| Critical PHP flaws: What to watch for and what to update | | Critical PHP flaws: What to watch for and what to update | | Hello Malwarebytes Customer, | | Emergency security updates are now available for two critical vulnerabilities in PHP, the programming language that powers many websites and web applications. | | Known as PHP2Shell, these flaws could let attackers run malicious code on an affected server without logging in. They could steal business data, change website content, or use a trusted website to target visitors with phishing pages and malicious downloads. | | If you’re a website visitor: | - Some websites may temporarily go offline while they are patched.
- Watch for unexpected content, downloads, or redirects, and repeated login requests, even on familiar sites.
- If something looks wrong, leave the page.
- You don't need to install PHP updates on your own device.
| | If you’re a website owner: | - Ask your hosting or IT provider to confirm PHP fixes are installed, not just scheduled, across all your websites and applications.
- If they can’t patch immediately, ask whether affected services should temporarily be taken offline.
- If you manage your own servers, follow PHP’s update instructions.
- Using unsupported PHP? Check for a vendor fix or upgrade to a supported version.
| | Read our blog for more information about PHP2Shell and the security updates. | Stay safe,
The Malwarebytes Team | |
 | | | | Powerful digital protection that’s always by your side | | | | | | | | © 2026 Malwarebytes • 2445 Augustine Drive, Suite 550, Santa Clara, CA, USA, 95054 | | 2445 Augustine Drive, Suite 550,
Santa Clara, CA, USA, 95054
© 2026 Malwarebytes | | | | |
