On October 21, the PHP project released emergency security updates for two critical vulnerabilities. Security researchers are calling them "PHP2Shell." PHP is the programming language behind a large share of the web, including WordPress and many of the website platforms independent tire dealers use. If your shop's website runs on PHP, now is the time to make a call.

What happened

The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and both are rated critical (CVSS 9.2). According to the PHP Foundation, either one can let an attacker run their own code on a web server without logging in. The PHP team says every PHP installation that serves web pages is at risk, and the most common server setups are included.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged organizations to patch immediately. When CISA published its alert, it had not seen the flaws being exploited. Europe's CERT-EU has since noted that early proof-of-concept exploit code is circulating, which raises the risk of attacks.

Why it matters to a tire shop

Your website is often the first place a customer meets your business. It may take online appointments, quote requests, contact forms and customer details. If an attacker took control of the server, they could steal that information, change your pages, redirect visitors or knock the site offline. Any of those costs you bookings and customer trust.

You don't need to be a technical expert to act. You only need to ask the right questions.

What to do now

  1. Contact your web company or hosting provider. Ask which PHP version your website runs and whether it has been updated for CVE-2026-109618 and CVE-2026-109619.

  2. Confirm the version is fixed. The patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. See the official PHP release notes. PHP 8.1 and older no longer get official updates. Some hosting providers apply fixes to older versions themselves, so ask your provider to confirm in writing.

  3. Check your plugins and add-ons. If your site uses WordPress or another content management system, make sure the core software, themes and plugins are current. Remove anything you no longer use.

  4. Keep current backups. Ask your provider how often your site is backed up, where the backups are stored and how quickly the site can be restored.

  5. Watch for unusual activity. Look out for unexpected pages, new admin accounts, strange redirects, spam form submissions or a sudden slowdown. Report anything odd to your web provider straight away.

CISA advises that sites which can't be updated quickly should be protected or taken offline until they are patched. A web application firewall may give some short-term protection, but the PHP team is clear that installing the update is the only complete fix.

The bottom line

Most tire dealers don't manage their own web servers, and that's fine, but it means the fix depends on your provider. A five-minute phone call or email today can confirm your site is protected. If you can't get a clear answer, keep asking until you do.

For more detail, see the CISA alert, the PHP Foundation's announcement and the Canadian Centre for Cyber Security advisory.