PHP2Shell Explained for Business Owners

On 21 October 2026, the people who maintain PHP released an emergency update. PHP is the software that quietly runs behind roughly 70% of the world’s websites, including most WordPress sites and WooCommerce stores. Two serious flaws in it could let an attacker take control of a website’s server without needing a password.

If you own a business website, this matters to you even if you have never heard of PHP. This guide explains what happened in plain language, how to tell whether your site is affected, and exactly what to do this week. There is also a section you can forward straight to your developer or hosting provider.

What happened

Think of PHP as the engine under your website’s bonnet. Your WordPress theme, plugins and pages are the car’s body and dashboard; PHP is what actually runs them on the server.

Researchers found two flaws in that engine. Security experts have nicknamed them PHP2Shell, because they can hand an attacker a “shell” — remote control of the server. Their official labels are CVE-2026-109618 and CVE-2026-109619, and both are rated 9.2 out of 10 for severity.

In simple terms, a specially crafted web request can leave PHP’s memory in a broken or stale state. The next request handled by the same part of the server can then be tricked into running the attacker’s code, or into revealing what is stored in memory.

Three details make this unusual:

• It’s in the engine, not the add-ons. The problem sits in PHP itself, not in a particular WordPress plugin or theme. Updating your plugins does not fix it.
• It happens before your website’s own code runs. Firewalls and security plugins built into your site may never see it.
• It has been there a long time. Versions as old as PHP 5.4, released over a decade ago, are affected.

The PHP team announced the problem on 20 October and released fixed versions the next day. Governments including the US cybersecurity agency CISA and the UK’s National Cyber Security Centre urged organisations to update immediately. Attack attempts have since been reported in the wild, with Cloudflare seeing spikes in exploit traffic.

Why it matters to your business

An unpatched server gives an attacker the same access your developer has. Here is what that can mean in practice:

• Your website is taken over. Pages can be defaced, redirected to scam sites, or quietly changed to infect visitors.
• Your secrets leak. The flaws can expose what is held in the server’s memory, including passwords, payment and shipping API keys, and login tokens.
• Your customers’ data is exposed. Order histories, enquiry forms and email lists stored behind the site become reachable.
• Google and your customers lose trust. A hacked site can be flagged as unsafe in search results, and customers remember.
• The site goes down while it’s cleaned up. For an online store, every hour offline is lost sales.

The speed of attacks is the new part. Once a fix is public, attackers can study it to work out exactly how to break unpatched sites. The gap between “fix released” and “attacks begin” is now measured in hours, not months.

Am I affected? A two-minute self-test

You are probably running PHP if your website was built on any of the platforms below and is hosted on your own server or a shared hosting plan.

Your website is built on	Runs on PHP?	What it means for you
WordPress or WooCommerce	Yes	Check your PHP version this week
Joomla, Drupal, Magento, OpenCart, PrestaShop	Yes	Check your PHP version this week
A custom site built with Laravel or CodeIgniter	Yes	Check your PHP version this week
Shopify, Wix, Squarespace	Managed by the platform	The provider patches its own servers; nothing for you to update
Astro, Next.js or plain HTML	No	Not affected by PHP2Shell

Not sure what your site is built on? Three quick clues:

1. Your login page. If you log in at yoursite.com/wp-admin, it’s WordPress.
2. Your hosting dashboard. If you see cPanel, Plesk or a “PHP version” setting, your site almost certainly uses PHP.
3. Your invoices. A shared hosting plan from a typical web host usually means PHP.

Also think about the websites you’ve forgotten: an old campaign page, an event microsite, a staff portal or a lab site nobody has logged into for years. Forgotten sites are often the oldest and least protected.

What to do this week

You don’t need to fix this yourself. You need to make sure someone does, and get it in writing. Work through this list:

1. Ask one question today. Message whoever looks after your website — your developer, agency or hosting company: “Is our website running a PHP version patched for PHP2Shell, and has the server been restarted since?” Ask for a yes or no and the version number.
2. Check the version number you get back. It should be 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer within its series. If it’s 8.1 or older, read the next section — an upgrade or a vendor patch is needed.
3. List every website you own. Include old ones. Each needs the same answer.
4. Change important passwords and keys once the site is patched. Because the flaws can leak what is in the server’s memory, it’s a sensible precaution to reset admin passwords and ask your developer to rotate payment, email and shipping API keys.
5. If nobody answers within a day, take the site offline. A “back soon” page costs far less than a hacked store. The PHP team itself says settings changes alone don’t fully close this hole.
6. Keep the written answer. It’s useful for insurance, audits and peace of mind.

If you don’t know who looks after your website, that is the most important thing this news has revealed.

Forward this to your developer

Copy this section into an email to whoever manages your server.

Upgrade PHP to the fixed release for your branch, or install your operating system or hosting vendor’s patched package:

PHP branch	Fixed version	Notes
8.5.x	8.5.12	Official patch
8.4.x	8.4.27	Official patch
8.3.x	8.3.36	Official patch
8.2.x	8.2.35	Official patch
8.1, 8.0, 7.4	No official release	Use a vendor or long-term-support backport, or migrate
Anything from 5.4 to 8.5.11	—	At least one of the flaws may apply

Then:

• Restart everything that runs PHP — Apache, PHP-FPM and any long-running PHP workers. Without a restart, vulnerable workers can stay in memory even after the upgrade.
• Can’t patch immediately? Consider taking internet-facing PHP services offline. Setting upload_progress.enabled=0 and restarting every worker reduces some exposure, but it is a temporary stopgap, not a fix.
• Look for signs of an attack: multipart requests followed by memory-limit errors, unexplained HTTP 500 errors, unusual PHPSESSID cookies, and unexpected PHP worker restarts.
• Rotate secrets that the server held in memory: database passwords, API keys and session or signing keys.
• Confirm in writing the PHP version now running on each site and the time of the restart.

Why AI found it now

These flaws sat unnoticed for more than ten years. They were found this year by security researchers at Calif and Wiz working with AI models from OpenAI and Google, who reported them privately so a fix could be ready before the news broke.

It’s tempting to read this as “AI is now hacking the internet.” The more useful lesson is quieter. In a DW interview, security researcher Tara Wheeler pointed out that AI isn’t mainly discovering exotic new attacks. It is finding old, basic weaknesses much faster than people could. She compared bugs like this to asbestos in old buildings: hidden in ageing structures, and something we will keep uncovering.

That speed works for both sides. Defenders found and fixed PHP2Shell in weeks. Attackers can use the same tools to turn a published fix into a working attack within hours. For business owners, the conclusion is simple: an outdated website is now found faster than ever, by whoever is looking.

The bigger lesson: who looks after your website?

A dentist should stay current on dentistry. A factory owner should stay current on production. Neither should have to read security bulletins to keep their website safe. Yet many business sites were built once, handed over, and never updated again — and that is exactly where PHP2Shell does its damage.

At Wraptron, most of the websites we build today run on modern stacks such as Astro and Next.js, which don’t use PHP, so they were not affected by PHP2Shell. But the stack is only half the answer. What protects a business is someone who is responsible for the site, watching for news like this, and acting the same day.

Whichever platform your website runs on, ask yourself three questions:

• Do I know what my website is built on and where it is hosted?
• Do I know who is responsible for updating it?
• Would they tell me within a day if something like this happened again?

If any answer is “no”, that’s worth fixing before the next PHP2Shell.

Get a free website check

Not sure where you stand? We’ll check your website for free and send you a one-page status report in plain language — green, amber or red — within 24 hours. We look only from the outside, the way any visitor would, and we only check sites whose owners ask us to.

Request your free website check → or message CHECK to us on WhatsApp at +91 90947 79005.

Think Smart.

Sources

• PHP2Shell — Wikipedia
• Wiz — PHP2Shell research
• Quartz — PHP releases patches for two critical flaws found with AI
• Computer Weekly — Critical PHP flaws put millions of websites at risk
• ABC News — Urgent security fix for code vital to 70% of websites
• DW interview with Tara Wheeler, October 2026