On 21 October 2026, two critical security flaws were announced in PHP, the software that runs WordPress and a large share of the websites on the internet. Security researchers have named them PHP2Shell. If your business website runs on WordPress, or on any other PHP software, it is at risk until your web host updates PHP to a fixed version. Updating WordPress or your plugins will not fix this one.
The fix is already out. Most small businesses just need to send their host one email and check the reply. Here is what happened, how to tell if you are affected, and exactly what to ask.
What actually happened?
Two flaws, recorded as CVE-2026-109618 and CVE-2026-109619, were disclosed in PHP itself. Both are rated 9.2 out of 10 for severity. In plain English, they can let an attacker run their own code on a web server without logging in. That is about as serious as website flaws get, because it can mean a stranger taking control of your site, adding spam pages, redirecting your visitors, or reading what is stored on the server.
The flaws were found by the cloud security company Wiz, using AI, and reported to the PHP team, who released fixes the same day. Several governments took websites offline as a precaution while they updated, including agencies in the Netherlands, Finland and Canada, and the UK’s National Cyber Security Centre published an alert telling organisations to update.
Those sites going offline does not mean they were hacked. Taking a site down until it is fixed is simply the cautious option for organisations that cannot update straight away.
Is my website affected?
Your website is probably affected if any of these are true:
- It is a WordPress site. If
yourdomain.co.uk/wp-adminshows a login page, it is WordPress, and WordPress runs on PHP. - It uses Joomla, Drupal, Magento or WooCommerce. These also run on PHP.
- A local developer built it years ago and it sits on shared hosting with a control panel such as cPanel or Plesk. Most sites like this are PHP.
Your website is probably not something you need to act on if:
- It is on Wix, Squarespace, Shopify or Google Sites. These platforms run their own servers and handle security for you. There is nothing you can update yourself.
- It is a static site, made of plain pages with no login area, hosted on a service like Cloudflare Pages or Netlify. With no PHP on the server, this flaw has nothing to attack.
If you are not sure which one you have, that is fine. Most owners are not. Our offer at the bottom of this guide covers exactly that.
What fixes it?
Only an updated version of PHP on the server. The fixed versions are:
| PHP branch | Fixed in |
|---|---|
| 8.5 | 8.5.12 or newer |
| 8.4 | 8.4.27 or newer |
| 8.3 | 8.3.36 or newer |
| 8.2 | 8.2.35 or newer |
Older versions are a problem. PHP 7.4, 8.0 and 8.1 are past their official end of life, so there are no ready-made releases for them, only code fixes that a host would have to build in themselves. PHP 5 and early versions of PHP 7 are not getting fixes at all. If your site is still on one of these old versions, the honest answer is that it needs moving to a supported PHP version, and that may need some WordPress or plugin updates first so nothing breaks.
Firewall services such as Cloudflare and Imunify360 have added rules that block known attacks. That helps, but the companies themselves say it is a stopgap, not a replacement for updating PHP.
What to ask your web host today
Send your host (or whoever looks after your website) something like this:
Hi, I have seen the news about the PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619. Please can you confirm which PHP version my website is running, and whether it has been updated to a fixed version (8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer)? If not, when will it be? Thank you.
Ask for the exact version number in the reply, not just “yes, we are on it”. A version number is something you can check against the table above.
If your hosting has a control panel, you can often see it yourself. In cPanel, look for MultiPHP Manager or Select PHP Version. If a fixed version is offered there, it is usually a one-click switch, but take a backup first, because very old themes and plugins sometimes do not like a newer PHP.
What if my host does not reply?
Give it a working day. Big hosts are dealing with a lot of customers this week. If you get no answer, or the answer is that your PHP version will not be fixed, you have three sensible options:
- Ask the host to move you to a supported PHP version. Most can do this, sometimes on a newer server.
- Put the site into maintenance mode or ask the host to suspend it until it is patched. A few days offline costs far less than a hacked site and a Google warning.
- Move the site. If your host is slow or your site is so old it cannot run a modern PHP, this is a good moment to move to better hosting or rebuild on something simpler.
How to check you have not already been hit
Once PHP is updated, have a quick look for anything odd:
- Users. In WordPress, go to Users and check every admin account is someone you know.
- Content. Look for pages, posts or links you did not add, especially in other languages or about pills, casinos or crypto.
- Redirects. Open your site on your phone, using mobile data rather than Wi-Fi, and from a Google search result. Some hacks only redirect visitors who arrive from Google.
- Google Search Console. If you have it, check the Security issues section.
- Your inbox. Look for any email from your host about malware or suspicious activity.
If anything looks wrong, tell your host straight away, then change your hosting, WordPress and email passwords. Changing them before PHP is updated does not help much, because the flaw does not need a password.
Why this matters for getting found
This is not only a security issue. A hacked site can be flagged by Google with a “This site may be hacked” warning in search results, which quietly kills enquiries, and it can take weeks to clear. AI assistants that pull information from your website can also pick up spam an attacker has added. A clean, up-to-date site is part of being found, not a separate job. We cover what Google and AI assistants read from your site in where AI assistants get local business info.
We can check this for you, free
If you are not sure what your website runs on, or what your host’s reply means, email us at [email protected] or use our contact form with your web address and the words “PHP check”. We will look at what your site runs on and reply in plain English within 1 working day: whether you need to act, and exactly what to ask your host. The check is free and there is no obligation.
If you would rather someone else handled it, switching your PHP version, updating WordPress and plugins so nothing breaks, and a basic check for signs of a break-in is covered by our Website Health Fix, a fixed £249, invoiced after the work is done. If we find signs your site has already been compromised, we tell you what we found and agree a price with you before doing anything else.
Frequently asked questions
Is my WordPress website affected by PHP2Shell?
Very likely, until your host updates PHP. WordPress runs on PHP, and the security firm that found the flaws says every PHP version back to 5.4 is affected by at least one of them. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Ask your host which version your site is running and whether it is one of those or newer.
Will updating WordPress or my plugins fix it?
No. The flaws are in PHP itself, the software on the server that runs WordPress, not in WordPress or its plugins. Only an update to PHP on the server fixes it. On most shared hosting that is done by your host, or by you choosing a newer PHP version in your hosting control panel.
Are Wix, Squarespace and Shopify sites affected?
On hosted builders like Wix, Squarespace and Shopify you do not manage the server, so there is nothing for you to update. The platform handles its own security. If you are worried, check the platform’s status page or help centre for a statement.
Has anyone actually been hacked through PHP2Shell yet?
At the time of writing (22 October 2026), some security firms report attack attempts, while the US cyber agency CISA said it had not yet seen the flaws exploited. Either way, the details are public and the fix is available, so the safe assumption is that unpatched sites will be targeted soon.
How do I know if my website has already been hacked?
Common signs are admin users you do not recognise, pages or links you did not add, visitors being redirected to other sites, a warning from Google that the site may be hacked, or an email from your host about suspicious activity. If you see any of these, tell your host straight away and change your passwords after PHP has been updated.