Security reporting indicates that two critical remote code execution vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and referred to collectively as PHP2Shell, are now being exploited in the wild. For businesses that rely on PHP-based websites, e-commerce systems, custom applications or hosting environments, this raises the urgency of checking whether affected systems are exposed and whether vendor fixes or mitigations are available.

What happened

According to the source report, attackers have successfully exploited the two PHP2Shell vulnerabilities in real-world activity. The reported issue is significant because remote code execution can allow an attacker to run commands on a vulnerable server, which may lead to website compromise, data exposure, malware deployment or broader access to connected systems.

At this stage, the key confirmed development from the report is that exploitation has moved beyond a theoretical risk. That changes the business response from routine patch planning to more immediate verification, prioritisation and monitoring.

Why it matters for European businesses

PHP remains widely used across European business websites, content platforms, e-commerce stacks and internally developed web applications. Even where a company does not manage PHP directly, it may still depend on hosting providers, web agencies, SaaS connectors or software vendors running PHP components in the background.

For SMEs in particular, externally exposed web servers often support critical business functions such as:

• online stores and checkout flows
• lead generation websites and landing pages
• customer portals and booking systems
• CMS-based marketing websites
• API endpoints and integrations

If exploited, a critical server-side flaw can affect both operations and trust. Possible business consequences may include website downtime, SEO and campaign disruption, theft of customer or employee data, unauthorised redirects, malicious code injection, or the use of a compromised server as a foothold for wider intrusion.

For companies operating under GDPR or sector-specific security requirements, a web server compromise may also trigger internal reporting, forensic review and, depending on the incident, possible legal or contractual obligations. The exact obligations depend on the facts of the incident and should not be assumed automatically from the vulnerability alone.

Who may be affected

The highest-risk organisations are those with internet-facing PHP deployments or dependencies. This may include:

• SMEs running PHP-based websites, intranets or customer portals
• e-commerce businesses using PHP-driven storefronts, plugins or custom modules
• marketing teams relying on CMS platforms and campaign microsites hosted on PHP environments
• IT teams and digital agencies managing client websites, VPS infrastructure or shared hosting
• businesses using third-party vendors whose products or managed environments include vulnerable PHP components

Risk is typically higher where systems are directly exposed to the internet, patching is delayed, software ownership is unclear, or monitoring is limited.

What companies should consider

Businesses do not need to wait for a confirmed incident before acting. Practical steps may include:

• Identify exposure: inventory PHP-based public-facing systems, applications and hosting environments, including those managed by suppliers.
• Check vendor guidance: review advisories from PHP maintainers, hosting providers, platform vendors and security partners to determine whether your versions or deployments are affected.
• Prioritise remediation: apply available patches or supported mitigations based on official guidance, especially on internet-facing systems.
• Review logs and monitoring: look for unusual command execution, suspicious web requests, unexpected admin activity, file changes or new scheduled tasks.
• Limit exposure: where immediate patching is not possible, consider temporary access restrictions, segmentation or compensating controls recommended by your security team or provider.
• Prepare incident response: ensure that website owners, IT, hosting partners and external developers know who is responsible if signs of compromise appear.
• Assess downstream impact: if a vulnerable server connects to CRM, payment, ERP or customer databases, review whether extra containment or credential rotation is needed.

For smaller businesses, the most important immediate question is simple: Do we run any exposed PHP-based systems, and who is responsible for updating them? If that answer is unclear, this type of in-the-wild exploitation is a strong reason to clarify ownership quickly.