Is your business website affected by the PHP flaw?

Two critical flaws in PHP were fixed on 21 October 2026, and the security world is calling them PHP2Shell. PHP is the language behind WordPress and a large share of the web, which is why the BBC was reporting websites being taken offline while they were patched.

What is PHP2Shell?

Two flaws, CVE-2026-109618 and CVE-2026-109619, that let an attacker run their own code on a web server without logging in. Once they can do that, they can read whatever the website can read, including customer details from a contact form or an online shop, plant a way back in for later, or use the server to reach other systems.

The National Cyber Security Centre told organisations to find every PHP system they run, start with the ones facing the internet, and take a system offline if it cannot be fixed or protected in time.

Is my website affected?

If it runs on PHP and the server has not been updated since 21 October, assume so. According to Tenable’s summary, the PHP project says every installation that serves web requests is at risk, whichever way the server runs it.

That covers:

• WordPress, which is written in PHP
• WooCommerce shops, which run on WordPress
• Most other content management systems and many booking, ticketing and customer portal systems

A site built some other way, as plain pages or on a hosted platform such as Squarespace or Wix, is not running PHP that you are responsible for. Ours is not, which is why we could check it in minutes.

How do I check which PHP version my site uses?

On WordPress, log in and go to Tools, Site Health, Info, then open the Server section. It shows the PHP version.

The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything lower in the same series is not fixed.

If you cannot log in, ask whoever hosts the site. Our free security headers checker sometimes shows it too, because some servers announce their PHP version in a header called X-Powered-By. Many hosts hide it, so seeing nothing proves nothing.

What fixes it?

Updating PHP on the server, then restarting it. The restart matters: installing the new version does not fix copies of PHP that are already running.

On shared or managed hosting, which is how most small business websites are hosted, that is your host’s job rather than yours. Updating WordPress and its plugins is still good practice, but it does not fix this.

If your site is on PHP 8.1 or older, there is no official fix. Those versions were already out of support, and now there is a live reason to move.

What if it cannot be updated straight away?

PHP has published settings that reduce the risk, but they say plainly that updating is the only complete fix. Cloudflare has added rules to block known attacks, which helps only if your site sits behind Cloudflare.

If neither is possible, the NCSC’s advice is to take the site offline until it can be fixed. For a brochure website that is a few days of inconvenience. For a site holding customer data, it is the safer choice.

Has anyone actually been hacked?

The flaws have been exploited. Researchers confirmed attackers running code on test servers within days of the fix, and the US Cybersecurity and Infrastructure Security Agency added both to its list of known exploited vulnerabilities on 27 October.

For WordPress specifically, Wordfence said on 28 October that it was not aware of any WordPress site compromised this way yet. That is good news, and it is also how these things usually go: the attacks come after the headlines, aimed at the sites nobody updated.

What should I do today?

1. Ask your web host whether PHP has been updated to a fixed version and restarted. Get a yes or a date.
2. Check the version yourself in WordPress Site Health if you can.
3. If it is 8.1 or older, plan the move now.
4. If it was exposed for days, have someone look for signs of a break in: admin accounts you do not recognise, new files in the uploads folder, or changes nobody made.

If you are not sure who hosts your website, or you would like somebody to check it for you, get in touch.