On 21 October 2026, the people behind PHP released an urgent security update for two critical flaws, nicknamed PHP2Shell. If your website runs on WordPress, or almost any other popular content management system, it runs on PHP. So this one is worth five minutes of your time.
Here’s what’s going on, in plain English, and exactly what to do about it.
What is PHP2Shell?
PHP is the programming language that powers a huge share of the web, including every WordPress site. PHP2Shell is the name given to two flaws in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619.
In the worst case, they could let an attacker run their own code on the server that hosts your website, without needing a password. Both are rated critical, and researchers at Wiz found that every PHP version released in the last decade is affected by at least one of them.
Security teams have also reported attempts to exploit the flaws around the time they were made public, so this isn’t a problem to leave until next month.
Why updating WordPress won’t fix it
This is the part that catches people out. The flaw is in PHP, which sits underneath WordPress on your web server. Updating WordPress, your theme or your plugins won’t touch it, and no security plugin can patch it for you.
The fix has to be installed on the server itself, which usually means your hosting company.
What to do today
1. Check which version of PHP your site uses. In WordPress, go to Tools, then Site Health, then Info, and open the Server section. You’ll see the PHP version listed there.
2. Check whether it’s a patched version. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or anything newer on those branches.
3. Ask your host for written confirmation. If you’re on shared or managed hosting, send your host a quick message: “Can you confirm the PHP version running my site is patched for CVE-2026-109618 and CVE-2026-109619, and when it was patched?” Many hosts moved quickly, but not all had finished at the last report, so don’t assume.
4. If you’re on an old version, plan a move. If your site is running PHP 8.1 or older, ask your host or developer about moving to a supported version, and test it on a staging copy of your site first. PHP 7.4 stopped receiving official support back in 2022, so it’s well overdue.
5. If you manage your own server, update your PHP packages and restart PHP-FPM for every PHP version you run. The Qualys write-up covers the details.
6. If anything looks odd, such as new admin users, unfamiliar files or strange redirects, speak to your host or developer straight away. Restoring a clean backup from before the flaw was announced, onto a patched server, and changing your passwords is the safest route.
The bigger lesson
Most small business owners never think about what their website runs on until something like this happens. That’s fair enough: you’ve got a business to run. But it’s a good reminder to know three things about your site:
- Who hosts it, and how they handle security updates.
- Who’s responsible for keeping it updated, whether that’s your host, your developer or you.
- Whether you have recent backups, and how to restore them.
It’s also worth knowing that not every website runs PHP on its server. Some modern websites, including this one, are built as fast, static pages with no PHP running behind them, so flaws like PHP2Shell simply don’t apply. That isn’t the right fit for every business, but it’s one reason we build lightweight websites where it makes sense.
Not sure where you stand?
If you’d rather not dig through server settings, get in touch and tell us your website address. We’ll take a look and give you an honest answer on whether you need to do anything, with no hard sell.