PHP2Shell: What Arab Website Owners Should Do About the Critical PHP Flaw, and How to Go Offline Without Losing Rankings

On 21 October 2026 PHP shipped emergency releases (8.5.12, 8.4.27, 8.3.36 and 8.2.35) for two critical flaws, nicknamed PHP2Shell, that can let an attacker run code on a server without logging in. Most small and mid-sized websites in Saudi Arabia, the UAE, Egypt and the rest of the Arab world run WordPress on PHP, often on shared hosting the owner never logs in to. We read the PHP version that 23 Arab websites announce in their own response headers on 25 October. Two of the five that show a version were still on an unpatched release.

Key takeaways

• Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no official release; only some hosts and Linux vendors backport the fix.
• A third flaw (CVE-2026-115560) was disclosed on 23 October and is not fixed by the 21 October releases. The interim fix is the server setting session.upload_progress.enabled=0.
• Of 23 Arab websites we checked, 18 hide their PHP version or do not appear to run PHP. Of the 5 that show it, 2 were on 8.2.34, one release short of the fix.
• If you must take a site offline to patch, Google’s John Mueller says to return HTTP 503, not a timeout, a 404 or a 500.

What is PHP2Shell, and which versions are fixed?

PHP’s own advisory of 21 October lists two vulnerabilities: CVE-2026-109618 (remote code execution through out-of-memory corruption) and CVE-2026-109619 (remote code execution through stale global state). Both can be triggered without authentication. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and PHP says that only an update is a complete solution (PHP security advisory).

The details leaked on 20 October, before the planned release, and PHP published about 25 minutes early on 21 October. Patchstack’s timeline records hosting partners and Cloudflare reporting early attacks the same morning, followed later that day by telemetry that showed mostly probing (Patchstack). The Canadian Centre for Cyber Security said on 23 October that a proof of concept is public and that it had not yet seen active exploitation, and it added a third flaw, CVE-2026-115560, which the 21 October releases do not fix (Canadian Centre for Cyber Security, AL26-026).

How exposed are Arab websites?

CybelAngel, citing Shodan counts, reports about 2.24 million internet-facing hosts that advertise PHP. Of about 1.5 million that state a version, roughly 59% run a branch with no official fix. Algeria is named among the countries with the highest share of such hosts (CybelAngel). The report gives no figures for Saudi Arabia, the UAE or Egypt.

To get a first Arab reading, on 25 October we opened the homepages of 23 websites in Saudi Arabia, the UAE, Kuwait and Egypt: medical labs and clinics, digital and SEO agencies, a consultation platform, a VPN site and our own two sites. For each, we read only the headers the site sends to every visitor (X-Powered-By and Server). We did not probe or test anything.

We do not name the two unpatched sites. Both are healthcare websites in the Gulf. The three patched sites include our own voctos.net and voctos.com.

Two limits matter. First, a hidden version tells you nothing: 18 of 23 sites hide it or show no PHP at all, and some of them may be on PHP 8.1 or older. Second, a host can run a patched backport while still reporting the old number, so a header is a reason to check, not proof of a hole. This is 23 sites on one day, not a market survey.

What should an Arab website owner do this week?

1. Find your PHP version. In WordPress, go to Tools, then Site Health, then Info, then Server. On Hostinger this is in hPanel under PHP Configuration; on cPanel it is under MultiPHP Manager. If you cannot see it, ask whoever holds the hosting account, which for many Arab businesses is the developer who built the site.
2. Update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later. If you are on 8.1 or older, ask the host whether it ships a backported fix (CloudLinux, Debian/Ubuntu Sury, AlmaLinux, Remi and Zend LTS builds are named by Patchstack). If not, plan the move to 8.3 or 8.4 and test the site on staging first.
3. Ask the host to set session.upload_progress.enabled=0. PHP and the Canadian Cyber Centre both list it; it is also the interim fix for CVE-2026-115560. It must be set at the server or FPM level, not with a plugin.
4. Do not install “fix” plugins or paste code snippets from forums. Patchstack warns that these are unverified and can break sites.
5. Check for signs of compromise: new admin users, unknown files in wp-content, spam pages in Search Console’s Pages report, or sudden redirects on mobile. If you find any, treat the server as compromised and change every password and key it holds.
6. Check your data-protection duties if customer data may have been exposed. Saudi Arabia’s PDPL, the UAE’s Federal Decree-Law 45 of 2021 and Egypt’s Law 151 of 2020 all contain breach-notification rules. Read the regulator’s text or ask your lawyer for the exact deadline that applies to you; this article is not legal advice.

Will taking my site offline hurt rankings?

Not if you do it the right way. John Mueller of Google said that a site taken down for the PHP fix should return HTTP 503 (service unavailable) rather than time out or return 404 or 500, and that this can be done outside PHP, for example at the CDN or by pointing DNS elsewhere (Search Engine Roundtable, 21 October 2026). A 503 for a few hours tells Google to come back later. If the site will be down for more than a day, Google’s older guidance is to serve a static version instead. Many Arab sites already sit behind Cloudflare, which makes a maintenance page with a 503 status the quickest route.

After the fix, open Search Console and check Settings, then Crawl stats, for a run of 5xx errors, and the Pages report for URLs that dropped out. If traffic moves in the same week, rule out server errors before blaming an algorithm update; see what moved in Arabic search during the September 2026 spam update.

What does this not cover?

We did not test any site for the vulnerability, and we could not see the version on 18 of 23 sites. We did not check Arab government or bank websites. The numbers on exploitation come from the security firms and agencies cited, not from our own logs.

FAQ

Is my site safe if it is on PHP 8.3.36?

It is patched for the two flaws fixed on 21 October. CVE-2026-115560, added on 23 October, still needs session.upload_progress.enabled=0 until PHP ships a fix.

My site is on Wix, Shopify, Salla or Zid. Do I need to do anything?

These platforms run their own servers, so the update is their job, not yours. Sites on WordPress, Joomla, Drupal or custom PHP code on your own hosting need the steps above.

Can a 503 page hurt my Google rankings?

A 503 for hours is the status Google recommends for planned downtime. Long outages of several days, or errors that look like 404 or 500, are what cause pages to drop.