This week a pair of critical flaws nicknamed “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619) were disclosed in PHP — the programming language that quietly powers a huge share of the world’s websites, including most WordPress sites. Rated 9.2 out of 10, they let an attacker run their own code on a vulnerable web server without ever logging in — and attackers were probing for them within hours. The UK and US cyber authorities urged organisations to patch immediately.

Here’s the uncomfortable question for any business with a website: if your site had become vulnerable overnight, would you have known? For most organisations the honest answer is no — and that, not PHP itself, is the real lesson.

Your website was “secure” — past tense

A website isn’t secure once; it’s secure as of the last time someone checked. New critical vulnerabilities like this appear constantly, in the software your site is built on — PHP, WordPress, plugins, frameworks, libraries. A site that sailed through a security review last month can be wide open today, through no change of your own. And the gap between a flaw being made public and being exploited is now measured in hours, not weeks.

Why one-off checks don’t cut it

An annual penetration test or a one-off scan is a photograph — accurate the day it’s taken, out of date the next morning. What actually protects you is continuous vulnerability scanning: your websites and web applications checked automatically, around the clock, against the very latest known vulnerabilities. So the moment something like PHP2Shell lands, you know whether you’re affected and can act — before an attacker does.

What to do right now

If you run PHP anywhere — a WordPress site, a web app, a legacy page — patch it immediately to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. And if you’re not even sure whether you’re exposed? That uncertainty is the problem continuous scanning solves.

Continuous scanning, from Foresight

We provide continuous vulnerability scanning of your websites and web applications — automatically checking for new flaws like PHP2Shell and telling you plainly what to fix, and when. It’s just £35 per month. You can also start with a free external risk scan to see where you stand today — and if the worst ever happens, here’s exactly what to do if you get hacked.

PHP2Shell will be patched and forgotten within a fortnight. The next critical flaw is already on its way. Continuous scanning is simply how you stop finding out the hard way.

Sources: the PHP project security advisory and CISA alert on CVE-2026-109618 / CVE-2026-109619 (“PHP2Shell”), and reporting by BleepingComputer, The Hacker News, Help Net Security and others, October 2026. This article is general cyber-security commentary and the author’s opinion.