How we handled the PHP2Shell security flaws
On 21 October 2026 two critical security flaws in PHP were made public. They became known as PHP2Shell. PHP is the software that runs most websites, including every WordPress site, so this was one of the most serious web security issues of the year.
This post explains what happened, what we did, and what it means for websites hosted with BM Hosting.
What PHP2Shell was
The flaws allowed an attacker to take control of an unpatched web server without needing a password. Any server running an affected version of PHP was at risk until it was protected.
What we did
- Protected the same day. Protections were in place across our hosting on 21 October, the day the flaws went public, and our server firewall blocked the known attack.
- Permanent fix installed. The patched version of PHP was installed across all of our hosting by 23 October.
- Older PHP versions covered. Some fixes were applied to the PHP version a site already runs. That means the version number your site shows may not have changed, even though it is protected.
- No downtime. None of this needed any action from our customers, and no website was taken offline.
Do you need to do anything?
No. If your website is hosted with us, it is protected. If your IT provider or insurer asks for written confirmation, you can point them to our security notice.
Keeping you informed
When something affects our hosting, we post it on our service status page and in our announcements. If you have a question about your own site, email hello@bluemonkee.com.
