PHP2Shell: what the NSA’s PHP warning means for your practice website
The NSA has urged everyone running PHP to patch two critical flaws immediately. Most dental and cosmetic clinic websites run on PHP. Here’s what to check, and what to do this week.
On 21 October, the PHP project released emergency updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, now nicknamed PHP2Shell. The same day, the NSA, alongside CISA, issued an advisory urging every organisation that runs PHP to patch immediately — and, where that isn’t possible, to take affected systems offline until they can be.
That’s an unusually blunt instruction. If your practice has a website, it almost certainly applies to you.
Why this one matters for clinics
PHP is the language that powers WordPress, Drupal and Joomla — and, by extension, the majority of dental, orthodontic and cosmetic surgery websites. Your booking widget, enquiry forms, before-and-after galleries and patient intake forms are very likely running on it.
What makes PHP2Shell different from the usual “update your plugins” warning is where the bug lives. The flaws are in PHP itself, not in a theme, plugin or your site’s configuration. An attacker doesn’t need a login or a vulnerable plugin: a single crafted web request can be enough to run their own code on your server.
For a clinic, a compromised web server can mean:
- Enquiry and intake form submissions — names, phone numbers, treatment interest — being read or copied.
- Stored credentials being used to reach your email, booking system or practice management software.
- Your site quietly serving malware or spam to patients, and Google flagging it as unsafe.
- A privacy breach you may be legally required to report.
Is anyone actually exploiting it?
Reports differ. As of 22 October, CISA said it had not observed exploitation, but the NSA warned that attackers are likely to weaponise the flaws, and security firms monitoring honeypot networks have reported exploit attempts since the details went public. Working proof-of-concept code reportedly appeared within hours. The safe assumption is that automated scanning for unpatched sites is already under way.
What to do this week
- Find out which PHP version your site runs. In WordPress, go to Tools → Site Health → Info → Server. Otherwise, ask your host or web developer — it should be a one-line answer.
- Check it against the fixed releases. You’re patched if you’re on PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or newer within the same branch.
- If you’re on PHP 8.1 or older, act now. These versions no longer receive official updates. Some hosts and Linux distributions have shipped emergency backports, but the real fix is upgrading to a supported version.
- If it can’t be patched today, take it offline. That’s the NSA’s advice, not ours. A simple holding page with your phone number costs you far less than a breach.
- Check for signs of compromise after patching. Patching closes the door but doesn’t evict anyone already inside. Look for unfamiliar admin users, unexpected files or scheduled tasks, and change your hosting and admin passwords.
A web application firewall can block some attack attempts while you arrange an update, but the PHP team is clear that only an update fully resolves the flaws. Updating WordPress plugins alone won’t fix this — it has to happen at the server level.
If you’re an Uptime Medical client
Sites on our managed hosting and care plans are being checked and updated as part of your plan — there’s nothing you need to do. We’ll confirm your site’s PHP version and the result of our compromise checks by email.
If you’re not a client and aren’t sure where your site stands, get in touch. We’ll check your PHP version and tell you what needs doing, free of charge.