On October 21, 2026, the PHP security team released emergency updates for two critical vulnerabilities. Security researchers nicknamed them PHP2Shell, and government agencies, hosting companies, and security firms around the world have urged organizations to update quickly.
If your business has a website, there’s a good chance this affects you. The good news is that the fix is an update, and you don’t need to be technical to take the right steps. Here’s what happened, why it matters, and what to do this week.
What Is PHP2Shell?
PHP2Shell is the nickname for two security flaws, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 for severity, which puts them in the critical category.
In plain language, under certain conditions these flaws could let an attacker run their own commands on a web server without logging in. That’s called remote code execution, and it’s one of the most serious types of vulnerability because it can give an attacker control of the server itself.
The key detail is where the flaws live. They’re in PHP itself, the programming language running behind the scenes, not in a single plugin, theme, or website. That means even a well-maintained website could be exposed if the PHP on its server hasn’t been updated.
Why This Matters for Small Business Websites
PHP is one of the most widely used technologies on the web, estimated to power around 70% of websites. That includes WordPress, which runs on PHP, along with many online stores, booking systems, and custom business sites.
If an attacker gained control of a web server, they could potentially:
- Steal customer information or contact form submissions
- Install malicious code or hidden backdoors
- Redirect visitors to scam sites or display unwanted content
- Use your server to attack others or send spam
Security firms also reported exploitation attempts around the time patches were released, and exploit code has reportedly circulated. That’s why the guidance has been to update now rather than wait for a convenient moment.
Which PHP Versions Are Patched
The PHP team released fixes in these versions:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
For older versions that no longer receive regular support (PHP 7.4, 8.0, and 8.1), the team released limited emergency fixes aimed at people who build PHP from source or use long-term support vendors. If your site runs on one of these older versions, this is a strong reason to move to a currently supported version.
What to Do Right Now
You may not manage PHP yourself, and that’s fine. Here’s a simple order of action:
- Find out where your websites run. List every site and web application your business uses, including old ones, and note who hosts each one.
- Check your PHP version. The next section shows how to do it in WordPress.
- Contact your host or web developer. Ask whether PHP has been patched against CVE-2026-109618 and CVE-2026-109619.
- Back up before updating. Make sure you have a recent, working backup of your files and database.
- Update PHP. On managed hosting, your provider may handle it. On other plans, you can often change the PHP version in your hosting control panel.
- Test your site afterward. Check key pages, forms, checkout, and logins to make sure everything still works.
One important caution: don’t rely on the version number alone. Some hosting providers apply security fixes to their packages without changing the visible version number to match the official release. The most reliable approach is to ask your host to confirm the patch directly.
How to Check Your PHP Version in WordPress
If your site runs on WordPress:
- Log in to your WordPress dashboard
- Go to Tools, then Site Health
- Click the Info tab
- Open the Server section and look for PHP version
Compare it to the patched versions above, and share it with your host if you’re unsure.
Patching Doesn’t Remove an Existing Infection
Updating closes the door, but it doesn’t remove anything an attacker may have already left inside. Because exploitation attempts were reported around the time of disclosure, it’s worth watching for warning signs:
- New administrator accounts you don’t recognize
- Unfamiliar files or code in your website folders
- Your site suddenly slowing down or redirecting visitors
- Warnings from your host, browser, or search engine about your site
- Unexpected spam emails sent from your domain
If you notice any of these, restore from a clean backup if you have one, change all passwords, and bring in a professional to scan and clean the site.
The Bigger Lesson
PHP2Shell is a reminder that website security isn’t only about plugins and passwords. The software underneath your site needs regular updates too, and the businesses that handle moments like this well are the ones that already know where their sites live, who manages them, and who to call.
If you don’t have those answers yet, now is a good time to write them down.
Final Thoughts
You don’t need to panic, but you shouldn’t wait. Check your PHP version, ask your host to confirm the patch, and keep an eye out for signs of trouble. A small amount of attention this week can prevent a much bigger problem later.
Frequently Asked Questions
What is PHP2Shell? It’s the nickname for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could let attackers run code on a web server without logging in.
Does PHP2Shell affect WordPress sites? WordPress runs on PHP, so a WordPress site on an unpatched PHP version could be exposed. The flaw is in PHP itself, not in WordPress or any plugin.
Is my website at risk if I use managed hosting? Possibly, but many managed hosts handle PHP updates for you. Ask your provider to confirm that the patch has been applied.
Can I fix it by updating my plugins? No. Plugin updates won’t fix this, because the vulnerabilities are in PHP on the server. The PHP version itself needs to be updated or patched.
How do I know if my site has already been hacked? Watch for unknown admin accounts, unfamiliar files, redirects, sudden slowdowns, or warnings from your host or browser. If you’re unsure, ask a professional to scan the site.
Not Sure If Your Website Is Protected?
Venice Web Design can check your hosting, confirm your PHP version, and make sure your website is secure and up to date.
Book a free consultation to have your website security reviewed.
