PHP security issue and our automatic fix

PHP flaw identified on 21 Oct 2026

Earlier today, two critical PHP issues were identified and a fix was pushed out to address these, which was impacting around 70% of all the websites in the world. These were tracked as CVE-2026-109618 and CVE-2026-109619 and known as php2shell.

Every site we manage are powered by PHP so this became a critical and urgent fix for us to address. It was a truly global issue with the vulnerability being highlighted by the BBC and comms for the National Cyber Security Center being issued on what to do. We were constantly reviewing and deciding upon the action that we would put in place.

We take these issues exceptionally seriously and our dev and support teams kicked into action.

DNS protection

One feature that made us much more confident in our servers stability and the decision to wait until the patch had been rolled out was that 99% of our sites are protected via CloudFlare DNS. CloudFlare deployed protections against the php2shell vulnerability as part of their automatic WAF rules. This change to the firewall, that the web traffic moves through, mitigated the issue. It’s not a permenant fix but gave us a massive advantage in protecting the assets.

Wibbles actions on the PHP vulnerability

We worked closely with our hosting team to audit, plan and arrange the rollout of the update that came out at 14.00 UTC. It was a large task as we are fully responsible for the entire management of hundreds of PHP powered websites across dozens and dozens of managed servers. We were confident in our server teams’ approach and oversaw the patch rollout to all of our critical assests. At the time of the publication of this blog: The rollout continues across our entire suite of servers.

Wibble’s on-going security approach

This isn’t our first critical vulnerability, and it won’t be our last. We took control and made decisions on our approach quickly and put a plan in place. We’ve written about a previous issue with faced before and our approach was similar to this. We are a zero trust agency and we continue to put a huge amount of time, effort and money into the identification, mitigation and protection of issues, flaws and vulerability that come out.

Our approach has been flawless to date but we are constantly reviewing, tweaking and improving our defences using a multi-faced approach to web security.

This is our general approach and guide to ongoing maintenance and protection, which we have carried out

Proactive Monitoring: Our team constantly monitors for security vulnerabilities and potential threats. This vigilance allowed us to respond quickly to this PHP issue.

Comprehensive Audits: As soon as the vulnerability was identified, we conducted thorough audits of all client websites. This step was crucial in assessing the extent of the risk and ensuring no site was overlooked.

Swift Implementation: We understand the importance of rapid response. We worked with the hosting team to swiftly push the fix out.

Client Communication: Transparency with our clients is key. We were pleased that quite a number of clients contacted us to check were we aware of this fix and we were able to confidently state we were and already had a plan in place. This blog post forms part of our communication plan to let clients know that we are all over this issue.

Summary

Our team moved rapidly to identify, evaluate the issue and act. We had experience in dealing with similar issues in the past so we knew what to do and had the team to roll it out with confidence.

For more information on our web design and web development services and how we can help protect your website, please contact us.