Cyber insurance

PHP2Shell: what it means for your cyber insurance and what to do

Reviewed by the Apex broking team · Last reviewed 2026-10-22

PHP2Shell is a pair of critical PHP flaws fixed on 21 October 2026; update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then check your cyber policy's patching and notification conditions. It matters for insurance because cover for an attack through a known, unpatched vulnerability can depend on your policy's security conditions and on notifying your insurer in time.

Part of: Cyber insurance UK guide

What happened with PHP2Shell?

Last updated 22 October 2026.

PHP2Shell is the name security researchers have given to two critical flaws in PHP, the programming language that runs a large share of the web, including WordPress, Drupal, Joomla and Magento sites. Our PHP2Shell wiki entry has the short definition. The timeline so far:

• 20 October 2026: the PHP project pre-announced an emergency security release for two critical vulnerabilities after details leaked.
• 21 October 2026: PHP released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (php.net security advisory). The same day, the UK's National Cyber Security Centre published an alert telling UK organisations to prepare to update immediately.
• 21 to 22 October 2026: several security firms reported exploitation attempts, and firewall rules were being deployed by network providers (Help Net Security, 21 October 2026, updated 22 October). It was not in the US CISA Known Exploited Vulnerabilities catalogue as of 21 October 2026, and no confirmed public breach had been attributed to it at the time of writing.

The two flaws are CVE-2026-109618 (remote code execution via out-of-memory corruption) and CVE-2026-109619 (remote code execution via stale global state). Both are rated CVSS v4.0 9.2, which is critical. In plain English: an attacker who has never logged in may be able to send requests to your website that let them run their own code on the server. That can lead to stolen data, defaced or redirected sites, ransomware or the server being used to attack others.

Am I affected by PHP2Shell?

If your website, web app, customer portal or online shop runs on PHP and serves web requests, assume you are affected until someone confirms the server is on a fixed version. php.net says all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest for mod_php, where an unauthenticated request can trigger the attack before any application code runs.

A version number alone can mislead. A Linux distribution package can carry the fix under an older-looking version, so ask whoever runs the server to confirm the fix is applied rather than relying on the number you see. Our guide on how to check your website PHP version walks through where to look.

Why WordPress and other CMS sites depend on the server

WordPress, Drupal, Joomla, Magento and other PHP applications run on top of the server's PHP. Updating the CMS, theme or plugins does not fix PHP2Shell; PHP itself has to be updated. We cover this in more detail in PHP2Shell and WordPress sites: what to do.

Shared hosting versus your own server

• Shared or managed hosting: the host usually controls the PHP build and applies the patch. You often choose which PHP version your site uses in the hosting control panel, so you may need to move to a supported branch.
• Your own server, VPS or cloud instance: you, your IT provider or your developer are responsible for updating PHP and restarting the services that use it.
• Software and appliances: the NCSC warns that third-party products and services can bundle PHP, so check vendor updates too.

Being hosted elsewhere does not move the business risk away from you. See do I need cyber insurance if my website is hosted.

What to do in the next 24 hours

This checklist puts the NCSC and php.net guidance into plain English. Apex is an insurance broker, not an IT security firm, so the technical steps belong with your host, IT provider or developer.

1. List everything that runs PHP, starting with anything facing the internet: websites, shops, booking systems, client portals and intranets.
2. Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor package that contains the fix. php.net says: "There are no complete mitigations, updating is the only safe choice."
3. Treat stop-gaps as stop-gaps. Server settings such as disabling session upload progress or lowering post size limits reduce exposure to specific attack paths but do not make an installation safe.
4. If a system cannot be fixed, consider taking it offline until it can, as the NCSC suggests.
5. Monitor for malicious activity on internet-facing PHP systems, and keep watching for updates from software vendors whose products bundle PHP.
6. Ask your host or IT provider in writing whether your servers are patched, on what date, and whether they have checked for signs of compromise. Keep the reply. If something does go wrong, a dated record helps both the technical response and any insurance claim.
7. Look at your cyber policy for conditions on patching, notification and incident response, and save the insurer's incident helpline number if there is one.

Does cyber insurance cover a PHP2Shell attack?

Often yes, but it depends on your policy wording. A cyber policy does not usually name individual vulnerabilities; it responds to the consequences of a cyber incident, such as a hack, data breach or ransomware attack, subject to its terms, conditions, exclusions and excess. The covers commonly found in UK cyber policies are:

For a fuller breakdown see what cyber insurance actually pays for, first-party versus third-party cyber cover and what cyber insurance does not cover.

Known, unpatched vulnerabilities

Now that a fix exists, cover for an attack through a known, unpatched flaw can turn on the policy's security conditions. Some wordings require reasonable steps to keep systems updated, some set a period within which critical patches should be applied, and some contain exclusions or reduced cover for unpatched vulnerabilities. Others say little on the point. The wording and what you told the insurer on your proposal both matter. We explain this in does cyber insurance cover unpatched vulnerabilities. The practical point is simple: patch promptly and keep evidence of when you did.

Do I need to tell my insurer about PHP2Shell?

If you have found signs of compromise, almost certainly yes, and quickly. If you were simply running a vulnerable version and have now patched with no sign of attack, it depends on your wording.

• Claims-made policies: professional indemnity policies, and many cyber policies, are written on a claims-made basis, so the policy in force when you notify is the one that responds. Late notice can cause problems.
• Notification of circumstances: many policies let you, or require you to, notify circumstances that might give rise to a claim, even before anything has gone wrong. See notification of circumstances: what and when.
• Read your notification clause: check who to tell, how fast, and whether you must use the insurer's incident helpline before appointing your own IT experts. Our guide to cyber and PI notification obligations explains the common traps.
• Regulators run on a separate clock: if personal data has been breached and a risk to people is likely, UK GDPR Article 33 requires notice to the ICO without undue delay and, where feasible, within 72 hours of becoming aware.

Apex clients should call us. We will help you work out whether and how to notify, and get the notice to the insurer quickly and correctly. For the first days of a live incident, see cyber incident: the first 72 hours and your insurance.

If you don't have cyber insurance

Patching comes first. Cyber insurance is there for the costs that follow if something still goes wrong. Cyber policies are generally not designed to cover incidents that have already happened or that you knew about before cover started, so the time to arrange it is before you need it.

A quote is quicker if you have this ready:

• business activity, turnover and number of staff;
• what data you hold and roughly how many customer records;
• how your website is built and hosted, and who maintains it;
• your security basics: multi-factor authentication, backups, and how quickly critical updates are applied (including the date PHP was patched);
• any previous cyber incidents or claims.

Our cyber proposal form walkthrough explains the questions, and Cyber Essentials and cyber insurance covers how certification fits in. If you are weighing it up, start with what cyber insurance is and whether a small business needs it or our cyber insurance UK guide, or go straight to a cyber insurance quote.

How Apex can help

Apex is an independent UK insurance broker. We do not patch or scan systems, and we cannot guarantee cover or claims, but we can help with the insurance side:

1. Check your current cyber policy for its conditions on patching and security, notification and incident response.
2. Help Apex clients notify their insurer of an incident or circumstance quickly and correctly.
3. Arrange cyber cover if you have none, through our cyber proposal.
4. Arrange technology PI and cyber for web agencies, developers, hosting providers and MSPs.
5. Give a free second opinion on your renewal, and run our contract insurance clause check.

For web agencies, developers and hosts

If you build, maintain or host PHP sites for clients, PHP2Shell raises a second question: could a client hold you responsible if their site is compromised? That usually turns on your contract and what you agreed to maintain. Your own cyber policy covers your systems; claims from clients typically fall under technology professional indemnity. Record which client servers you patched and when, and consider notifying your PI insurer of circumstances if a client site may have been compromised. Read more in PHP2Shell liability for web agencies and hosting providers, web developer insurance, MSP cyber insurance and MSP liability when a client is breached.

Sources

• php.net: Security advisory, critical remote code execution vulnerabilities (21 October 2026)
• php.net: PHP 8.4.27 released (21 October 2026)
• NCSC: Critical security issue affecting PHP (21 October 2026)
• ICO: UK GDPR data breach reporting
• UK GDPR Article 33, legislation.gov.uk
• Help Net Security: PHP2Shell, critical PHP vulnerabilities patched (21 October 2026)

Frequently asked

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.