PHP2Shell Explained: Critical PHP Risk for Business Websites

Your website almost certainly runs on PHP

Your business website almost certainly runs on PHP, WordPress, Drupal, Joomla, Magento and Laravel all do, and so does plenty of software that never mentions PHP at all.

This week, two critical flaws were fixed inside PHP itself. Security officials named the pair PHP2Shell, and both carry a severity score of 9.2 out of 10.

In plain English: this php vulnerability can let an attacker run code on your server without any password. That is the worst kind of bug a website can have, if it can be reached.

What happened: the PHP2Shell timeline

The short version is unusual, the attacks started before the announcement:

August 2026, Researchers at Calif, Wiz Research and OpenAI find the flaws and report them to the PHP team. A coordinated fix is planned in secret.

October 17, Amazon's honeypots record attack attempts in the wild, days before any public announcement.

October 20, The technical details leak early, before the fix is ready.

October 21, early, Cloudflare counts thousands of attack attempts in the ten hours before the announcement. Governments across the Netherlands, Finland, France, Denmark and Australia take services offline as a precaution; Japan's MUFG bank does the same.

October 21, 14:00 UTC, PHP releases emergency fixed versions, and security agencies urge everyone to patch immediately.

Within a day, Cloudflare's CEO reports the attempts in the millions. Censys counts roughly 1.58 million internet-facing PHP servers, almost all of them unpatched.

Is my WordPress site affected? Short answer: assume yes

This is not a WordPress bug, and it is not a plugin bug. The flaws sit in the PHP engine itself, so a site can be fully updated and perfectly clean, and still exposed.

PHP's own developers say every PHP installation that serves web requests is potentially affected, across every common setup, with the highest risk on Apache's mod_php. The vulnerable code dates back to PHP 5.4, released in 2012.

There is exactly one fix, and it is not in your website's code: update PHP itself. If your host manages your server, applying it is their job, making sure it happens is yours.

The safe versions: check yours against this list

Find your PHP version, in WordPress, under Tools → Site Health → Info → Server, and compare it with the minimum safe version for your branch, from the PHP security update of October 2026:

PHP 8.5 → you need 8.5.12 or later

PHP 8.4 → you need 8.4.27 or later

PHP 8.3 → you need 8.3.36 or later

PHP 8.2 → you need 8.2.35 or later

PHP 8.1 or older → PHP itself published no fixed release for your branch. Many hosts and Linux vendors backported the fix into older versions with the same version number, so only your host can confirm you are covered.

On a safe version, or confirmed covered by your host? The emergency is over for you. Below the line without confirmation, you are still exposed.

How scared should you be? The honest answer

Less than the headlines suggest, but not relaxed. Security firm Sansec updated its analysis on October 22: public proof-of-concept attacks do not work against a default PHP installation.

A real attack needs specific knowledge of your server, the right conditions on it, and often a second flaw, typically an old plugin or theme weakness. WatchTowr, watching the traffic live, puts it plainly: attempts everywhere, nobody successful yet.

Sansec's advice is equally plain: you do not need to take your store offline. But a 9.2 score, attacks that began before disclosure, and millions of attempts add up to one instruction, patch this week, not this quarter.

Do these 5 things this week

1. Find your PHP version today. Two minutes in WordPress Site Health, or one message to your host.

2. Get PHP updated to a safe version from the list above. On managed hosting, ask for it, do not assume it already happened.

3. Get the answer in writing. If your host says a backported fix covers you, have them confirm the build and the date it was applied.

4. Update WordPress itself, plus every theme and plugin, and delete the ones you no longer use. An attack usually needs a second flaw; do not leave one lying around.

5. Back up before the update and again after it. Then click through your site, and place a test order if you sell online.

And two don'ts: do not take your site offline in a panic, the experts say it is not needed, and do not try to fix this by editing website code. The flaw sits in PHP, underneath your site entirely.

Copy, paste, send: the message for your host

Not sure what to ask? Send this, exactly as written:

“Hi, please confirm which PHP version our website runs, and whether it includes the fixes for CVE-2026-109618 and CVE-2026-109619 (PHP2Shell). The minimum safe versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12; if we are on an older branch with a backported fix, please confirm the patched build and when it was applied. If we are not patched yet, please schedule the update this week and confirm when it is done. Thank you.”

A good host answers within a day. Silence, or a vague “we'll get to it”, is also an answer, about whether they should keep hosting your business.

Found with AI, fixed by people: the lesson that stays

One detail is easy to miss. These deep flaws, hiding in the world's most-used web language since 2012, were found and reported by security teams at Calif, Wiz and OpenAI, in an era when AI tools help researchers hunt bugs at machine speed.

The attacks are automated too. Keeping a website maintained is not: updates applied, versions checked, backups taken. That unglamorous work decides whether a week like this is a headline you read, or a disaster you live.

It is the work I do for the business websites I build and look after. PHP2Shell will not be the last such emergency; the sites that shrug these weeks off are simply the ones somebody is quietly keeping current.