{"id":31988,"date":"2026-10-22T08:34:49","date_gmt":"2026-10-22T06:34:49","guid":{"rendered":"https:\/\/www.thebrokernews.ch\/attention-do-you-know-if-your-website-runs-on-php\/"},"modified":"2026-10-22T14:51:49","modified_gmt":"2026-10-22T12:51:49","slug":"attention-do-you-know-if-your-website-runs-on-php","status":"publish","type":"post","link":"https:\/\/www.thebrokernews.ch\/en\/attention-do-you-know-if-your-website-runs-on-php\/","title":{"rendered":"ATTENTION: Do you know if your website runs on PHP?"},"content":{"rendered":"
The question isn't whether PHP is used, but where.<\/span><\/div>\n\n\n\n

Two critical vulnerabilities in the PHP programming language have taken websites offline around the world, including in Switzerland. For insurers, brokers, and small and medium-sized businesses, the question now is not whether they use PHP, but where. Because the answer is often more surprising than one might think.<\/strong><\/p>\n\n\n\n

Hardly anyone outside the IT department is familiar with PHP, and yet a large part of the Internet runs on it: from WordPress, Joomla, Typo3, and Drupal to online stores, customer portals, and internal administration tools. WordPress alone powers an estimated 400 to 500 million websites. It is precisely this foundation that has been compromised as of this week. Two vulnerabilities in the core of the language, known as \u201cPHP2Shell\u201d and registered as CVE-2026-109618 and CVE-2026-109619, are currently circulating. They allow attackers to remotely execute their own code on the server without logging in. In plain language: take over websites, extract databases, access customer data, and misuse the infrastructure for further attacks.<\/p>\n\n\n\n

A leak that set the clock ticking<\/strong><\/h6>\n\n\n\n

What\u2019s explosive isn\u2019t just the vulnerability itself, but the sequence of events. The name PHP2Shell comes from an exploit tool; a screenshot of it surfaced in a leak on October 20, 2026, before a patch (to fix the vulnerability) was available. The patched versions were released on October 21 at 4:00 p.m. Swiss time. Both vulnerabilities are rated with a CVSS score of 9.2, which is close to the maximum. The situation is now serious: The University of Stuttgart\u2019s RUS-CERT has reported publicly available exploits, has verified one of them according to its own statements, and has reported attacks that have already been observed. The German BSI classifies the risk as exceptionally high with a warning level of \u201c3 \/ Orange.\u201d <\/p>\n\n\n\n

Switzerland Is Right in the Middle of It<\/strong><\/h6>\n\n\n\n

Anyone who thought this was just a German problem was quickly proven wrong. The Federal Office for Cybersecurity (BACS)<\/a> has classified both vulnerabilities as critical and is urging all website and online service operators to install the update immediately. Among those affected were the Basel-based hosting provider Cyon<\/a> and the University of Basel. The University of Geneva and ETH Lausanne also temporarily took their websites offline, as did various hosting providers; the canton of Basel-Stadt shut down its websites as a precaution. <\/p>\n\n\n\n

Noteworthy is the BACS\u2019s observation, which goes far beyond the traditional corporate website: PHP can also be found in administrative interfaces, internal line-of-business applications, hosting platforms, containers, or appliances, and operators are not always aware that a product uses PHP in the background. For an industry whose brokers, agencies, and customer portals often run on off-the-shelf solutions, this is a real wake-up call. <\/p>\n\n\n\n

Am I affected?<\/strong><\/h6>\n\n\n\n

The honest answer: Anyone who operates their own or a rented website should assume this is the case until proven otherwise. All versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12; only these four versions and any later ones are secure. How PHP is integrated on the server doesn\u2019t matter; the PHP team considers Apache with mod_php to pose the highest risk. You can check the PHP version in your hosting provider\u2019s admin panel or by contacting your IT department. But be careful not to jump to conclusions: BACS notes that the major version alone does not indicate whether a patch is missing, because Linux distributions provide their own patched packages. <\/p>\n\n\n\n

Users of website builders can be a little more relaxed. Websites on hosted platforms such as Shopify, Wix, or Squarespace are generally not directly affected because the provider operates and updates the servers itself. For regular internet users, there\u2019s no immediate need to take action anyway, the vulnerability is on the servers, not on smartphones or laptops. However, you could still be indirectly affected if data leaks through an unprotected website.<\/p>\n\n\n\n

What to Do Right Now<\/strong><\/h6>\n\n\n\n

Step 1: Call your hosting provider, IT service provider, or system administrator\u2014do not email them. Step 2: Update. The only complete fix is to update to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12 and then restart all PHP processes. The restart is not a minor detail: A process that was started before the update continues to run with the old code in memory. Nor does the instinct to quickly update WordPress and all plugins help. The vulnerabilities lie in PHP itself; updating plugins or themes does not fix the problem. <\/p>\n\n\n\n

Things are getting tricky for anyone still using outdated technology. The PHP project no longer provides updates for PHP 8.1 and earlier; it only offers minimal source code backports for 7.4, 8.0, and 8.1, which are intended for administrators who compile PHP themselves. In this case, BACS recommends switching to a supported version. And while we\u2019re on the subject: According to php.net, PHP 8.2 will only receive security updates until December 31, 2026. Where an update is not possible, the only option, as the authorities also point out\u2014is to temporarily take the server offline. According to the BACS, a web application firewall alone is not sufficient.<\/p>\n\n\n\n

Step three, and this one is often overlooked, is to check whether anyone has already gained access to the system. The BACS urges organizations to identify affected systems beyond just the website and to look for signs of an attack. If you suspect a compromise, take the following steps: take the website offline, secure the logs as evidence, and change all login credentials and keys.<\/p>\n\n\n\n

The Insurance Question<\/strong><\/h6>\n\n\n\n

For companies with cyber insurance, it\u2019s worth taking a look at their policy now, before anything happens. Many policies make coverage contingent on appropriate security measures and timely patching of known vulnerabilities. Anyone who suspects an attack should notify their insurer early on; most insurers offer incident response hotlines specifically for such situations. In addition, there are legal obligations: Operators of critical infrastructure must report cyberattacks to BACS within 24 hours, and where personal data may have been compromised, the obligation to report to the FDPIC applies under the revised Data Protection Act. For brokers, this applies doubly: they operate websites and portals themselves, and their SME clients expect clear guidance, not technical jargon\u2014, specially now.<\/p>\n\n\n\n

The Real Lesson<\/strong><\/h6>\n\n\n\n

PHP2Shell isn\u2019t the first vulnerability of this magnitude, and it won\u2019t be the last. The lesson here lies less in the technical aspects than in organizational ones: If you don\u2019t know which software is running on which systems, you won\u2019t be able to respond within hours in the event of a crisis. An up-to-date inventory of your own IT infrastructure, clear lines of responsibility with your service provider, and a well-rehearsed emergency plan are not optional extras\u2014they are risk management. The machines were patched in record time. Whether they are updated in a timely manner is up to people.<\/p>\n\n\n\n

Binci Heeb<\/p>\n\n\n\n

See also: Cyber insurance is on the rise but there are still major gaps for small and medium-sized enterprises<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Two critical vulnerabilities in the PHP programming language have taken websites offline around the world, including in Switzerland. For insurers, brokers, and small and medium-sized businesses, the question now is […]<\/p>\n","protected":false},"author":2,"featured_media":31989,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"_price":"","_stock":"","_tribe_ticket_header":"","_tribe_default_ticket_provider":"","_tribe_ticket_capacity":"0","_ticket_start_date":"","_ticket_end_date":"","_tribe_ticket_show_description":"","_tribe_ticket_show_not_going":false,"_tribe_ticket_use_global_stock":"","_tribe_ticket_global_stock_level":"","_global_stock_mode":"","_global_stock_cap":"","_tribe_rsvp_for_event":"","_tribe_ticket_going_count":"","_tribe_ticket_not_going_count":"","_tribe_tickets_list":"[]","_tribe_ticket_has_attendee_info_fields":false,"footnotes":""},"categories":[5100,5134],"tags":[15937,15933,15938,15940,15936,15939,15935,15941,6181,15934],"class_list":["post-31988","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-current","category-general","tag-affected-individuals","tag-cyberattack","tag-didactic-play","tag-insurance-question","tag-leak","tag-outdated","tag-php","tag-steps","tag-technology-en-2","tag-websites","ownarticle"],"acf":[],"cc_featured_image_caption":{"caption_text":"The question isn't whether PHP is used, but where.","source_text":"","source_url":""},"_links":{"self":[{"href":"https:\/\/www.thebrokernews.ch\/en\/wp-json\/wp\/v2\/posts\/31988","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thebrokernews.ch\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thebrokernews.ch\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thebrokernews.ch\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thebrokernews.ch\/en\/wp-json\/wp\/v2\/comments?post=31988"}],"version-history":[{"count":2,"href":"https:\/\/www.thebrokernews.ch\/en\/wp-json\/wp\/v2\/posts\/31988\/revisions"}],"predecessor-version":[{"id":31993,"href":"https:\/\/www.thebrokernews.ch\/en\/wp-json\/wp\/v2\/posts\/31988\/revisions\/31993"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thebrokernews.ch\/en\/wp-json\/wp\/v2\/media\/31989"}],"wp:attachment":[{"href":"https:\/\/www.thebrokernews.ch\/en\/wp-json\/wp\/v2\/media?parent=31988"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thebrokernews.ch\/en\/wp-json\/wp\/v2\/categories?post=31988"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thebrokernews.ch\/en\/wp-json\/wp\/v2\/tags?post=31988"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}