The short version: on 21 October 2026 the PHP project released emergency fixes for two critical flaws nicknamed PHP2Shell. They let an attacker run code on a web server without logging in, and attacks were seen before the patches came out. If your website runs on WordPress or anything else built with PHP, ask your web host today which PHP version you're on.
What happened
The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and both score 9.2 out of 10 on the CVSS v4 scale. Both come from the way PHP handles a request that ends abnormally, which can leave memory in a state an attacker can abuse.
They affect PHP installations that serve web pages, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP project said the risk is highest for mod_php, and researchers showed a working attack on it.
Cloudflare's chief technology officer said the company was already seeing early attacks before the fixes shipped, and the UK's National Cyber Security Centre told organisations to update systems that use PHP or take them offline until they're patched.
The fixed versions are:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
PHP 8.1 and older don't get official updates any more. The PHP project published minimal backports for 7.4, 8.0 and 8.1, but those are for people who compile PHP themselves, which almost no small business hosting does.
Is my website affected?
It depends on what your website runs on, not on how big your business is.
| Your website | Exposed to PHP2Shell? | Who has to act |
|---|---|---|
| WordPress on shared or managed hosting | Yes, until PHP is updated | Your web host |
| WordPress on your own VPS or server | Yes, until PHP is updated | You or your developer |
| Other PHP software (Joomla, Drupal, WooCommerce, custom PHP) | Yes, until PHP is updated | Your host or developer |
| Wix, Squarespace or Shopify | No | The platform, nothing for you to do |
| A static site on Cloudflare, such as Astro | No, there's no PHP running | Nobody |
Most UK small business owners on WordPress don't run their own server, so the patch is in your host's hands. Good hosts will have updated already. The point of asking is to be sure, and to find out if you're stuck on a version that won't get a fix.
What to do this week
- Ask your host which PHP version your site runs on. You want 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer. The email below does the asking for you.
- If you're on PHP 8.1 or older, plan an upgrade now. There's no official PHP2Shell fix for those versions. Test on a staging copy first, because old themes and plugins can break.
- Update WordPress, your theme and every plugin. PHP2Shell isn't a plugin problem, but a server that's being probed is the worst time to be running an old plugin with a known hole.
- Look for signs of a break-in. Check for admin users you don't recognise, new files you didn't upload and any warning in Google Search Console under Security issues. Kaspersky advised checking server logs from 20 October onwards for the web server starting programs it normally wouldn't.
- Make sure you have a backup stored away from your hosting. If the worst happens, a clean copy from before 20 October is what gets you back online quickly.
The email to send your web host
Copy this, add your domain and send it to your host's support address:
Hello, my website is example.co.uk. Following the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) patched on 21 October 2026, could you confirm which PHP version my site runs on, and that it has been updated to 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later? If my site is on PHP 8.1 or older, please tell me what my options are for moving to a supported version. Thank you.
A clear, dated answer is what you're after. If the reply is vague, or the host can't tell you the version, that tells you something about how your site is looked after.
What comes next
PHP2Shell won't be the last warning. PHP 8.2 stops receiving security updates on 31 December 2026, so sites on 8.2 have about two months before they need to move again. And PHP is only part of the picture. Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, 42% more than in 2024, and 91% of them were in plugins. Almost half had no fix available when they were made public.
None of that means WordPress is a bad choice. It means a WordPress site needs someone keeping it updated, every month, for as long as it exists. If you've got that covered, through your host, a developer or a plan like our Website Care, you're in a good position.
If you don't want a server to worry about at all, a static site has nothing for PHP2Shell to attack. We explain how that works, and when it isn't the right fit, on our WordPress alternative page. Our free AI visibility audit also checks your PHP version and plugins.
