Quick answer: On October 21, 2026, the NSA and CISA issued emergency advisories about a critical PHP vulnerability nicknamed "php2shell" (CVE-2026-109618 and CVE-2026-109619). Virtual Results immediately audited all 20 servers and 50+ PHP runtimes across our entire fleet, patching every client site to the secure versions recommended by CISA. All services remain fully protected.
A major security event hit the web this fall, and it affected nearly every website running on PHP — the programming language that powers a huge share of the internet, including every site Virtual Results manages for its clients. On October 21, 2026, the National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA) both issued emergency advisories warning organizations to patch their systems immediately or take them offline.
That's a serious response, and it doesn't happen often. When two federal agencies issue emergency guidance on the same day, it's worth understanding what happened and why. This post explains the threat in plain language, what it could have meant for your website, and exactly what Virtual Results did to make sure every site in our care stayed protected.
What Was the 'php2shell' Vulnerability?
The vulnerability at the center of this advisory goes by two technical names — CVE-2026-109618 and CVE-2026-109619 — but security researchers gave it a more memorable nickname: "php2shell." The name hints at what it does. Attackers who exploited this flaw could potentially go from zero access to full control of a server, as if they had typed commands directly into it.
In technical terms, this was an unauthenticated remote code execution (RCE) vulnerability. In plain terms: attackers didn't need a password, a login, or any special access to exploit it. They just needed to find a website running an affected version of PHP. According to the NSA's October 21, 2026 advisory, the flaw could provide a direct path to a server's file system or database — meaning sensitive data, site files, and backend systems were all potentially exposed.
This vulnerability affected all PHP installations serving web requests, regardless of industry, site size, or hosting provider. If a system ran PHP and was reachable from the internet, it was a potential target.
How Serious Was the php2shell Vulnerability?
This wasn't a routine bug fix. The NSA's advisory recommended that organizations take systems offline entirely if they couldn't be patched right away — a recommendation reserved for the most severe threats. CISA echoed that urgency, directing organizations to prioritize immediate patching of internet-facing systems above all else.
The FBI also issued its own warning, underscoring that this wasn't a narrow or theoretical risk. The scope was worldwide. Because PHP powers such a large percentage of websites globally, from small business sites to major platforms, the potential blast radius of this vulnerability was enormous.
For context, when the NSA, CISA, and FBI all weigh in on the same vulnerability within the same window, it signals that the risk is active, exploitable, and already being used — not just a hypothetical weakness.
What Could This Have Meant for Virtual Results Clients?
Any website built on PHP was potentially at risk, and that included every site in the Virtual Results fleet. Left unpatched, this vulnerability could have given attackers unauthorized access to site data, client databases, and underlying server files.
For a real estate brokerage, agent, or organization relying on a website for lead generation, client communication, or daily operations, that kind of exposure could mean compromised client data, disrupted services, or reputational harm. This is precisely the kind of event where fast, coordinated action matters most — which is why we moved immediately.
What Virtual Results Did About It
The moment the advisories went public, our team began a full inventory across our infrastructure. We identified 50+ PHP runtime records spanning 20 servers, covering a wide range of versions — everything from legacy PHP 5.6 installations to our most current PHP 8.5 environments.
We didn't wait to prioritize. Our first move was patching the PHP runtimes powering active, client-facing websites, since those were the systems most exposed to internet traffic and therefore the highest-risk targets. Following CISA's guidance, we updated affected systems to the secure versions: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, depending on which branch each site was running.
We made a deliberate choice to keep each site on its existing verified PHP branch wherever a vendor fix was available, rather than forcing version jumps that could introduce compatibility issues. Stability matters just as much as security, and our goal was to close the vulnerability without creating new problems elsewhere.
Before and during the patching process, we prepared rollback plans for every environment, so that if anything behaved unexpectedly, we could reverse the change quickly and safely. We also manually checked live processes and site behavior after each patch to confirm that everything was functioning as expected — not just that the vulnerable version number had changed.
Because a threat of this scale called for more than a one-time fix, we also expanded our uptime monitoring beyond simple HTTP status checks, giving us deeper visibility into how our servers and applications behave going forward. From there, we completed a full-fleet follow-up, extending the same patching process to staging environments, internal services, command-line PHP installations, and older, idle installs that weren't part of our initial active-site sweep.
Every Service We Protect Is Covered
This wasn't a partial fix limited to our highest-traffic sites. Virtual Results patched every service across our entire fleet, including:
- Agent sites
- Broker sites
- Broker caravan sites
- Real estate education sites
- Real estate charity sites
- Calendar Alerts app
- My Hub
- New agent sites
- The Virtual Results platform
- Our real estate content delivery service
Every one of these services runs on PHP in some form, and every one of them has been fully reviewed, patched, and verified against the php2shell vulnerability.
You're in Good Hands
As of today, every site and service in the Virtual Results fleet is patched, tested, and operating as expected. There's no further action required on your part — the work is already done.
This kind of rapid, fleet-wide response is exactly what we do behind the scenes for our clients, every day. Security threats like php2shell don't wait for convenient timing, and neither do we. Whether it's an emergency advisory from the NSA or routine maintenance, our team treats the security of your website with the same urgency we'd want if it were our own.
If you have questions about this vulnerability or how it relates to your specific website, reach out to your Virtual Results account team. We're here to keep your site secure, so you can stay focused on your business.
Frequently Asked Questions
What is the php2shell vulnerability?Php2shell refers to two related vulnerabilities, CVE-2026-109618 and CVE-2026-109619, disclosed on October 21, 2026. It allowed attackers to remotely execute code on servers running affected PHP versions without needing a login or credentials.
Was my website affected by this vulnerability?If your site is hosted and managed by Virtual Results, it has already been fully patched. Every server and PHP runtime across our fleet — including active sites, staging environments, and internal services — was reviewed and updated.
Did Virtual Results find any evidence of a breach?This post focuses on the vulnerability and our patching response. If you have specific concerns about your site, contact your Virtual Results account team directly for details.
What did Virtual Results do to fix this issue?We inventoried all PHP runtimes across our servers, prioritized patching for active client sites first, updated systems to the CISA-recommended secure versions (PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35), and followed up with a full-fleet review covering staging, internal services, and idle installs.
Do I need to do anything on my end?No. Virtual Results handled the entire patching process across all managed sites and services. No action is required from clients.
How can I stay informed about future security updates like this?Your Virtual Results account team is your best point of contact for updates on site security and infrastructure maintenance. Reach out anytime with questions.