Article
Critical PHP flaw (php2shell): what it means for companies with an old TYPO3 website
On 21 October 2026 the PHP developers released a fix for two critical flaws that let an attacker run their own program on a web server without logging in. If your website is up to date, you simply have PHP updated. With an old TYPO3 website it isn't that simple – it doesn't run on the fixed PHP. We explain why, what it means for your company and what to do.
What happened
PHP is the programming language that many websites run on – including every website on TYPO3, WordPress or Drupal. The server uses it every time a page is displayed.
On 21 October 2026, new PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released. They fix two flaws, CVE-2026-109618 and CVE-2026-109619, known as php2shell. Through them, an attacker can run their own program on the server without logging in. The PHP developers rate them as critical – 9.2 out of 10.
- They affect every PHP installation that serves a website, regardless of the system running on it.
- Details leaked before the planned disclosure. Security companies reported the first attack attempts on the very day the fix was released.
- There is only one complete protection: updated PHP. The settings the PHP developers recommend until the update reduce the risk but do not remove it.
Why an old TYPO3 website won’t get the usual fix
Think of a website as a car: TYPO3 is the body and the equipment, PHP is the engine. This time the flaw is in the engine, and officially fixed engines were released only for newer models – PHP 8.2 and newer.
But each TYPO3 version can only run on certain PHP versions. An old TYPO3 does not fit into the new engine:
| TYPO3 version | PHP versions it runs on | The php2shell fix |
|---|---|---|
| 13 LTS | 8.2 and newer | applied with a regular PHP update |
| 12 LTS | 8.1 to 8.4 | applied if the website runs on PHP 8.2 to 8.4 |
| 11 LTS | 7.4 to 8.3 | applied only after moving to PHP 8.2 or 8.3 |
| 8 to 10 LTS | 7.0 to 7.4 | only through an unofficial patch for PHP 7.4, if your hosting provider applies it – otherwise an upgrade |
| 4.x to 7 LTS | 7.2 at most | none from the PHP developers – an upgrade is the only way |
For PHP 7.4, 8.0 and 8.1, the PHP developers prepared at least a minimal patch outside the regular releases for those who build PHP themselves, and some Linux distributions and long-term support vendors ship their own fixed packages. You need to ask whether your hosting provider has them. For PHP 7.3 and older, the PHP developers prepared nothing. Google lists all versions from PHP 5.4 onwards as vulnerable – and old PHP has years of unfixed flaws even without php2shell.
Even if you fix PHP, TYPO3 11 and 12 themselves no longer receive free security fixes – more in the article How long your TYPO3 website is supported. And if you run TYPO3 13 on PHP 8.2: PHP 8.2 receives fixes only until 31 December 2026, so it is a good idea to move to at least PHP 8.3 by the end of the year.
How many websites are affected? In September we scanned 102,144 Slovak domains and found 249 websites on TYPO3. For 93 of them the version could be determined, and 45 of those ran on TYPO3 4 or 6. These versions run on PHP 5, for which the PHP developers prepared no fix, and they cannot reach the fixed PHP 8.2 without an upgrade.
What exactly your company risks
When an attacker can run their own program on the server, they can do roughly what the website itself can: change pages, read the database, send e-mails. In practice it can look like this:
- Someone else’s content under your name. Fraudulent pages or ads for pharmaceuticals or casinos appear on the website. Visitors coming from Google or on mobile are redirected elsewhere. You may not notice, because the website looks normal to you.
- A data leak. Enquiries from forms, contacts, editor logins, the entire website database. If personal data leaks, a company generally has to report the incident to the data protection authority within 72 hours of becoming aware of it (Art. 33 GDPR).
- Spam and blacklists. A compromised server can send spam or attack other servers. Its address ends up on blacklists, and if the company’s e-mails also go through it, they start landing in spam.
- Warnings in Google and in the browser. Google may warn in its search results that the website may be hacked, and the browser may show a red warning before it. Visitors leave before they read what you do.
- An outage and a repair under pressure. The hosting provider may switch a compromised website off. Then comes cleaning, restoring from a backup if there is one, and a rushed upgrade – more expensive than a planned one.
“Attackers aren’t interested in us”
With flaws like these, attackers don’t pick a particular company. Bots scan the entire internet and try every server that responds. For php2shell, the security company Sansec predicted mass attacks within 15 minutes of the fix being published, and security companies reported the first attack attempts on the same day – some even before the fix was released. To a bot, a small company website is the same target as a large one.
What to do – depending on your website’s version
- Find out what your website runs on. The quick check on t3web.awis-group.com shows the system, an estimate of the TYPO3 version and the PHP version, if the server reveals it. Your hosting provider or website administrator can tell you the exact PHP version.
- TYPO3 13 or 12: ask your hosting provider or administrator to update PHP to a fixed version as soon as possible (8.2.35, 8.3.36 or 8.4.27, or a fixed distribution package). With TYPO3 12 on PHP 8.1 you first need to move to a newer PHP. Attack attempts appeared even before the fix was released, so also have the server checked for unknown new files.
- TYPO3 11: if the website runs on PHP 8.2 or 8.3, updating PHP is enough. If it runs on an older version, moving to PHP 8.2 may require changes to extensions. Consider upgrading right away – TYPO3 11 has not received free fixes since 31 October 2024.
- TYPO3 10 and older: the only lasting solution is a TYPO3 upgrade, which also moves the website to current PHP. Until the upgrade is done:
- ask your hosting provider whether they have a fixed package for your PHP (for PHP 7.4 one may exist, for older versions it is unlikely),
- have the protective settings recommended by the PHP developers applied – they reduce the risk but do not remove it,
- keep an up-to-date backup stored outside the server,
- if you don’t need the website, switch it off. The UK National Cyber Security Centre (NCSC) also recommends disconnecting systems that cannot be fixed immediately from the internet.
How we can help
- The quick website check is free and requires no registration; you see the result immediately.
- Audit: within two working days we send a report – what your website runs on, what is risky and what a fixed-price solution would cost.
- Upgrade to TYPO3 13 LTS at a fixed price: S €2,900, M €4,900, L from €7,900. We keep the content and redirect the old URLs so the website keeps its Google rankings.
- CARE from €39 a month: hosting in the EU, security updates for TYPO3 and PHP, backups and monitoring. Then you don’t have to follow news like php2shell yourself.
All prices exclude VAT.
We wrote this article on 21 October 2026. We will update it when new information becomes available.
Sources: PHP announcement of the security releases – php.net (21 October 2026); supported PHP versions for TYPO3 – typo3.com (ELTS 10.4, 11.5, 12.4), for older versions jweiland.net; vulnerable PHP versions – Google Cloud; course of the attacks and recommendations – SecurityWeek, Tenable, Help Net Security, Huntress; end of PHP support – php.net/eol.php; figures from the scan of Slovak domains – AWIS, September 2026.