On October 21, 2026, the PHP project released emergency security updates for two critical flaws in PHP, the programming language behind a large share of business websites. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and security researchers have nicknamed the pair PHP2Shell. Sites built on WordPress, Drupal, Magento, Joomla, and Laravel all run on PHP, so this reaches many owners who have never had a reason to think about it.
This article covers what happened, where the risk sits, and what to ask the people who run your website. The response is not complicated. It does need a named owner and a deadline.
What Is the PHP2Shell Vulnerability and Does It Affect My Website?
TL;DR: Two critical flaws in PHP, each rated 9.2 out of 10 for severity, can let an attacker run commands on a web server without logging in. The flaws sit in PHP itself, not in WordPress or any plugin, so only a PHP update on your server fixes them. The fixed versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Ask your host or developer today which version your site runs and the date the fix was applied. PHP 8.1 and older no longer receive official updates and need a vendor fix or an upgrade.
What Happened With the PHP Vulnerability
PHP’s security team announced on October 20 that a critical release was coming. Details of the flaws became public before the planned date, and the fixes shipped on October 21. PHP’s security advisory says every installation serving web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The team rates the risk highest for Apache with mod_php, where a demonstrated exploit lets an unauthenticated request trigger the attack before any application code runs.
Google Cloud’s advisory lists the affected range as PHP 5.4 through 8.5.11. PHP is used by about 71 percent of the websites whose server-side language W3Techs can identify, based on its July 2026 data. A flaw in the language reaches well beyond any single platform.
Where the Real Risk Sits for Business Owners
The Problem Sits Underneath WordPress
The flaws are in the PHP interpreter, the software layer your hosting server uses to run your website. Updating WordPress, a theme, or a plugin changes the application. It does not change the PHP version running underneath it. The fix has to come from whoever manages the server, whether that is a hosting company, an IT vendor, or a developer.
What an Attacker Could Gain
PHP describes the flaws as unauthenticated remote code execution, which means a stranger could run code on the server. Qualys also reports that researchers have demonstrated reading the memory of PHP processes, which can hold passwords, authentication tokens, and API keys. For a business, the exposure can range from a defaced or redirected website to stolen credentials that open other systems.
How Much Attack Activity Is Confirmed
Reports differ. CISA said at the time of its October 21 alert that it had not observed exploitation. Cloudflare reported attack traffic targeting its customers before the official release and said attackers were changing their payloads to get around its protections. An attempt is not a successful breach, but it shows these flaws are being tested against real websites.
Steps to Take This Week
Find Out Which PHP Version Your Site Runs
In WordPress, open Tools, then Site Health, then the Info tab, then Server. Most hosting dashboards show the version as well. A version number does not tell the whole story, because vendors sometimes apply the fix to an older version number. A status update from the host that lists what was changed and when gives you a clear record.
Ask Your Host for a Status Update
Ask whether the fix for both CVE numbers is installed and whether PHP has been restarted. An update that is installed but not restarted can leave the old code running. Host patch schedules were still moving on October 21, so check the host’s status page and ask for an update that names the PHP version and the date of the change.
Treat PHP 8.1 and Older as an Urgent Project
PHP says versions 8.1 and older no longer receive updates from the project. Some distributions and long-term support vendors provide backported fixes, and the PHP team released limited source patches for 7.4, 8.0, and 8.1. The practical choices are a vendor-supplied fix or an upgrade to a supported version. PHP 8.2 reaches end of life on December 31, 2026, so it belongs in the same plan.
Treat a Firewall as a Stopgap
Cloudflare put protective firewall rules in place for its customers on October 21. PHP’s advisory is direct that temporary measures reduce exposure to specific attack paths and do not make an installation safe. Only the update is a complete solution.
Have Someone Check for Signs of Compromise
Because attack traffic was reported before patches were available, ask your developer to review server logs and recently changed files going back to at least October 20. Ask them to look for unfamiliar administrator accounts and to rotate passwords and API keys stored on the server if there is any reason to suspect exposure.
What to Say to Your Host, Developer, and Marketing Team
Your Host or IT Vendor
Ask which PHP version each of your sites runs, whether the fix for CVE-2026-109618 and CVE-2026-109619 is installed, and whether PHP was restarted afterward. If the answer involves PHP 8.1 or older, ask for the upgrade or backport plan with a date. Ask them to share their status update or ticket record for your account.
Your Developer or Website Manager
Ask where else PHP runs. Staging copies, old sites, subdomains, and microsites often sit on the same machine, and Qualys notes that updating the main installation can leave other vulnerable copies behind. Ask for the update to be tested before it goes live, because a patched PHP can end a worker process abruptly under memory pressure, and forms, logins, and checkout need to be confirmed working afterward. Our web development work follows the same principle: the site is not finished until someone verifies it.
Your Marketing Team or Agency
Marketers do not patch servers, but they own landing pages, campaign sites, forms, and tracking. Ask for a complete list of every site and page the business runs, including any hosted apart from the main website. Ask them to watch analytics and reporting for unexpected traffic changes, redirects, or pages nobody created. If a site is suspected of compromise, ask them to pause paid advertising that sends visitors to it.
What Brevard SEM Is Doing for Clients
For the websites we develop, our response follows the same sequence we recommend to owners. The steps below describe our process. They are not a guarantee of any outcome.
Inventory and Version Check
We list every client site we built, including staging copies, subdomains, and microsites, and identify the PHP version each one runs and who controls its hosting. Sites on PHP 8.1 or older are flagged for an upgrade or vendor-fix plan.
Update, Restart, and Verify
Where we manage hosting or maintenance, we apply the vendor-released fix, restart PHP, and confirm the running version afterward. Where a client’s own host or IT vendor controls the server, we coordinate with them and report what the provider confirms, because we cannot patch infrastructure we do not control.
Test and Review
After each update we check forms, logins, and checkout, then review logs and recent file changes back to October 20 for anything unexpected. If something looks wrong, we tell the client and recommend rotating credentials stored on the server.
Why Established Businesses Need an Owner for PHP Updates
A website is a stack: the content, WordPress or another platform, the plugins, the hosting, and PHP underneath. Many businesses assume someone is covering the bottom layer, and often nobody has been asked to. Assign a name to it. That person should know the current PHP version, the date it was last updated, and who confirms the work was done. CISA urged organizations to patch immediately, and a critical flaw deserves a response measured in days.
The marketing stakes are real too. A compromised site puts the visibility built through search engine optimization at risk, because search engines and browsers can warn visitors away from sites they detect as compromised. Prevention costs far less than recovery.
Frequently Asked Questions
Is WordPress affected by the PHP vulnerability?
WordPress runs on PHP, so a WordPress site on an unpatched PHP version is exposed. The flaw is in PHP, not in WordPress, which means a WordPress update does not fix it. A PHP update on the server does.
Which PHP version fixes PHP2Shell?
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Sites on PHP 8.1 or older need a fix from their hosting or support vendor, or an upgrade to a supported version.
Has the PHP vulnerability been exploited?
Reports differ. CISA had not observed exploitation when it published its alert on October 21, while Cloudflare reported attack traffic aimed at its customers. Attack attempts do not confirm successful breaches, but they are reason enough to update promptly.
Do I need to act if I use managed WordPress hosting?
Managed hosts generally update PHP on the customer’s behalf, but patch timing varied by host on October 21. Ask the host for a status update showing the PHP version and the date the fix was applied to your site.
Can a firewall protect my website from PHP2Shell?
A firewall can reduce exposure to known attack paths, but PHP’s advisory states that such measures do not make an installation safe. Updating PHP is the only complete fix.
Business owners who want an outside review of where their website stands can start with a conversation.
