attacker take control of an affected web server without a password. The PHP project released emergency fixes on October 21, and attacks are already underway.
Amazon Web Services, Microsoft, and Google Cloud have each published guidance urging customers to update. Amazon’s threat intelligence team reported seeing an exploitation attempt on October 17, four days before the fix was public, and says the flaws are now being broadly exploited.
“Most of our clients don’t run PHP themselves, but almost all of them depend on something that does: their website, their online store, a client portal, or a cloud app they log into every day,” said Wynn Jones, CEO of In-Touch IT. “We’re taking care of the systems we manage. For everything else, the most important step is a quick phone call or email to the company that runs it.”
What In-Touch IT is doing
In-Touch IT is scanning the servers, networks, and websites we manage or monitor for our clients to find any system that may be running a vulnerable version of PHP. That includes less obvious places PHP can be found, such as network storage, phone systems, cameras, and other devices with a web-based admin page.
Our team is contacting each client’s main point of contact directly to go over what we found, flag any systems that need attention, and help work out next steps. For systems run by an outside vendor or hosting company, we’ll help clients find the right contact and know what to ask.
What clients should do for systems In-Touch IT doesn’t host or manage
PHP2Shell affects the server running the website or app, not your office computers. Updating your PCs won’t fix it, and you can’t see the problem from your browser. Only the company running the server can apply the fix. That includes WordPress sites: the WordPress Security Team has said no WordPress update is needed or planned, so the fix has to come from your hosting company.
If your website is on GoDaddy’s standard Web Hosting or Windows Hosting, confirm the patch status directly with GoDaddy. As of October 22, GoDaddy reported its Managed WordPress hosting fully patched, while those shared hosting plans were still relying on temporary protections.
List what you rely on.
Write down your website, online store, client or patient portal, online booking or payment pages, and any web-based software your team logs into.
Contact whoever runs each one.
Use the table below to find the right contact.
Ask three questions:
- Do any of your systems that handle our data or website run PHP?
- Have you updated to a fixed version (8.5.12, 8.4.27, 8.3.36, or 8.2.35) or applied your vendor’s patch?
- If you’re on PHP 8.1 or older, what is your plan, and when will it be done?
Get the answer in writing.
Keep it with your security records. For firms that keep a Written Information Security Plan (WISP), this is a vendor-oversight record worth filing.
Tell us right away.
Contact us if a vendor can’t answer, says they’re still working on it, or you notice anything unusual on your site.
Who to contact
| What you use | Who to contact | What to ask for |
|---|---|---|
| Your company website (WordPress, Drupal, or similar) | Your web developer or website hosting company | Confirmation the server’s PHP is updated |
| Online store (WooCommerce, Magento, or similar) | Your store developer or hosting company | Confirmation the store’s server is updated |
| Cloud software and portals your team logs into | The software company’s support team or security/status page | Their PHP2Shell statement |
| Apps a vendor runs for you on Amazon, Microsoft Azure, or Google Cloud | The vendor that built or manages the app | Confirmation they followed their cloud provider’s guidance |
| Devices with a web-based admin page (network storage, phone systems, cameras, door access) | The device manufacturer or the company that installed it | Whether the device uses PHP and when a firmware update is available |
Warning signs to report
Contact your vendor and In-Touch IT if you notice your website showing unfamiliar pages or links, customers reporting pop-ups or redirects, unexpected new admin accounts, or emails from your hosting company about unusual activity.
About PHP2Shell
The flaws are in PHP itself rather than in any one plugin or product, and affect PHP versions going back to 5.4. The PHP project no longer supports version 8.1 and older, and there is no official patched release for those versions. That gap is large: as of October 22, more than a third of WordPress sites still ran PHP 8.1 or older. If your website or a vendor’s system is on one of these versions, ask for a firm date to upgrade to a supported version. If that can’t happen quickly, ask whether the site or system can be taken offline until it’s upgraded, as Europe’s CERT-EU advises.
About In-Touch IT
In-Touch Computer Services, Inc. (In-Touch IT) has provided managed IT, cybersecurity, and compliance support to businesses since 1992, with offices in Atlanta, Rome, and Dalton, Georgia, and Gainesville, Florida.
Media and client contact
Ready to Address Potential PHP2Shell Security Risks? Let's Talk
In-Touch IT helps businesses identify cybersecurity risks, strengthen their security posture, and coordinate protection across managed IT environments. If you are concerned about potential PHP2Shell exposure, our team can help you understand which systems we manage and where additional vendor or hosting-provider assessments may be needed.
Call us at (877) 346-8682 or contact our cybersecurity team online to discuss your concerns and next steps.
