What happened
PHP is the programming language behind a huge share of the web, including WordPress, Joomla, Drupal and Magento. Two serious flaws were found in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell.
- No login needed: an attacker can run their own code on an unpatched server just by sending it web requests.
- Very widespread: every PHP version from 5.4 to 8.5 is affected, in every common setup that serves web pages.
- Confirmed in real attacks: attempts were seen before the fix was even published, and on 26 October CISA added both flaws to its list of vulnerabilities known to be exploited by attackers.
- It's not about plugins: the flaw is in PHP, so a fully up-to-date WordPress site can still be exposed if the server's PHP isn't patched.
The UK's National Cyber Security Centre (NCSC) is urging organisations to take immediate action, and the US cyber agency CISA says to patch immediately, or take PHP systems offline if they can't be patched.
Is my website affected?
If your website runs on PHP and its hosting hasn't been updated since 21 October 2026, assume it's at risk. The safe versions are:
- PHP 8.5.12 or later
- PHP 8.4.27 or later
- PHP 8.3.36 or later
- PHP 8.2.35 or later
PHP 8.1 and older are out of support and get no normal fix. If your site is still on one of these, it needs upgrading, not just patching.
How to check
- WordPress: go to Tools → Site Health → Info → Server to see the PHP version.
- Hosting control panel (cPanel, Plesk and similar): look for "PHP version" or "Select PHP version".
- Not sure who hosts it? Ask whoever built your website, or check who you pay for hosting.
What to do today
- Email your hosting company: “Has our server been patched for PHP2Shell, CVE-2026-109618 and CVE-2026-109619? Which PHP version are we on?” Good hosts will have already done it. Several large hosts have published statements.
- If you run your own server, update PHP to a fixed version and restart PHP (all workers), then confirm the version.
- If you can't patch quickly, consider taking the site offline or putting it into maintenance mode until you can. That's CISA's advice for unpatchable systems.
- Use a web application firewall as a stopgap. Cloudflare has added protection rules, including on its free plan, for traffic that goes through Cloudflare. It helps, but it isn't a fix.
- Update WordPress, themes and plugins too. They're not the cause, but don't give attackers a second way in.
Signs your site may already be compromised
- Strange redirects to other websites, especially on phones
- New admin users you didn't create
- Spam pages showing up when you search Google for
site:yourdomain.co.uk - Warnings from Google, your browser or your host, or a sudden slowdown
If you see any of these, read what to do if your website has been hacked. Patching stops new attacks, but it doesn't remove anything an attacker has already left behind.
The bigger lesson for small businesses
Most small business websites aren't hacked by someone targeting them. They're hit by automated tools scanning the whole internet for servers that haven't been updated. This flaw will be scanned for for years.
So ask: who is responsible for patching our website's server, and how would we know it's been done? If the answer is “not sure”, that's the real risk. A proper website care plan answers it.
For what it's worth, this website, and the starter sites we build, don't use PHP at all. They're pre-built pages served from Cloudflare's network, so there's no PHP server to patch. That isn't right for every business, but it removes a whole category of problem.
Not sure where you stand? Our £100 website audit checks your hosting, PHP version and security, or just ask us a quick question.
Sources
- NCSC: Critical security issue affecting PHP
- CISA alert: Critical Vulnerabilities in PHP Require Immediate Patching (21 October 2026)
- Tenable: php2shell frequently asked questions
- PHP's official release notes and advisory at php.net
Correct as of 27 October 2026. This is a fast-moving issue; follow your host's and PHP's latest advice.
