What happened
On October 21, 2026, the team that maintains PHP released emergency fixes for two critical security flaws, CVE-2026-109618 and CVE-2026-109619, which researchers nicknamed PHP2Shell. PHP is the behind-the-scenes programming language that assembles a web page each time a visitor loads it. It powers WordPress, Drupal, Joomla and an estimated 70% of all websites, so most business owners rely on it every day without ever seeing it.
A CVE number is the official tracking ID security teams around the world use to refer to one specific flaw. Both of these scored 9.2 out of 10 on the industry’s standard severity scale, called CVSS, which places them in the critical range. Either one lets an attacker take control of a web server, the computer that stores your website and delivers it to visitors, by sending a single specially built web request. No password or account is needed, because the attack arrives through the same front door as an ordinary visitor.
The bugs sit in PHP’s core engine, the part every PHP website shares, so it makes no difference whether the site is a WordPress blog or a custom booking page. They involve how PHP cleans up after a request crashes from running out of memory, the short-term workspace a server uses while it builds a page. A crash can leave scraps behind for the next request to pick up. The same weakness lets attackers read whatever else is sitting in that workspace, including passwords, login sessions and API keys, the digital keys websites use to connect to services like payment processors.
Researchers at the security firm Wiz found the flaws in August with help from AI tools and reported them privately to PHP, giving the team time to build a fix before anything went public. Some of the vulnerable code is more than a decade old.
No confirmed break-ins had been reported as of publication, but Cloudflare, a company that filters traffic for millions of websites, has seen attack attempts against its customers. The NSA and FBI told organizations that cannot install the fix promptly to take those systems offline. Criminals rarely get a master key that fits most of the internet, and right now they are jiggling every doorknob they can find.
Who needs to act
Your next step depends on who runs the server behind your website. Updating WordPress or your plugins will not fix PHP2Shell, because PHP sits one layer underneath them, the way a building’s wiring sits behind the paint. Whoever controls the server controls the fix.
Fully managed platforms take care of the server for you. WordPress.com, WordPress VIP, WP Cloud and Pressable announced on October 21 that their customers were already protected. If you use another website builder or managed host, look for a PHP2Shell notice on its status page or blog.
Shared hosting, where your site rents space on one server alongside many other customers’ sites, needs a closer look. So does a virtual private server (VPS), where you rent a whole virtual computer and usually maintain it yourself, and so does any site an IT vendor or web designer set up for you. Log into your hosting dashboard, the control panel most of us only visit to pay the bill, and look for the PHP version. You can also send your host this question: “Have you installed the October 21 PHP security release on my server, and which PHP version am I running now?”
Ask for the version number in writing. A reply that only says “protected” may mean the host placed a web application firewall in front of your site, a filter that recognizes and blocks attack traffic before it reaches the server, while the actual update is still on its way. That keeps you safe today, and it is worth checking again next week that the update itself has landed.
Compare your version number to the table below. You are covered once your version matches or passes the number on the right.
| Your PHP version starts with | Fixed once it reads at least |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
| 8.1 or lower | PHP no longer supports these versions and issued no official fix. Some Linux providers released unofficial repairs that keep the same version number, so get written confirmation from your host and plan a move to 8.2 or newer. |
PHP also hides in places owners forget, and each of these runs on a server that needs the update:
- An old version of your website still online at a different address
- A staging site, the test copy a designer builds before launch, still running long after the launch party
- A customer portal, booking tool or payment page a vendor installed for you
- A parked domain, an extra web address you own that shows a placeholder page
Your PHP2Shell checklist for this week
- List every website and web tool tied to your business. Include old sites, test copies and anything a vendor hosts for you, like an online booking or payment page.
- Confirm each one runs a fixed PHP version, using your hosting dashboard or a written answer from your host.
- Update anything still unpatched today. If the update can’t happen right away, ask your host to put a web application firewall in front of the site, or take the site offline until the fix is in. A few days of “back soon” costs far less than a hijacked server.
- Change the passwords and API keys for any site that was online and unpatched after October 21. Start with the database password (the key your website uses to open its own stored records), then the admin logins for the site and the hosting account, then any keys that connect the site to your payment processor or email service. This flaw can read secrets out of server memory, so treat those as possibly exposed.
- Ask whoever manages your server to review its logs, the running record of every visit and error the server handles. Wiz lists these warning signs: repeated “500” errors (the generic “something went wrong” page), out-of-memory errors, unusually large session cookies (the small ID tag a site uses to remember a logged-in visitor), and PHP processes restarting for no clear reason. If any of them show up, call for help before you change anything else, so the evidence stays intact.
Protecting your business beyond this patch
Expect the fake “urgent patch” email
Big security news is a gift to phishing crews, the scammers who send fake messages built to trick you into clicking a link, typing in a password or paying for something. Scammers read the headlines too, and they type faster than they spell. Over the next few weeks, expect emails and texts dressed up as your web host, your IT vendor or WordPress, warning that your site will be shut down unless you log in or pay for an emergency fix. Your real host does not need your password to patch a server it already runs. When a message pushes you to act fast, slow down and breathe, then reach your hosting account by typing the address yourself or calling the number on your last invoice.
Put updates on autopilot
A security update, often called a patch, repairs a flaw the software maker already knows about. Attackers lean heavily on flaws that already have a patch available, because so many businesses never install it. Turn on automatic updates for your website software, plugins, computers and phones, and restart when they ask. If a host or IT vendor handles updates for you, ask how quickly they install critical security releases and get that promise written into your contract.
Lock down the accounts that control your money and your website
Multi-factor authentication (MFA) means a login asks for a second proof beyond your password, so a stolen password alone won’t get anyone in. Turn it on for your business email, bank, payroll, hosting account and domain registrar, the company where you registered your web address. An authenticator app on your phone, which shows a fresh six-digit code every 30 seconds, holds up far better than a code sent by text message, because criminals can hijack a phone number. A physical security key you plug in or tap is stronger still. Whoever controls your email can reset nearly every other password you have, so give it the strongest protection available.
Keep backups you can actually restore
A backup is a saved copy of your website and business files that you can roll back to if something is damaged, deleted or locked up by ransomware, the malicious software criminals use to scramble your files and demand payment. Keep at least one copy somewhere an attacker on your server can’t reach, such as a separate cloud account or a drive you unplug after each backup. Once a quarter, restore a file or a copy of your site to prove it works. A backup you have never restored is a hope with a file extension.
Verify before money moves
Attackers who break into a server or an inbox often go after payments next, sending fake invoices or “updated” bank details that appear to come from a real vendor. Before you change a vendor’s banking information or send a wire transfer, call the vendor at a phone number you already had on file, never one included in the request. Fraudsters love a wire transfer almost as much as they hate a phone call. Once a wire leaves your account, getting it back becomes a race against the clock.
Know who you will call
An incident response plan is a short written guide to who you call and what you do when something goes wrong. Write down, on paper, who manages your website and IT, your bank’s fraud line, and the first steps you’ll take if your site is hacked or money goes missing. Walk through it once with your team, snacks optional but encouraged. The first hour of an incident goes far better when nobody is hunting for a phone number.
Need a hand?
If you are not sure who runs your server, your host’s answer reads like a riddle, or an “urgent patch” email has you second-guessing, contact Countervail. Our licensed investigators help small businesses with security awareness training, tabletop exercises (a guided practice run of a cyberattack, worked through around a conference table), written incident response plans, and cybercrime investigations when something has already gone wrong.
Sources:
Wiz Research, PHP2Shell: https://www.wiz.io/blog/php2shell-php-rce
PHP news archive, 2026: https://www.php.net/archive/2026.php
Laravel Forge, PHP security advisory with fixed versions: https://laravel.com/forge/docs/knowledge-base/php-security-release-october-2026
Automattic, Oct 21, 2026: https://automattic.com/2026/10/21/your-sites-are-protected-against-the-php2shell-vulnerabilities/
WordPress.com, Oct 21, 2026: https://wordpress.com/blog/2026/10/21/php2shell-vulnerabilities/
WEAR, Oct 21, 2026: https://weartv.com/news/nation-world/critical-php-flaws-put-millions-of-websites-at-risk-as-governments-pull-sites-offline
TweakTown, Oct 21, 2026: https://www.tweaktown.com/news/114213/nsa-warns-70-percent-of-websites-to-install-the-latest-php-patch-now-or-go-offline/index.html
The Conversation: https://theconversation.com/php-is-in-the-foundation-of-70-of-websites-heres-what-it-is-and-why-a-flaw-in-the-software-is-a-major-hacking-threat-294999