PHP2Shell: What Small Business Website Owners Need to Do Right Now

Quick answer: PHP2Shell is the nickname for two critical flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619), patched on October 21, 2026. They let an attacker take over a web server with one request, no login needed. If your website runs on PHP, including WordPress, make sure your server is on PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or that your host has patched it for you.

Last week the web had its most stressful few days in years. The press called it "Black October."

If you run a business website, you may have seen the headlines and wondered whether any of it applies to you. For most small businesses, the honest answer is: probably yes. The good news is that the fix is usually quick, and often your hosting company has already done it.

Here's what happened, in plain language, and exactly what to check.

What is PHP2Shell?

PHP2Shell is a pair of critical security flaws in PHP, the programming language that powers most of the web. PHP rates both 9.2 out of 10 for severity.

According to researchers at Wiz, an attacker can trigger them with a single web request, before any of your website's own code even runs. No password, no login, no plugin required. A successful attack can give them control of the server, which means your site, your files and often your customer data.

The flaws were found and reported by Wiz Research, Calif and OpenAI's Codex Security team. The vulnerable code had been sitting in PHP for more than a decade. AI tools helped researchers find and prove the problem much faster than before. Unfortunately, the same tools help attackers too.

Is my website affected?

Your website is likely affected if it runs on PHP and the server has not been updated since October 21, 2026. PHP runs about 69% of websites whose server language is known, according to W3Techs.

You are probably running PHP if your site uses:

• WordPress, WooCommerce, Joomla or Drupal
• Laravel or another PHP framework
• cPanel-style shared hosting

It doesn't matter which theme or plugins you use. This flaw lives in the engine underneath your site, not in WordPress itself.

Are attackers already using it?

Yes, attackers are actively trying. Amazon's threat intelligence team recorded an exploitation attempt on October 17, four days before the flaws were made public. On October 21, security firm watchTowr reported active exploitation attempts against both flaws.

As of this writing, no specific server break-in has been publicly confirmed. That window won't stay open for long. Attackers scan the whole internet for unpatched servers within hours.

Does updating WordPress fix PHP2Shell?

No. Updating WordPress, your theme or your plugins does not update PHP. PHP is the server software your site runs on. It's usually managed by your hosting company or whoever set up your server.

This is the most common misunderstanding about PHP2Shell, so it's worth saying twice: patch the server, not just the site.

What should I do today? 5 steps

1. Find out who manages your server. Shared or managed hosting (SiteGround, Kinsta, WP Engine and similar) usually handles PHP for you. A VPS or your own server means you, or your developer, are responsible.
2. Ask your host one direct question. "Have you applied the October 21 PHP security fixes for CVE-2026-109618 and CVE-2026-109619 on my server?" Get the answer in writing. SiteGround, for example, says it patched all its servers on release day.
3. Check your PHP version. In WordPress, go to Tools → Site Health → Info → Server. You want 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer. Some Linux vendors patch older-looking version numbers, so if you're unsure, ask whoever manages the server.
4. Get off old PHP. PHP 8.1 and older no longer get official updates. If your site is on PHP 7.x or 8.0, plan an upgrade now. This is overdue regardless of PHP2Shell.
5. Add a firewall in front of your site. Cloudflare has deployed protective rules for these flaws to all customers, including the free plan. A firewall buys time; it is not a replacement for patching.

If you manage your own server and can't patch immediately, the UK's National Cyber Security Centre advises taking unpatchable systems offline. PHP has also published temporary settings your developer can apply, such as turning off session upload progress (session.upload_progress.enabled=0).

What if my site was already hit?

Patching stops new attacks. It does not remove an attacker who got in earlier. Ask your developer or host to look for warning signs from the past two weeks:

• Bursts of unusual file-upload requests followed by memory errors
• Repeated "500 Internal Server Error" responses
• Unusually large session cookies
• Unexplained crashes or restarts of PHP
• New admin users, files or scheduled tasks you didn't create

If anything looks off, treat it as an incident: preserve the logs, change passwords and keys, and get help before you wipe evidence.

Is there another PHP flaw I should know about?

Yes, but it's lower risk. On October 23, PHP warned of a third issue, CVE-2026-115560. It only affects sites with an unusual session configuration, and PHP says it is unlikely in practice. The temporary session setting mentioned above also protects against it. A full fix will come in PHP's next routine release.

The bigger lesson from Black October

AI has shrunk the gap between "a flaw is found" and "attackers can use it" from weeks to days. For a small business, that changes what good security looks like:

• Know who is responsible for every layer of your website: the code, the plugins and the server.
• Have a host or partner who patches within a day, and confirm it.
• Keep backups that are offline and tested.
• Put a web application firewall in front of anything that matters.

If you're not sure your site is covered, I'm happy to look. Book a free 10-minute call and we'll check where you stand. You can also brush up with my beginner's guide to WordPress security, or test your instincts in the Security arcade.

Frequently asked questions

What is PHP2Shell?

PHP2Shell is the name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, patched on October 21, 2026. Each is rated 9.2 on CVSS v4.0 and can let an unauthenticated attacker run code on a web server.

Which PHP versions fix PHP2Shell?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive official fixes; source backports exist for 7.4, 8.0 and 8.1.

Is my WordPress site affected by PHP2Shell?

If your WordPress site runs on an unpatched PHP version, yes. The flaw is in PHP itself, so it affects sites regardless of theme or plugins.

Does updating WordPress fix PHP2Shell?

No. WordPress updates do not change the PHP version on your server. Your host or server administrator must update PHP.

Is PHP2Shell being exploited?

Exploitation attempts were seen from October 17, 2026, and security firms reported active attempts on October 21. No specific successful compromise had been publicly confirmed as of October 25, 2026.

Sources

• Help Net Security: PHP2Shell patched, update now
• The Hacker News: PHP issues emergency patches for PHP2Shell
• The Hacker News: PHP warns of another unpatched RCE risk
• SiteGround: Critical PHP vulnerabilities

About the author: Sara Wolpin is the founder of PinSecurity and a working CISO. She helps small and mid-size businesses secure their websites, cloud accounts and AI tools, and leads incident response when something goes wrong.