If your website or web app runs on PHP, and that includes most WordPress, WooCommerce, Laravel, Drupal and Magento sites, this affects you. This guide explains what happened in plain language and what to do today.

This is a developing situation. This article reflects what was publicly known on 27 October 2026.

What is PHP2Shell?

PHP is the programming language that runs on the server behind a large share of the web. PHP2Shell is a pair of bugs in PHP itself, not in a plugin or theme, which means a website can be vulnerable even if its own code is perfectly written.

Both flaws allow unauthenticated remote code execution. In plain terms, an attacker who can reach your website over the internet can run their own commands on your server, without a username or password. They are rated 9.2 out of 10 for severity (CVSS v4.0).

• CVE-2026-109618 is triggered when PHP runs out of memory part-way through setting up a request, leaving data in a broken state that PHP later trusts.
• CVE-2026-109619 involves internal data that outlives the request it belongs to, so the next request handled by the same PHP process can act on leftover data.

According to the PHP project, the risk is highest on servers using Apache with mod_php, where an attack can succeed before your application's code even runs.

Why it matters for your business

Code execution on your server means an attacker can potentially:

• read or steal customer data, orders and passwords stored in your database
• change your website, add spam pages or redirect visitors to malicious sites
• install malware or use your server to attack others
• take your site offline

Beyond the immediate damage, a breach can mean lost sales, a drop in search rankings if Google flags your site, and data-protection obligations if personal data is exposed.

Is my website affected?

Every PHP installation that serves web requests is in scope, whatever the server setup: PHP-FPM, Apache mod_php, php-cgi, LiteSpeed and FrankenPHP.

If you are below the fixed version for your branch, you are vulnerable until you update.

How to check your PHP version

Use whichever applies to you:

• WordPress: go to Tools → Site Health → Info → Server and look at "PHP version".
• Hosting control panel: cPanel, Plesk and most managed hosts show the PHP version under a "PHP" or "Software" section.
• Laravel: run php artisan about on the server.
• Server access: run php -v. Note that the command line can use a different PHP than your website, so also check what your web server or PHP-FPM is running.

What to do now

1. Update PHP to a fixed version

Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install the updated PHP package from your Linux distribution. The PHP maintainers state that no configuration change fully protects you. Updating is the fix.

2. Restart PHP after updating

Running PHP processes keep using the old code until they restart. Restart PHP-FPM, Apache and any long-running PHP workers so the fix actually takes effect.

3. If you use managed or shared hosting

Many hosts update PHP for you, but don't assume. Contact your host and ask two questions: Has PHP been updated to a fixed version for PHP2Shell? and Have PHP processes been restarted? If your site is pinned to an old PHP version in the control panel, the host may not be able to protect it.

4. If you are on PHP 8.1 or older

These versions no longer receive official updates. CISA's advice is to take unsupported PHP systems offline until they can be updated. The lasting fix is to upgrade to a supported version (8.2 or newer). For older WordPress or Laravel sites this can mean updating plugins, themes or framework versions too, so test on a copy of the site first.

5. If you can't update today

• Restrict access to the site or server (for example, behind a VPN or IP allow-list) or take it offline temporarily.
• A web application firewall (such as Cloudflare's) can block known attack patterns, but it is only partial protection while you patch, not a replacement for it.

6. Check for signs of compromise

If your site was exposed before you patched, look for warning signs: unfamiliar files or admin users, PHP processes launching shell commands or downloading tools, unexpected outbound traffic, or changed pages. If anything looks wrong, restore from a clean backup, change all passwords and keys stored on the server, and get a professional to investigate.

The bigger lesson: keep your stack up to date

PHP2Shell isn't a reason to abandon PHP. It is a reminder that every website runs on layers of software that need regular maintenance. Sites still on PHP 7.4 or 8.1 are now in the hardest position, because there is no simple official update for them.

A simple routine prevents most of this:

• stay on a supported PHP version and plan upgrades before end-of-life dates
• apply security updates promptly and know who is responsible for them (you, your developer or your host)
• keep regular, tested backups stored away from the server
• keep plugins, themes and frameworks current

Need help?

If you're not sure whether your site is affected, or you're stuck on an old PHP version that needs upgrading, get in touch with us. We build and maintain custom web applications and websites and can help you update safely.

Sources

• CISA: Critical Vulnerabilities in PHP Require Immediate Patching
• CERT-EU Security Advisory 2026-018: Critical Vulnerabilities in PHP
• watchTowr: CVE-2026-109618 FAQ
• Help Net Security: PHP2Shell vulnerabilities patched

For a rescue, the website does a lot of the work. It's where adopters meet the dogs, where fosterers and volunteers sign up, and where supporters donate. Chance 4 Change had a website, but it needed an upgrade, and keeping the dog listings up to date had to be simple for a small team.

The challenge

The charity needed:

• a modern website that shows each dog well and makes adopting, fostering, volunteering and donating easy
• a simple way for the team to add and update dogs without editing pages by hand
• a place to share happy endings and foster stories, which build trust with future adopters and donors
• a way to raise money for dogs that need medical treatment

What we built

A new public website

• Dogs for adoption, each with their own profile and story
• Clear pages for adopting, fostering (with an application route), volunteering and surrendering a dog
• A donate page so supporters can give online
• A featured dog on the homepage, a newsletter sign-up and full charity details

An admin system

The charity's admins log in to a dashboard that shows the numbers at a glance, such as how many dogs are looking for homes, how many have been rehomed, foster stories and urgent medical cases. From there they can manage:

• Available dogs: add a dog with photos and their story, and update them as things change
• Adopted dogs: dogs that have found their forever homes, shared as success stories
• Foster stories
• Medical fund cases: a page for a dog that needs treatment, with photos and the story behind the appeal

Everything added in the admin area appears on the public website straight away, so keeping the site current no longer needs a developer.

Technology

• Next.js for a fast website and admin system in one codebase
• MongoDB for dogs, stories and medical cases

The project took around two to three months.

The result

• The team can easily manage dogs, success stories and appeals themselves
• The website gives every dog a proper profile, and makes the next step clear whether a visitor wants to adopt, foster, volunteer or donate
• Rehomed dogs and foster stories are showcased, helping more rescue dogs find homes

We continue to support Chance 4 Change with the platform.

Building something similar?

Charities and non-profits often run on small teams and tight budgets, so the website has to be easy to keep up to date. If you need a site that your team can manage themselves, tell us about your project and we'll get back to you with a free design.

That's three different things to run from one website: a professional service business, a charity and a membership-based park. Cheryl already had a website, but it needed an upgrade to handle bookings, memberships and payments properly.

The challenge

Cheryl needed a single platform that could:

• present her dog and horse services, the Trust Technique, the charity and the adventure park clearly
• let park members join, book sessions and manage their own bookings
• support different types of membership
• take payments online
• give her an admin area to run it all without technical help

What we built

A new public website

A rebuilt website covering her services for dogs and horses, the Trust Technique, the charitable trust, the canine adventure park, a dog photo gallery and client testimonials, with clear paths to enquire, book or donate.

A member portal

Park members get their own login where they can:

• manage their profile and their registered dogs, including neutering and vaccination status
• see upcoming sessions and book new ones
• reschedule or cancel bookings themselves, with changes locked inside a set window before a session starts so the park isn't left with last-minute gaps
• view their active membership and past sessions
• leave a review after a session

An admin system

Behind the scenes, Cheryl has one dashboard to manage the whole business:

• Bookings and calendar for park sessions and services
• Membership packages and booking packages, with Stripe for payments
• Service plans with pricing that appears automatically on the website
• Vouchers
• Clients and their dogs
• Opening hours and slot settings for each day, including session length and buffer time between bookings
• Park closures and blackout dates, so maintenance days or bad weather block bookings automatically
• An email broadcast tool to message clients, filtered by membership status (for example active, expired, or no package)
• Testimonials with an approval queue, and the dog gallery

Technology

• Next.js for the website, member portal and admin system in one codebase
• MongoDB for members, dogs, bookings, memberships and content
• Stripe for online payments

The project took around two to three months.

The result

• Members can book and manage park sessions online, and memberships and payments are handled in one place
• Cheryl can update services, pricing, opening hours, closures and content herself
• Day-to-day admin is much easier to manage, with bookings, members, payments and communication in a single system

We continue to work with Cheryl on the platform.

Building something similar?

If you run a membership, venue or appointment-based business and are juggling bookings, payments and member communication across different tools, we can bring it together in one system. Tell us about your project and we'll get back to you with a free design.

CoachFlow is a platform we designed and built to bring all of that into one place, so coaches can spend less time on admin and more time coaching.

CoachFlow is a Devketers product. The screenshots use sample data.

The problem we set out to solve

A coach's business runs on a simple loop: someone discovers them, books a call, becomes a client and joins a programme. Each step tends to live in a different tool, so leads go cold, bookings get missed and it's hard to see which programmes actually bring in revenue.

What CoachFlow does

Online booking

Clients book through a public booking page: they pick a session type (such as a free discovery session), choose a date and time in their own time zone, and get a video call link when the booking is confirmed. The coach creates available slots by date range, time and session length, and sees everything on a bookings calendar.

Session management

Every booking shows the client, the time and any notes they left. The coach can confirm, complete or cancel sessions in one click.

Leads captured from email

CoachFlow brings leads together from different sources, such as quizzes, freebies, newsletter sign-ups and bookings, into one inbox, so no enquiry gets lost. Coaches can filter by source and date, and reply from there.

Lead board

A visual pipeline moves each lead from new to outreached, reply received and completed, with the package they're interested in and their notes. Leads can be filtered by package and exported.

Clients and revenue

• Client management, with personal details, joined dates and growth over the month, plus CSV export
• Revenue by programme, for example a 12-week transformation programme, single sessions or a group mastermind, so the coach can see which offers perform best

Technology

• Next.js for the public booking pages and the coach portal in one codebase

The result

CoachFlow gives a coach one place to take bookings, capture and follow up leads, manage clients and see revenue, which means less time on admin and more time coaching.

Want something like this for your business?

CoachFlow's approach works for any appointment-based service business, such as consultants, therapists, tutors or trainers. Tell us about your business and we'll get back to you with a free design.

The Dog Walkers App is a Devketers product. The screens shown use sample data.

It has three separate experiences in one app: one for dog owners, one for walkers and one for the business admin.

For dog owners

• A home screen with upcoming walks and their status (requested or confirmed)
• Book with a walker after viewing their profile, including qualifications such as canine first aid, the areas they cover, the walks they offer and reviews from other owners
• Group walks or private walks, depending on what each dog needs
• Dog profiles, with alerts when a vaccination is due
• Walk reports after every walk, with notes, distance, duration and photos
• Notifications when a walk is confirmed, a request is sent, a report is ready or a membership renews

For walkers

• A day view of their walks, including group walks with every dog in the group
• Each dog's pick-up address and access notes, for example where the key safe is, or that the side gate latch is stiff
• Mark a walk complete, and reports are sent to every owner automatically
• Their client list, availability and time off, the areas they cover, and the types of walk they offer

For the business admin

• People: clients, walkers and dogs in one place, with filters such as members, clients with low credits and inactive clients
• Book on behalf of a client: pick the dog, group or private walk, walker, day and time slot. The app warns when a dog already has a walk that day
• Prices and services, including group walks, private walks and meet-and-greets
• Membership plans and walk credits
• Team: add new dog walkers
• Reports on revenue, bookings and capacity
• Exports of client emails and active clients

Technology

• React Native, so one codebase runs on both iPhone and Android

The result

Owners can book walks in a couple of taps, walkers have everything they need for each walk in their pocket, and the business can see bookings, clients, capacity and revenue in one app.

Want an app like this?

We build cross-platform mobile apps for service businesses, from booking and scheduling to client and team management. Tell us about your idea and we'll get back to you with a free design.

Fetch Cambridge came to us with an existing system that they had outgrown. We designed and built a new platform that brings their website, bookings, scheduling and payments together in one place.

The challenge

The old system could no longer keep up with how the business worked day to day. Fetch Cambridge needed a single platform that could:

• let clients book walks online instead of arranging everything manually
• handle recurring walks, the regular weekly bookings that most of a dog walking business depends on
• give the team a clear view of who is walking which dog, and when
• keep client and dog details organised
• take payments online

It also had to work for three very different groups of people: the business owners running it, the walkers out on the road, and the dog owners booking walks.

What we built

We built a custom web application with a public website and a secure login for each type of user.

For clients (dog owners)

• Online booking of walks, including recurring bookings
• A profile for their account and their dogs
• Online payments through PayPal
• Notifications about their bookings

For dog walkers

• Their own login showing the walks assigned to them
• Notifications when their schedule changes

For admins

• Full booking management in one dashboard
• Scheduling walks and assigning them to walkers
• Client and dog profiles
• Invoicing and payment tracking
• Notifications to keep clients and walkers up to date

The public website and the management system are part of the same build, so new clients can go from reading about the service to booking a walk without leaving the site.

The hardest part: recurring walks and booking management

Most of a dog walking company's work is repeat business. The same dog is walked every Monday, Wednesday and Friday, for months. That sounds simple, but a booking system has to deal with what happens around it:

• a client cancels or moves a single walk without changing the rest of the schedule
• a walker is unavailable and their walks need reassigning
• new one-off bookings have to fit around the recurring ones
• payments and invoices need to match the walks that actually happened

We designed the booking model around recurring walks from the start, rather than treating them as a series of separate one-off bookings. This keeps the schedule accurate when things change, and makes the admin view much easier to manage.

Technology

• Next.js for the website and web application, in one fast, SEO-friendly codebase
• MongoDB for bookings, clients, dogs, walkers and schedules
• PayPal integration for online payments

The project took around five months from start to launch.

The result

• Bookings now come in online, so clients can book walks themselves rather than arranging them manually
• Day-to-day management is easier: bookings, recurring walks, walker schedules, client details and payments are all in one place
• The website and booking system work together, giving Fetch Cambridge a professional online presence that turns visitors into bookings

Fetch Cambridge was happy with the new platform, and we continue to work with them on improvements and new features as the business grows.

Building something similar?

If you run a service business that depends on bookings, schedules and repeat customers, such as dog walking, pet care, cleaning, tutoring or coaching, a system built around how you actually work can take a lot of the admin off your plate. Tell us about your project and we'll get back to you with a free design.

That work produces a huge amount of data: thousands of leads, each with a status, a call history, notes and follow-up dates, spread across several client campaigns and handled by a team of agents. Generic spreadsheets and off-the-shelf CRMs didn't fit the way the team actually works, so we built them a CRM of their own.

The challenge

iSolutionYou needed one system that could:

• hold leads for several client campaigns without mixing them up
• track every lead through the outreach process, from first contact to booked appointment
• show managers, at a glance, how calls and appointments are going
• control what each team member can see and do
• stop agents from wasting time on duplicate leads when new lists are imported

What we built

A live overview dashboard

Total appointments, appointments booked today, show-ups and missed appointments, plus lead counts by outcome (callbacks, interested, not interested, wrong number, follow-ups). A trends chart shows calls and appointments over the week, next to today's schedule.

Lead pipelines per client

Leads are organised by client campaign. Each lead has its contact details, company, location, source (for example LinkedIn, referral, website or Upwork), status and follow-up date. Statuses cover the whole outreach process, including new lead, interested, future follow-up, cold email sent, appointment booked and onboarding. A full outreach notes and history log on each lead means anyone can pick up where a colleague left off. There is also a separate workspace for leads being worked by text message.

Appointments and calendar

Booked appointments appear in a calendar with today's schedule, call details and status (scheduled, completed, no-show). Appointments booked through Calendly are tracked automatically.

Team management and permissions

• Role-based access: admins can switch individual pages, data actions and sensitive sections on or off for each team member
• User management with roles such as outreach specialist, senior sales agent and sales manager
• KPI reporting per employee over any date range: appointments, show-up rates and booking outcomes
• Salary management for the team

Spreadsheet import and duplicate checker

New lead lists can be uploaded from Excel or CSV. Before anything is imported, the duplicate checker screens the file against existing leads, for one client or across the whole CRM. Flexible matching rules (for example name and company together, or phone or email alone) decide what counts as a duplicate.

Technology

Built on the MERN stack:

• MongoDB for leads, clients, appointments and users
• Express and Node.js for the API, permissions and import processing
• React for the dashboard and workspace
• Calendly integration for appointment tracking

The result

• Lead data from every client campaign is organised in one place, with a full history on every lead
• The team's workflow is streamlined: agents know exactly who to call and when, and managers can see performance without building reports by hand
• Duplicate checking keeps imported lists clean, so agents don't call the same business twice

Building something similar?

If your team is managing leads, calls and appointments across spreadsheets and tools that don't quite fit, a CRM built around your process can make a big difference. Tell us about your project and we'll get back to you with a free design.

For a manufacturer selling to other businesses, the website is often the first thing a buyer checks. It has to show the product range clearly, prove quality, and make it easy to get in touch for a quote.

The challenge

Solid Tex needed a professional corporate website that would:

• present the company, its experience and its values
• show the full product range in a way buyers can scan quickly
• highlight its certifications, such as ISO 9001:2015 and OEKO-TEX® Standard 100, which matter to export customers
• explain which industries it serves
• turn visitors into enquiries
• be set up properly for search engines, so buyers can find it

What we built

A WordPress corporate website with:

• About the company: its journey, philosophy and commitment to quality and sustainability
• Why choose Solid Tex: pricing, quality, fast delivery and on-site testing
• Product range: thread types with images, including spun polyester, polycore and bonded threads
• Industries served: apparel and fashion, home textiles, industrial applications and technical textiles
• Certificates: a dedicated section showing its quality and textile safety certifications
• Contact: a direct call-to-action phone number, an enquiry form, address details and a map

The site uses a clean, corporate design built around the company's brand, and was built with SEO in mind so buyers can find it in search.

Technology

• WordPress, so the Solid Tex team can update content themselves

The result

Solid Tex has a professional online presence that presents its products and certifications clearly, supports its reputation with buyers and gives them a simple way to make an enquiry.

Building something similar?

If you're a manufacturer or B2B business and your website isn't doing justice to your products and quality standards, we can help. Tell us about your project and we'll get back to you with a free design.

Some of the stock is bought through investment groups, where money is pooled to buy watches, so profit also has to be tracked per group. That gets complicated quickly in spreadsheets.

The challenge

The Watches Inc needed one system to:

• keep track of every watch in stock, where it came from and what it cost
• record sales with the real profit on each one, after expenses
• see sales and profit per investment group
• track expenses, including advertising spend
• keep a record of customers, suppliers and day-to-day tasks

What we built

A private admin web app with everything in one place.

Dashboard and analysis

A dashboard with sales trends and sales by group, plus a business analysis view showing revenue and profit trends, order volume and a monthly sales history with new customers and profit.

Investment groups

Each investment group shows its watches, total sales and profit, so everyone knows how their money is performing.

Inventory

Every watch is recorded with its investment group, brand, source, cost price, list price and condition, plus whether it has been posted on Instagram yet. Stock can be added one item at a time, imported in bulk or pasted in from a spreadsheet.

Sales records

Each sale records the cost, selling price, any expenses and the resulting profit, along with the customer, city, payment status and whether the order has been shipped and delivered. Totals for revenue, profit and number of transactions are always visible, and sales can be imported in bulk.

Expenses, customers and suppliers

• An expense tracker with categories and a monthly trend, including advertising spend
• A customer directory with each customer's sale history
• Sources and suppliers, with totals for what has been bought and sold through each
• A simple to-do list for day-to-day tasks

Technology

• React for the admin interface
• Node.js for the API and business logic
• MongoDB for stock, sales, customers and groups

The result

• Sales, stock and customers are managed in one system instead of scattered spreadsheets
• The business can see the real profit on every watch, and for every investment group
• Bulk import and paste make it quick to bring existing records in

Building something similar?

If you're running a reselling or retail business on spreadsheets and starting to lose track of stock, costs and profit, a simple custom system can give you a clear picture. Tell us about your project and we'll get back to you with a free design.