PHP2Shell: what small business websites need to do today

The short answer

If your website runs on WordPress or another PHP system, ask your web host or web designer today to confirm in writing that your server runs PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer, or a vendor build that includes the fix for CVE-2026-109618 and CVE-2026-109619. If your site is on PHP 8.1 or older, plan an upgrade, because the PHP project no longer fixes those versions itself. If you use a fully hosted builder where you never manage a server, there is nothing for you to install; watch your platform's status page instead.

The rest of this guide explains what happened, how to tell which group you are in, and what we would do in your place. It is written for owners and for the web designers who look after their sites.

What happened on October 20 and 21

On October 20, 2026 the PHP security team announced an emergency release for the next day and rated both flaws 9.2 out of 10 on the CVSS v4.0 scale. Details leaked online before the planned disclosure, according to security firms Huntress and Infosecurity Magazine, which turned an orderly patch day into a scramble.

On October 21 PHP published the fixes. Its advisory says the flaws can allow unauthenticated remote code execution: an attacker who sends the right request can run their own code on the server without logging in. PHP says every installation that serves web requests is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, and it rates the risk highest for mod_php because the attack can start before any website code runs.

Governments reacted fast. Reuters reported that the Netherlands, Denmark, France and Finland took at least some public websites offline as a precaution. In Canada, Evan Solomon, the Minister of Artificial Intelligence and Digital Innovation, posted about government sites going temporarily offline and urged anyone running PHP to update. Japan's Prime Minister Sanae Takaichi asked website operators on X to check whether their public sites use PHP, patch that night, and close the site temporarily if patching quickly was not possible. Reuters also reported that the flaws had sat unnoticed in PHP for years until they were found with the help of AI.

On exploitation, the picture moved during the day. The Canadian Centre for Cyber Security's alert AL26-026 said a proof of concept was available but no active exploitation had been identified yet. SecurityWeek later updated its report to say security firms had started seeing exploitation attempts. Assume attacks are happening and act today.

Who needs to do what

The question that matters is not "do I use PHP" but "who runs the server my site sits on". That decides who installs the fix.

For PHP 8.1 and older, PHP says some Linux distributions and long term support vendors ship their own backported fixes, and it published minimal source backports for 7.4, 8.0 and 8.1. That means an older version number is not automatically unpatched, but you need your host to say so in writing. We explain how to read your version in how to check your website's PHP version.

Five things to do today

1. Work out who runs your server. Look at who you pay for hosting. A monthly bill from a hosting company usually means shared or managed hosting. A bill from a cloud provider plus a developer usually means your own server.
2. Get the PHP version confirmed in writing. Ask for the exact version, or the vendor build that includes the fix, for every site you run. Do not forget staging copies, old subdomains and a second site you stopped updating. Our copy and paste emails for your host and web designer make this a two minute job.
3. Plan your way off PHP 8.1 or older. Even if your host has backported this fix, older versions get no official fixes for the next flaw. PHP 8.2 itself loses official support on December 31, 2026, so 8.3 or newer is the safer target. Test on a staging copy first, because old plugins and themes can break.
4. If nobody can confirm a fix, limit exposure. PHP and the Cyber Centre both point to isolating or taking offline systems that cannot be patched yet. A WordPress maintenance plugin does not help here, because it still runs on PHP. See how to take a site offline without hurting your Google ranking.
5. Look for signs of a break in. New admin accounts, files you did not add, strange redirects or a warning in Google Search Console all need action. Our first 24 hours checklist walks through it.

Common mistakes

• Updating WordPress and stopping there. Keeping WordPress, plugins and themes current is good practice, but it does not change the PHP engine underneath. This flaw is in PHP itself.
• Relying on one setting change. PHP lists interim settings for server administrators, such as turning off session upload progress, but says only an update is a complete solution. Treat any workaround as a bridge to the patch.
• Assuming a firewall makes you safe. Help Net Security reported that Cloudflare deployed firewall rules for the known attack paths, including for free plan customers. That only covers traffic that passes through Cloudflare, and new attack variants can appear. It buys time; it is not the fix.
• Waiting for a hacked sign before acting. Attacks of this type often leave no visible change. Patch first, check second.

Our take

This is a server problem, so most small business owners do not need to touch code. What they need is a clear answer from the person who runs the server, today, in writing.

Owner on a hosted builder: you have the least to do. Keep an eye on your platform's status page and announcements, and change nothing in a panic.

Owner on shared or managed WordPress hosting: send your host one email and keep the reply. If the answer is vague, or your site is on PHP 8.1 or older, book the upgrade now rather than in December.

Owner whose developer manages a server: ask for the patch to be installed and the PHP workers restarted today, and ask for a short note when it is done. If your developer is unreachable, ask your cloud provider's support about isolating the server until it is patched.

Web designer with several client sites: make a list of every site, its host and its PHP version before you answer anyone. Clients will ask; a list with dates beats a reassuring guess.

When this advice would change: if confirmed mass compromise of a specific platform or plugin is reported, or if your host tells you it cannot patch your server, move from "confirm" to "isolate now".

Sources

• PHP: Security advisory, critical remote code execution vulnerabilities (October 21, 2026)
• PHP: Supported versions
• Canadian Centre for Cyber Security: AL26-026 Critical vulnerabilities impacting PHP
• Reuters via US News: Government websites go dark after AI discovered flaw
• Engadget: Government websites in the EU and Canada taken offline
• Central News Agency: Japan's Prime Minister urges PHP patching (Chinese)
• SecurityWeek: PHP2Shell, mass exploitation looms
• Help Net Security: PHP2Shell patched, update now
• Huntress: php2shell, leaked critical PHP vulnerabilities