Patched, but still not safe? Three cases
Your host patched PHP2Shell and said there's nothing to do. For most sites that's true. Here are the three cases where you're not done yet and what to check.
By Jeensuk Yang
PHPFree · Web security · Risk series 02
?Who this is for
- Your web host told you PHP is patched and there's "nothing to do"
- You're thinking, "The patch is done, so we're done"
- You want to know whether your business is one of the exceptions
!What you'll learn
- What a patch protects you from, and what it doesn't
- The three cases where you're not done yet, and the signs of each
- How to tell which side your business is on
Did you get the "patched, nothing to do" email?
In the last article I explained that most big web hosts patched PHP on October 21 and 22. For most businesses, that really is the end of the story. But businesses in three situations still have work left. Let's go through them one at a time, so you can decide for yourself which side you're on.
If PHP is patched, is everything really done?
For most sites, yes, as of October 25, 2026.
Hostinger, for example, rolled out the fix across its platform and told customers on every plan except VPS that there was nothing to do.1 Kinsta patched PHP 7.4 through 8.5 with no action needed from customers.2 But a patch is like putting a new lock on your front door, and there are things a new lock can't do.
- Someone who got in before the lock was changed
- A house where you have to change the lock yourself (a VPS)
- A separate hole in a different door
A new lock does nothing about someone already inside, or a copy of the old key they left with.
Psychologists call our habit of assuming bad things happen to other people optimism bias.3 It's what turns "nothing to do on our side" into "nothing could have happened to us." Those are two different sentences.
Jeensuk's take"Patched" means future attacks are blocked. What already happened, and the parts you manage yourself, need a separate check.
Case 1: What if someone got in before the patch?
Then the way in they left behind is still there. Attackers moved fast this time. Hostinger says it blocked exploit attempts that were "already circulating" before the fix was public.1 And Wiz, one of the teams that found the bugs, showed that attackers could read passwords, tokens and API keys out of PHP's memory.4
Closing the vulnerability does not remove persistence or malicious code already present. — ThreatLocker, Oct 21, 2026
So security teams give the same advice: look at whether anyone reached the server before it was patched,5 and keep the server logs from October 20 onward before restarting or rebuilding anything.6 If you suspect a break-in, change the passwords and keys that may have leaked.5 CISA, the U.S. cybersecurity agency, also tells administrators to watch for PHP processes that start shells or download tools.7
Signs worth checking
- Your WordPress user list has an admin you don't recognize
- Your uploads folder has PHP files you didn't put there
Jeensuk's takeA patch doesn't show a burglar the door. I'll walk through how to look for the traces in part 4.
Case 2: What if you manage the server yourself?
Then nobody patched it for you.
On shared or managed hosting, the host looks after PHP, which is why so many hosts fixed it at once. A VPS or your own server is different. Hostinger's notice says it plainly: if you manage PHP on your own server, "update it and restart it now."1 Reclaim Hosting gave customers who run their own PHP containers until October 27 to redeploy.9
In other words, a site on a VPS can still have the hole open today, unless someone has actually done the update.
Signs you might be on a VPS
- Your plan's name includes "VPS," "cloud server" or "dedicated"
- Your web developer said, "We set up the server for you, too"
- Your monthly bill comes from your developer as a "maintenance fee," not from a hosting company
Jeensuk's takeOn a VPS, the first question is "Who updates PHP?" I'll cover this case in detail in part 3.
Case 3: What about the separate hole announced on October 23?
It's a different bug from the October 21 fix, and very few sites are affected. On October 23, the PHP team published an informational advisory about session upload progress (CVE-2026-115560). It isn't fixed by the October 21 releases; PHP will handle it in the next regular release.10
It only matters under what PHP calls "an unusual combination of configuration and application code": an app that switches how sessions are stored while it's running.10
session.upload_progress.enabled=0) in php.ini or the server settings, then restart PHP. PHP says not to rely on ini_set() or a .user.ini file for this.10You can't tell from looking at your site whether this applies, so ask the person who can see your server settings.
Jeensuk's takeThis isn't something to lose sleep over. Just remember that right after a big fix, related holes can turn up.
So what should your business do?
First, here are the three cases on one page.
| Case | What's left | Who checks |
|---|---|---|
| 1. Break-in before the patch | A planted back door, leaked passwords | You + whoever runs your site |
| 2. A server you manage | The hole itself | Whoever manages the server |
| 3. The separate bug | A different hole with no fix yet (rare setups only) | Whoever manages the server (your host, on shared hosting) |
You have three ways forward.
Parts 3 and 4 of this series walk through every step. If someone on your team can handle server settings, this is enough.
"Are we on shared hosting or a VPS?" and "Do we still have server logs from October 20 on?" If you don't get an answer, that is an answer.
A brochure-style business site can run without PHP. No PHP means no "crack in the foundation" like this one.
Jeensuk's takeFor most small businesses, the real problem isn't this hole. It's scrambling the same way all over again when the next one is found.
Frequently asked questions about life after the patch
My host said "nothing to do." Do I really have nothing to do?
Mostly, yes. It's still worth checking separately that no one got in before the patch. Take one look at your WordPress user list and your uploads folder.
How do I know whether my site is on a VPS?
Check your contract or invoice. If the plan says "VPS," "cloud server" or "dedicated," or if your developer set up the server for you, it may be a VPS. Ask your developer to confirm.
Do I need to act on CVE-2026-115560 right now?
Most sites aren't affected. It only matters in unusual setups. If you're unsure, ask your server admin whether session.upload_progress.enabled=0 is set.
SOURCES
- Hostinger, "Hostinger deploys protections against php2shell PHP vulnerabilities" (Oct 21, 2026; updated Oct 23) hostinger.com
- Kinsta, "PHP2Shell: How Kinsta protected WordPress sites" (Oct 23, 2026) kinsta.com
- Wikipedia, "Optimism bias" (Weinstein 1980, Journal of Personality and Social Psychology 39(5), 806–820) wikipedia.org
- Wiz Research, "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet" (Oct 21, 2026) wiz.io
- ThreatLocker, "PHP2Shell: Why organizations must patch critical PHP vulnerabilities now" (Oct 21, 2026) threatlocker.com
- TechTarget, "PHP2Shell: 22M exposed servers at risk as emergency patches released" (Oct 21, 2026) techtarget.com
- CISA, "Critical Vulnerabilities in PHP Require Immediate Patching" (Oct 21, 2026; last revised Oct 23) cisa.gov
- Google Cloud (Mandiant), "M-Trends 2026: Data, Insights, and Strategies From the Frontlines" (Mar 24, 2026) cloud.google.com
- Reclaim Hosting, "Reclaim Cloud and PHP2Shell" (Oct 22, 2026) reclaimhosting.com
- PHP Group, "Informational advisory: Session upload progress" (Oct 23, 2026) php.net
Five articles on what PHP2Shell means for small business websites. More English editions are on the way.
- What is PHP2Shell? What it means for your business website
- Patched, but still not safe? Three cases (this article)
- Why sites on a VPS or your own server are still at risk (coming soon)
- What if someone got in before the patch? Three signs (coming soon)
- PHP 8.2 support ends Dec 31: what to decide now (coming soon)
More articles on the ATATAKAI Digital blog.
Are you on the "done" side, or the "not yet" side?
Enter your site address and we'll tell you right away whether it runs on PHP and where your host stands. If you're not affected, we'll say so plainly: "No need to move right now."
Run the free 30-second checkWant to talk it through after you see the result? Contact ATATAKAI Digital
Updated Oct 26, 2026
