PHP2Shell: Is Your Website at Risk? What to Do Now

On 21 October 2026, government websites in several countries went offline within hours of each other. Finland took its public-facing services down. Dutch national and local government sites went dark, along with some hospital sites and the Port of Rotterdam. Canada, Denmark, France and Australia took some services offline too. It looked like a coordinated attack, but it was the opposite: these were precautions, taken so that teams could fix a flaw before anyone could use it.

The flaw is in PHP, the language behind a huge share of the web, including WordPress. If your business website runs on PHP, this matters to you. If it doesn't, you can relax. This guide explains both cases in plain language.

What is PHP2Shell? #

PHP2Shell is the nickname for two critical security flaws in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619. They are rated 9.2 out of 10 on the newer CVSS v4.0 scale, and NVD later scored them 9.8 on the older v3.1 scale. Both are at the top of the severity range.

In simple terms, the flaws can let an attacker run their own commands on a server that runs a vulnerable version of PHP. That is called remote code execution. Once an attacker can do that, they can steal data, deface the website, plant malware or take the site over completely. The "shell" in the name refers to the control panel an attacker gets on the server.

Reports say the bugs were found with the help of AI. One report says Amazon's threat team recorded an exploitation attempt on 17 October, four days before the public announcement. Sources disagree on how widely it is being exploited right now, so treat it as a real risk and not as a panic.

Why were government websites taken down? #

Governments run thousands of sites, and many of them use PHP somewhere. The patch was about to be published, and once a patch is public, attackers can compare it to the old code and work out the flaw. That creates a race between attackers and site owners.

Rather than take that risk, many agencies switched sites off, applied the fix, tested and switched them back on. Most reports describe the outages as temporary. This was a planned, careful response, not a sign that those sites were already hacked.

Is my website affected? #

The answer depends on what your site is built with.

Your website runs on	Affected?	What to do
WordPress, WooCommerce	Yes, if the server's PHP is not patched	Ask your host or update PHP
Joomla, Drupal, Magento, Laravel, custom PHP	Yes, if the server's PHP is not patched	Ask your host or update PHP
Shopify, Wix, Squarespace	Not through your own server	Nothing to do, the platform handles it
Next.js, React, Node.js, static HTML	No, these do not run PHP	Nothing to do for this flaw

The key point is that the flaw sits in the PHP installed on the server, not in your theme or plugins. So even a perfectly updated WordPress site is exposed if the hosting server runs an old PHP build.

The fix: which PHP versions are patched? #

PHP released fixes on 21 October. The patched versions are:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

Source patches have also been published for some older branches such as 7.4, 8.0 and 8.1, which no longer get regular updates. If your site still runs on one of those, the safer move is to upgrade to a supported version rather than depend on a backport.

What to do today: a simple checklist #

1. Find out your PHP version. In most hosting panels (Hostinger, cPanel, Plesk) there is a "PHP Configuration" or "PHP version" setting. WordPress users can also open Tools, Site Health, Info, Server in the dashboard.
2. Check it against the patched list above. If you are on 8.2, 8.3, 8.4 or 8.5, make sure it is the latest patch release and not just the right branch.
3. Ask your hosting provider in writing. On shared and managed hosting, the host patches PHP, not you. Ask: "Have you installed the fixed PHP build for CVE-2026-109618 and CVE-2026-109619 on my server?" Keep the reply.
4. Update the version if you control it. If your panel lets you choose PHP, pick the newest supported version. Test the site afterwards, since old plugins can break on a newer PHP.
5. Take a fresh backup before any change, and store a copy away from the server.
6. Check for signs of a break-in. Look for files you did not upload, new admin users you did not create, unfamiliar redirects, or a sudden spike in traffic or server load. Run a security plugin scan if you use WordPress.
7. Change passwords for hosting, FTP and WordPress admin if anything looks off.

Be careful of fake alerts #

Big security news brings scam emails. Expect messages saying "your website is hacked, click here to fix it" or "download this PHP security patch". Real patches come through your hosting panel, your operating system updates or the official PHP site, never through an attachment in an email. When in doubt, log in to your hosting account directly and check there.

Why this keeps happening, and what it means for your business #

Most small businesses never think about the software under their website until something breaks. Yet a website is a live system, and servers need updates the same way phones do. An old PHP version, an unused plugin or a forgotten staging site is how most real-world hacks start.

For a business, the cost of getting this wrong is not only the repair. A hacked site can be flagged by Google as unsafe, drop out of search rankings and lose the lead flow that your ads and SEO are paying for. A few minutes spent on updates and backups is far cheaper than that.

If you are not sure what your site runs on or whether your host has patched it, we can check it for you. Our website development team in Noida builds and maintains sites, and our guide on how to choose web hosting for a business website explains what to ask a host about security and updates.