Two critical security flaws in PHP – nicknamed PHP2Shell – were made public on 20 October 2026, and if your business website runs on WordPress, it’s almost certainly affected. Fixes were released on 21 October, so the priority now is making sure your website is on a patched version as soon as possible.
This isn’t something to leave until next month. Security researchers are already seeing attackers attempt to exploit both flaws, so it’s worth taking a few minutes to understand what’s happened and check where your website stands.
PHP2Shell explained: what are the vulnerabilities?
PHP2Shell refers to two separate flaws in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619. PHP is the programming language that runs behind the scenes on most websites – WordPress, WooCommerce, Drupal, Joomla and countless custom sites all rely on it.
Both flaws enable remote code execution. In plain terms, an attacker could run their own code on a web server without logging in – and in some setups, before your website’s own code has even loaded. That could mean anything from planting malware or spam pages to stealing data. Researchers have also shown that the flaws can leak information held in the server’s memory, such as passwords and login tokens.
The PHP team rated both flaws 9.2 out of 10 for severity, and one security firm rated them a full 10. Details leaked online on 20 October, ahead of the planned announcement, and PHP released its fixes the following day.
If you’d like the technical details, PHP has published advisories for CVE-2026-109618 and CVE-2026-109619.
Is your website affected?
Practically any website running PHP 5 through to PHP 8 is affected. What matters now is whether a fix is available for the version your website uses.
| PHP version | Fixed in | Status |
|---|---|---|
| 8.5 | 8.5.12 | Supported – update now |
| 8.4 | 8.4.27 | Supported – update now |
| 8.3 | 8.3.36 | Supported – update now |
| 8.2 | 8.2.35 | Supported until 31 December 2026 – update now, then plan an upgrade |
| 8.1 and older | No fix | No longer supported – upgrade needed |
Older versions of PHP no longer get regular security updates, so there’s no official fix for them. Websites still running PHP 8.1, PHP 7 or anything older are the most at risk, and the only real solution is to upgrade. You can check which versions are currently supported on the PHP website.
What should you do to protect your website?
If someone else looks after your hosting, ask them whether the fix has been applied and which version of PHP your website is running. If you manage your own server, these are the key steps:
- Check which version of PHP your website uses – most hosting control panels show this, or your host can tell you.
- If you’re on PHP 8.2 or newer, make sure the latest security release has been installed and the server restarted.
- If you’re on PHP 8.1 or older, plan an upgrade as soon as possible. It’s worth testing first, as older plugins and themes can sometimes need updating to work with newer PHP.
- Once the fix is in place, check your website for anything unusual – unfamiliar files, recently changed files or user accounts you don’t recognise – in case anyone got in before the patch.
If you’re not sure where to start, we’re happy to take a look.
What we’ve done at 37 Digital
We contacted our hosting clients as soon as the flaws were announced, so nobody was caught off guard. When PHP released its fixes, we applied them to every supported version of PHP on our hosting – PHP 8.2 and newer.
We’ve also retired PHP 4.4, 5.1 and 5.2. These stopped getting updates 15–20 years ago and simply can’t be kept safe any more. Any client still on PHP 8.1 or older will hear from us about upgrading, at a discounted rate for maintenance plan clients.
You might wonder why such old versions were still available at all. Some older websites were built on code that won’t run on newer PHP, and switching them over without work would simply have taken them offline. We kept those versions available so the sites could stay up while upgrades were planned. With flaws as serious as PHP2Shell, that trade-off no longer makes sense – keeping a website online isn’t worth leaving it open to attack.
For our maintenance plan clients, we’re going a step further. Now that the fixes are in place, we’re running these checks on each website at no extra charge:
- A full security scan for any suspicious files or activity
- A check for any recently changed or unexpected files
- A review of user accounts to make sure there are no unrecognised logins
- A check that the website is working as it should
Keeping your website secure
Security issues like PHP2Shell are a good reminder that a website isn’t a one-off job. The software behind it needs looking after, and when something serious comes along, speed matters.
At 37 Digital, our maintenance plans include security updates and monitoring, so issues like this are handled before you need to think about them. If you’re a client and want to know where your website stands, just get in touch at support@37digital.com.
Not a client yet and not sure your website is protected? Get in touch and we’ll take a look.
