If you've seen headlines about a flaw that put "half the internet" at risk, they're talking about PHP2Shell. Here's what you need to know if you run a website, without the jargon or the panic.
What happened
PHP is the language that powers most of the world's websites, including every site built on WordPress, Joomla or Drupal. On 21 October 2026, two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) were disclosed and named PHP2Shell.
What makes them serious: they let an attacker take full control of the server hosting your site without a password, and without anyone clicking anything. With that access they can alter your site, steal data, or use your server to attack others.
This one deserves attention — active exploitation attempts were seen even before the flaw was publicly disclosed.
Is my website affected?
It is if both of these apply:
- Your site runs PHP. If it's on WordPress, almost certainly yes.
- The server is running an unpatched PHP version. The flaw affects PHP 5.4 through 8.5.
Sites that don't use PHP on the server — many static sites and custom-built sites using other technologies — are not affected by this specific flaw.
How to check
- On WordPress: log in to the dashboard and go to Tools → Site Health → Info → Server. Your PHP version is listed there.
- In your hosting control panel (cPanel, Plesk, or your host's own panel): look for a "PHP Version" or "PHP Selector" section.
The patched versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12 or later. If your version is below those within its branch, your server is unpatched.
Versions 7.4, 8.0 and 8.1 are past end-of-life: they received code-level fixes but no installable release. If your site is still on one of these, now is the time to move to a supported branch.
What to do today
- Contact your hosting provider and ask whether they've applied the PHP2Shell patch on your server. On shared hosting, the host updates PHP, not you. Many have already done so.
- If you manage your own server, update PHP to a patched version as soon as possible. If you can't do it immediately, consider taking the site offline temporarily — that's what many organisations did while patching.
- Check for signs of intrusion, because patching doesn't undo an attack that already happened. Look for:
- admin users you don't recognise;
- new files or plugins you didn't install;
- unexpected redirects, ads, or spam links on your site;
- security warnings in Google Search Console.
- Change passwords for your site dashboard, hosting panel and database if you have any suspicion.
- Make a backup before touching anything, and make sure you have backups predating 17 October in case you need to restore.
- Update WordPress, your theme and plugins while you're at it. That doesn't fix PHP2Shell, but it closes other doors.
If you use a web application firewall like Cloudflare, it helps as a temporary measure, but it does not replace updating PHP.
The bigger lesson
A website isn't something you build once and forget. Behind it sits a server, a language runtime, plugins and a hosting environment — all of which need ongoing updates. Sites with active maintenance contracts were patched within hours; neglected ones, at best, are still exposed.
If you want to understand when WordPress is the right choice and when a custom-built site makes more sense, we cover that in our web development pages.
Need a hand?
If you're not sure whether your site is affected, or you don't have anyone looking after it, we can help: we check the PHP version, talk to your hosting provider, look for signs of intrusion, and get everything updated. We also offer ongoing web maintenance so you're not in this position next time, and consulting if you need a broader review.
Get in touch and we'll take a look.
FAQ
Is my WordPress site at risk?
If the server it's hosted on hasn't been patched, yes. Ask your hosting provider whether they've applied the PHP2Shell fix.
My host says they've patched it. Do I need to do anything else?
It's worth checking that there are no unfamiliar admin users, files, or redirects — attacks were happening before the patch existed. If everything looks normal, you're fine.
Can a security plugin fix this?
No. The flaw is in PHP itself, below WordPress. A plugin can help detect intrusions, but the fix is updating PHP.
Are sites that don't use PHP safe?
From this specific flaw, yes. That doesn't mean they need no maintenance — every site has components that need updating.
This article is for information only and reflects what was published up to 27 October 2026. We'll update it if anything changes.