Security
PHP2Shell: the PHP security flaw, and what website owners need to do
Ewan Milroy5 min readIf your business website runs on WordPress, it runs on PHP. This week PHP had two of the most serious security flaws it has seen in years, and every website that uses it needs to be on a fixed version.
Here's what happened, how to tell whether your site is affected, and what to do about it, depending on how your site is hosted.
What happened
On 20 October 2026, details of two flaws in PHP leaked online before the fixes were ready. They have since been named PHP2Shell, and tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 for severity.
In plain English: someone on the internet could run their own code on the server behind your website, without logging in. That can mean a defaced site, stolen customer details, or your server quietly being used to send spam.
The PHP team released fixed versions on 21 October:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
PHP 8.1 and older are no longer supported, so they get no official fixed release. A site still on one of those needs to move to a newer version.
When the US cyber security agency CISA issued its alert on 21 October, it had not seen the flaws being used in attacks yet. A working exploit already exists, though, so that window won't stay open long.
Is my website affected?
Probably, if your site is:
- WordPress, including WooCommerce shops
- Joomla, Drupal or another PHP-based system
- A custom site a developer built in PHP
Probably not directly, if your site is on Wix, Squarespace or Shopify. Those platforms run the servers themselves, and patching is their job. The same goes for a static site with no PHP at all.
Not sure what yours runs on? If you log in at an address ending in /wp-admin, it's WordPress.
What to do, depending on how your site is hosted
Shared hosting with a control panel (a typical low-cost plan with cPanel or similar). Your host updates the server, so check their news page or support notices to confirm they've patched. Then log in to the control panel and check which PHP version your site is set to use. If it's 8.1 or older, it won't get the fix. Move it to 8.3 or 8.4, then check the site still works.
A server or VPS that you or your developer manage. Nobody else will patch it. Update the PHP packages, restart PHP, and confirm the version numbers match the list above. Turn off any old PHP versions that no site is using. They'll never be fixed, so there's no reason to leave them running.
Managed WordPress hosting. Most managed hosts patch automatically. Look for a notice from them confirming it, rather than assuming.
Behind Cloudflare. If your site's traffic runs through Cloudflare's proxy, Cloudflare has added firewall rules for the known attacks. That's a useful extra layer while you patch, not a replacement for patching. It only applies if the proxy is switched on, so a site using Cloudflare just for DNS gets no protection from it.
How to check yours
In WordPress, go to Tools, then Site Health, then the Info tab, and open Server. It shows the PHP version your site is running. You're looking for one of the fixed versions above, or newer.
If you can't get in, or the version is older, ask whoever looks after your website these three questions in writing:
- Which PHP version is my site running, and is it one of the fixed versions?
- When was the server patched?
- Are there any older PHP versions still running on the server?
A clear answer to all three, with dates, is what good looks like.
What I did for the sites I look after
The websites I host were patched on the morning of 22 October, the day after the fix came out. I confirmed every site runs on a fixed version, switched off the old PHP versions none of them use, restarted the server onto its latest updates, and checked each site afterwards.
None of that needed the business owners to do anything, which is the point. Patching quickly when something like this lands is a big part of looking after a website, and it's the part cheap hosting usually leaves to you.
If you're not sure who's responsible for your website's security, or you'd rather it was someone you can call, that's what Website Care is for.
Sources
Not sure your website is patched?
Send me your web address and I'll tell you what it runs on and whether it's on a fixed PHP version. Or let me look after it from here on.