Last updated: October 22, 2026. This is a fast-moving story. We will update this post as new guidance comes out.
This week, two critical security flaws were announced in PHP, and together they are being called the PHP2Shell vulnerability. If you've never heard of PHP, that's fine. You don't need to. It's the behind-the-scenes engine that runs an estimated 70% of websites, including nearly every WordPress, Drupal, and Joomla site out there.
Think of it like a defect in an engine block, not in one specific car. The flaw isn't in your website's design or your plugins. It's in the engine underneath, which means almost everything built on top of it is affected.
Here's what it means in practice: an attacker on the internet can send a single request to an unpatched web server and take control of it. No password. No login. No one on your team has to click anything. Once they're in, they can change your website, steal the data on that server, or use it as a foothold to go after something bigger.
The good news is that a fix exists. The PHP team released patched versions on October 21. The work now is making sure every site and system that runs PHP actually gets that fix.
We see security alerts every week. Most don't warrant an email to every client we have. This one does, for four reasons:
When a government agency tells businesses to unplug something, that's worth five minutes of your attention.
For most businesses we work with, the honest answer is: your website might be, and your office probably isn't. Here's how to think about it.
This is where the real exposure is for most small and mid-sized businesses. If your website runs on WordPress, Drupal, Joomla, or was custom-built by a developer, it almost certainly runs on PHP. Whoever hosts and maintains it needs to confirm it has been updated.
If your site is built on Wix, Squarespace, or Shopify, the platform runs and patches the servers for you. You're in a much better spot, though it never hurts to confirm.
This is the part people miss. PHP doesn't only live on websites. It shows up in client portals, intranet tools, the web management page on a storage device, older line-of-business software, and that server someone set up years ago that nobody wants to touch. Any of those can be vulnerable if they're reachable from the internet.
Your laptops, your Microsoft 365 email and files, and your Teams calls are not the concern here. This is a web server problem, not a workstation problem.
You don't need to understand the technical details. You just need answers. Forward this list to whoever manages your website, whether that's a freelancer, an agency, or your hosting company:
A good web developer will be able to answer all five quickly. If you get vague answers or no answer at all, that tells you something too.
We run into this all the time. The site was built by someone's nephew, or by an agency you stopped working with three years ago, and nobody's logged in since. Those sites are exactly what attackers are scanning for right now.
If that's you, you have two real options: find someone to update it this week, or take it offline until someone can. A temporary "we'll be right back" page is a lot cheaper than cleaning up after a compromised server, especially if that server has client information on it or is connected to anything else in your business.
We'll be straight with you: we are not web developers, and we don't host websites. Your web developer or hosting company owns the fix for your site. Anyone who tells you otherwise is probably trying to sell you something.
Here's what we do. For our managed clients, we're checking the systems we manage for any PHP software and will reach out directly if we find something that needs attention. And if your web developer needs help securing things, or you're not sure who your web developer even is, we'll get on the phone with them and work it out together. When you call us, you get an engineer, not a call tree. It's the same practical, no-scare-tactics approach we take to cybersecurity across the board.
PHP2Shell is the name for two critical security flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 and can let an attacker take control of a web server running PHP without a password. Patches were released on October 21, 2026.
If your WordPress site runs on a PHP version older than the patched releases, yes. WordPress itself runs on PHP, so the fix has to happen on the server. Ask your web developer or hosting company to confirm your site is on PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35, or a host-patched equivalent.
Yes. Amazon's threat intelligence team saw an exploitation attempt on October 17, before the fix was public, and reported broad exploitation in the days after the patch was released. CISA and the UK NCSC both urged organizations to patch immediately.
The patched versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and older no longer receive official updates, so sites on those versions need a backported fix from their vendor or an upgrade to a supported version.
No. PHP2Shell affects web servers and devices that run PHP, not your laptops, Microsoft 365 email, or Teams. For most businesses, the main exposure is the company website and any web-based tools or devices that are reachable from the internet.
Not sure where your website stands?
Have your web developer call us, or call us yourself. We'll help you figure out who owns the fix and make sure it gets done. No ticket portal, no call tree: the main line rings right to our engineers.
Call (941) 315-2380