Security update

PHP2Shell: Perdigon Systems Are Not Affected

By Mike Allen, CTO, Perdigon Group October 22, 2026 3 min read

On October 21, 2026 the PHP project released fixes for two critical flaws that let an attacker take over an unpatched PHP server without logging in. European cybersecurity agencies told site owners who cannot patch quickly to take their sites offline. We checked every Perdigon system the same day. None of them run PHP, and none are affected.

What happened

The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed "PHP2Shell", are in the core of PHP itself, the language behind WordPress and a large share of the web. An attacker who can reach a vulnerable site can run their own code on the server. Nearly every PHP version released in the last decade is affected.

The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Security firms are now reporting attempts to exploit the flaws in the wild, so this is not a "patch next month" item.

Is Perdigon affected?

No. On October 22 we checked each system our customers touch:

This website is a static site on Cloudflare. It has no PHP and no server-side code to attack.
The support portal runs on Zoho Desk, a hosted service that does not expose PHP.
Payments go through Stripe's hosted checkout. Card details never touch our servers.
Our automation servers, which run ticketing, audits and calling reports, have no PHP installed on the host or in any service.

Cisco Webex and Meraki are Cisco cloud services. Cisco publishes its own advisories in the Cisco Security Advisory center, and we will pass on anything that affects your services.

What to do if you run PHP

If your company has a WordPress site, a customer portal, or any web app built on PHP, work through this list today:

Find out who runs it. Ask your web developer or hosting company which PHP version your site uses and when they will update it.
Update to a fixed version: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Older versions such as PHP 7 get no fix, so the site has to move to a supported version.
Restart after updating. PHP-FPM, Apache and other long-running PHP processes keep running the old code until they restart.
Check your network gear. Some firewall, NAS and camera admin pages run on PHP. Update the firmware when the vendor ships a fix, and keep admin pages off the open internet.
If you cannot patch yet, take the site offline or put it behind a login or web application firewall until you can. That is the guidance from the EU agencies.

Not sure if you're exposed?

Send us your website address and we will check it from the outside and tell you whether it runs PHP and which version. No cost, no obligation.

Ask for a free check

Questions people ask

Do I need to do anything about Perdigon's services?

No. The Perdigon website, support portal, payments and automation do not use PHP and are not affected. Your Webex and Meraki services are covered by Cisco's own security process.

My site is on WordPress. Am I at risk?

WordPress runs on PHP, so it depends on the PHP version your host runs. Ask your host whether they have moved to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restarted. Most managed WordPress hosts patch for you; check rather than assume.

How would I know if someone already got in?

Look for new admin users, unfamiliar files in the site folders, unexpected outbound traffic, or a host warning. If anything looks off, take the site offline and have your developer or a security firm review it before restoring.