PHP2Shell: Is Your Business Website Affected, and What to Ask Your Web Host

If your business website runs on WordPress, WooCommerce, Joomla or Drupal, or sits on a shared hosting plan with cPanel, it almost certainly runs on PHP. On 21 October 2026 (UTC, which was early on 22 October in eastern Australia) the PHP project released fixes for two critical flaws that researchers have named PHP2Shell.

You don't need to understand the technical detail to act on this. You need to know whether your site uses PHP, who looks after the server it runs on, and what to ask them. This post covers all three, with a message at the end you can copy and send.

Quick answer: If your site runs on PHP, ask your web host or developer today whether PHP has been updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to a vendor build that includes the fixes for CVE-2026-109618 and CVE-2026-109619. If you're on PHP 8.1 or older, ask what their plan is, because the PHP project no longer updates those versions. Check you have a recent backup stored away from the server. If your site is on Squarespace, Wix or Shopify, the platform runs the servers and patching is their job.

What happened

PHP is the programming language that runs a large share of the web's websites. The PHP project's security advisory says the new releases "fix two critical vulnerabilities that can allow unauthenticated remote code execution". In plain terms: someone who has no login to your site could, under the right conditions, run their own commands on the server it lives on.

Both flaws sit in PHP itself, not in your website's code. Wiz Research, one of the teams that found them, says nearly every PHP version is affected by at least one of the two, going back to PHP 5.4, and that a well-written site does not protect you. The PHP project says every PHP installation serving web requests is at risk, and it rates the risk highest for one common server setup (Apache with mod_php).

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer get updates from the PHP project. Some Linux distributions and support vendors provide their own fixes for older versions, and the PHP project has published minimal source fixes for 7.4, 8.0 and 8.1 to help, but the project's advice is to get a vendor fix or upgrade.

Is anyone attacking sites with it?

The sources we read don't agree on exactly how far this has gone, so here is what each says.

• The Hacker News reports that Cloudflare saw early attack attempts and that the security firm watchTowr reported active exploitation attempts of both flaws on 21 October. It also says no source had confirmed a successful break-in on a specific server at the time it was updated.
• Qualys says Cloudflare has reported attack traffic targeting the flaws, and that researchers have shown working attacks.
• The PHP project's advisory and the UK's National Cyber Security Centre don't say attacks have been seen. The NCSC says it is monitoring for impact.

Our reading: attempts are happening, which is reason enough to patch now, but there is no need to assume your site has been broken into.

Does your website run on PHP?

Work through this list.

• WordPress or WooCommerce. Yes. WordPress is written in PHP and WooCommerce runs inside WordPress. Wiz demonstrated the attack against WordPress, Drupal and Joomla setups.
• Joomla or Drupal. Yes, both are PHP.
• Shared hosting with cPanel or Plesk. Very likely. These plans are built to run PHP sites. If you log in to cPanel there is usually a setting that shows your PHP version.
• Squarespace, Wix, Shopify and similar hosted builders. You don't run the server. The platform does, so updating it is their responsibility, not yours. Anything you've added that runs elsewhere, such as a separate WordPress blog on its own hosting, still needs checking.
• A custom site a developer built. Ask them. Many are PHP (Laravel and Symfony are PHP frameworks), many are not.
• Not sure. Ask whoever sends you the hosting invoice. That person or company is the one who needs to act.

PHP also turns up inside other products, so the NCSC suggests checking with the vendors of anything you run that might bundle it, such as a booking system or a customer portal you host yourself.

What to do this week

1. Ask your host or developer whether PHP has been updated. Managed WordPress hosts may have done it already. On a cheaper shared plan you may need to ask. If you manage your own server, update PHP and restart every PHP process so the new version is the one running.

2. Watch for an answer that quotes an old version number. Qualys and The Hacker News both point out that Linux distributions often add the fix to an older version without changing the number. A host saying "we're on 8.1" isn't automatically bad news, but they should be able to say their package includes the fixes for the two CVE numbers.

3. Update WordPress, your theme and your plugins. This doesn't fix PHP2Shell, since the flaw is in PHP. It's still worth doing while you're paying attention, and some older plugins stop working on newer PHP versions, so an up-to-date site is easier for your host to move across.

4. Check your backups. Find out when your last full backup was taken, and whether a copy is stored somewhere other than the same server. A backup that lives on the server it's meant to rescue is not much use if that server is the problem.

5. If your host can't patch soon. The PHP project lists temporary settings that reduce exposure, such as turning off session upload progress and limiting request sizes, but says plainly they "do not make an installation safe". The NCSC goes further: if you can't update or apply those settings quickly, consider taking the system offline until it is fixed. For a small business the practical version is often moving to a host that runs a supported, patched PHP. If you're on PHP 8.2, note the PHP project says 8.2 stops getting security fixes after 31 December 2026, so plan a move to a newer version anyway.

6. If you think the site was compromised. Signs include pages or users you didn't create, unexpected redirects, a warning from your browser or Google, or a host telling you about strange activity. Wiz and The Hacker News list the technical signs your host can look for, such as unusual uploads followed by memory errors and repeated server errors. Don't just delete things. Tell your host, ask them to keep the logs, change your passwords from a different device once the site is fixed, and get help from someone who handles security incidents. If customer personal information might be involved, read the guidance on cyber.gov.au and from the privacy regulator before you decide what to tell people.

A message you can copy and send

Hi, I've read about the PHP security release on 21 October 2026 (CVE-2026-109618 and CVE-2026-109619, called PHP2Shell). Can you please confirm:

1. Which PHP version our website runs on.
2. Whether it has been updated to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to a vendor build that includes fixes for both CVEs, and that PHP has been restarted on the new version.
3. If we're on PHP 8.1 or older, what your plan is to fix or upgrade it, and by when.
4. When our last full backup was taken and where it is stored.
5. Whether you've seen any signs of these flaws being used against our site.

Thanks.

Send it to your host's support address, or to the developer or agency who looks after the site. Keep their reply.

Using an AI assistant to read the reply

If the answer comes back full of jargon, a general assistant such as Claude or ChatGPT can explain what it means in plain English. Paste the reply and ask: "Does this confirm our PHP is patched for CVE-2026-109618 and CVE-2026-109619? What should I ask next?"

Two cautions. Never paste passwords, server logins or customer details into a chat window, especially on a free personal account. And treat the assistant's answer as a starting point, not a sign-off: the people who run your server are the ones who can confirm it is fixed.

Where to get official advice

• Australia: ASD's Australian Cyber Security Centre has an alert titled "Critical vulnerabilities in PHP" on cyber.gov.au. Check it for the current Australian advice. It is also where to report a cyber incident.
• The PHP project: the security advisory lists the fixed versions and the temporary settings.
• UK NCSC: its alert has a clear list of steps for organisations.

Where to start

1. Send the message above to your host or developer today.
2. If nobody looks after your site and you want someone who will, Concierge matches you with a reviewed agency, and it is free for businesses. You can also browse agencies yourself.
3. If you're thinking about how AI tools fit into the rest of your business, our guide on what to put in an AI use policy for a small team covers what staff should never paste into an assistant.