PHP2Shell, Old PHP and Cheap Hosting: Pakistan and the Gulf

When the PHP2Shell vulnerabilities were disclosed on 21 October, the large managed hosts patched within a day and most of their customers never had to think about it.

That is genuinely most small business sites in Dubai, and a good share of them in Karachi and Lahore too. But it is not all of them, and the ones left over are concentrated in a particular corner of the market that is large in both regions: cheap shared hosting, an old PHP version, and nobody whose job it is to look after any of it.

If that is your site, the useful thing to understand is that PHP2Shell is not really your problem. It is the symptom that made the actual problem visible.

Correct as of 25 October 2026. This is a fast-moving situation and some of the detail below will have changed. Where it matters, we have said what is confirmed and what is not.

The short version

Check which PHP version your site runs. If it is 8.2 or newer on a managed host, you are almost certainly already patched and there is nothing to do. If it is 8.1 or older, you are on a branch that stopped receiving ordinary security updates — this time a patch was issued anyway because the severity demanded it, which will not happen for the next one. Upgrading is a day of work and it is overdue regardless of this CVE.

Why the old-version problem is worse here

Nothing about PHP2Shell targets any particular country. What differs by market is how sites are hosted and who maintains them, and in Pakistan and across the Gulf a few patterns are common enough to be worth naming:

• The site was built once, years ago, by someone who has moved on. There was no maintenance arrangement because nobody suggested one. The hosting renews automatically on a card, and the control panel login is in a WhatsApp thread from 2022.
• The hosting was chosen on price. At the bottom of the market, "we will patch PHP within 24 hours of an emergency disclosure" is not part of what you bought, and the smaller local resellers vary enormously in whether they do it at all.
• The PHP version was never moved forward, because an old WordPress theme or a custom script broke on a newer one, so someone pinned it to 7.4 and left it.

None of that is unusual or shameful — it is how most small business websites end up. It does mean that when something like this week happens, there is no mechanism for it to reach your site.

Which PHP versions still get security fixes

Branch	Status
8.4, 8.5	Actively supported
8.3	Security fixes
8.2	Security fixes until 31 December 2026
8.1 and older	End of life. No ordinary security releases.

PHP2Shell was severe enough that source patches were issued even for 7.4, 8.0 and 8.1, and managed hosts applied them. That was an exception made for a 9.2-rated unauthenticated RCE. Plan on the basis that the next one gets no such exception.

Note the date on 8.2: it drops off at the end of this year. If your site is on 8.2 right now, you are fine today and you have a deadline.

What to check, in ten minutes

1. Find out what PHP your site actually runs. In WordPress: Tools → Site Health → Info → Server. In hPanel or cPanel there is a PHP version page. Do not rely on php -v over SSH — on shared hosting it usually reports a different interpreter from the one your website uses, which we explain in how to check whether your PHP is really patched.
2. Find out whether your host has said anything. A host that published a security notice within a day of disclosure is a host that is paying attention. Silence a week later is information too.
3. Check when the site was last updated. If WordPress core, the theme and the plugins are all months behind, PHP is not your largest exposure — it is just the one in the news.

If you are on 8.1 or older

Moving up a PHP version is usually straightforward and occasionally fiddly. The honest sequence:

1. Take a full backup — files and database — and verify you can actually restore it. An untested backup is a hope, not a backup.
2. Clone the site to a staging subdomain and switch PHP there first. Every decent host gives you this; it is the step that turns a risky change into a boring one.
3. Update WordPress core, the theme and the plugins on staging before the PHP version, not after. Most upgrade failures are an abandoned plugin, and finding that out on staging costs you an afternoon rather than your live site.
4. Switch PHP on staging, then click through properly — checkout, forms, admin, anything custom. Turn error display on while testing and off before you go live.
5. Then do the live site, at a quiet hour, with the backup to hand.

If a plugin or a custom script genuinely will not run on a modern PHP version, that is worth knowing clearly, because it means that component is unmaintained and you are building on it. Usually it is replaceable; occasionally it needs rewriting. Either way the decision is better made now than during the next emergency.

If your hosting is the weak link

The test is simple: did your host patch this within a couple of days and tell you about it? If you cannot find out, that is your answer.

Decent managed hosting is not expensive any more, and the gap between the cheapest option and one that patches properly is usually a few dollars a month — set against a site that is the main source of enquiries for the business. We do migrations to Hostinger regularly, including for sites stuck on old PHP, and we have written up how to move a site without downtime if you would rather do it yourself. To be upfront: we are a Hostinger affiliate and the signup links on that service page earn us a commission. It is also the host our own site runs on, which is the actual reason we recommend it rather than the other way round.

For businesses in Pakistan and the UAE we handle this as ongoing work rather than a one-off: website care plans cover the updates, the PHP version, the backups and the monitoring, so that the next time a 9.2-rated flaw turns up, somebody has already dealt with it before you read about it.

If you are not sure what your site is running, send us the domain. We will tell you the PHP version, whether it is patched and whether anything else is obviously out of date. No charge, and no obligation to do anything about it with us.