When the news broke this afternoon, the first thing we checked was how hard the new PHP vulnerabilities were going to hit the sites we host. The answer from our support team was “so far nothing.” We’ll be honest, that’s the answer we wanted, and it’s also not the whole story.
On October 21, the PHP project released emergency fixes for two critical flaws in the language most of the web runs on. Governments took their own websites offline over it. Sites in the Netherlands, Finland, France and Denmark went dark on purpose while they patched, according to Reuters. The NSA, the UK’s National Cyber Security Centre and CERT-EU all said roughly the same thing. Update now, and if you can’t, take the site down until you can.
If you own a business website, someone may have already forwarded you a headline. Below is where things stand as of now and what we’re doing for the sites we host. We’ll keep this post updated as we know more.
What happened
PHP is the programming language behind most of the web. WordPress runs on it, and so do Drupal, Joomla and Magento. W3Techs puts PHP on roughly 7 out of 10 websites where the server language is known.
Researchers at a security firm called Calif found two flaws this summer while working with OpenAI. Google’s Wiz team found the same two on its own. Both groups used AI tools to do it. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, each is rated 9.2 out of 10 for severity, and Wiz named its working exploit PHP2Shell, which is what you’ll see in most headlines.
The official PHP security advisory puts it in technical terms. What it means is that someone who has never logged into your site can send it one bad request and take over the server it runs on. Wiz also found the flaws can expose what the server is holding at that moment, like passwords and the keys your site uses to connect to other services. Some server setups are more exposed than others, and that’s a question for your host, not something you need to figure out yourself.
The fix was planned for October 22. Details leaked a day early, so the PHP team released it on the 21st, and Cloudflare was already seeing exploit attempts, some in spikes of thousands, per USA Today.
Which PHP versions are affected
Every version from roughly the last 20 years. The PHP project released fixes for the four versions it still supports:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Anything 8.1 or older is past PHP end of life, so the project no longer ships official releases for it. Their security team did put out bare-bones patches for 7.4, 8.0, and 8.1, and some hosting and server companies will build their own fixes on top of those. For most small business sites on budget hosting, an older version leaves two options. Wait on somebody else, or upgrade.
This is the part that worries us. Censys found about 1.5 million of the 2.6 million PHP servers it could see running a version with no official fix, according to Reuters. Cisco Talos estimates roughly half of all PHP systems will never get one. Those sites are going to be targets for a long time.
How to tell if your website is exposed
Start by finding your WordPress PHP version. From the dashboard, go to Tools, then Site Health, then the Info tab, and open the Server section. Your hosting control panel usually shows it as well. On 8.2 or newer, compare it to the version numbers above. On 8.1 or older, you’re running a PHP version the project no longer supports.
Next, email your host. Ask whether PHP on your server has been updated to a patched release, and if it hasn’t, what’s protecting it in the meantime. A host that’s on top of this can answer in a sentence or two. If the reply is vague, keep asking until it isn’t.
If you or your developer manage your own server, the advisory lists a few temporary settings changes that lower the risk. The PHP team is clear that they don’t remove it. Updating is the only real fix.
And if something already looks off (files you didn’t add, admin users you don’t recognize, redirects nobody set up), the FBI says to take the server offline, save its logs (the server’s record of what happened and when), and report it, as Wired reported. Do not wipe the site and start over before those logs are saved. They’re the record of what happened.
What we’re doing for our clients
Our hosting clients haven’t had to lift a finger on this, and that’s by design. Every server running PHP 8.2 and newer has been patched by our hosting provider. For sites still on older versions, Imunify and Cloudflare (the services we run) have added firewall rules that block known attacks while patches roll out. Our support team has been watching all of our sites throughout the day, and so far we haven’t seen any sign that one was hit.
That said, a firewall rule isn’t a patch, and the PHP project says so, too. Over the next few weeks we’ll be reaching out to every client still on PHP 8.1 or older to schedule an upgrade. For most of those sites, it means testing the theme and plugins on a supported version in staging, fixing whatever breaks, and then making the switch. That takes time per site, so the upgrades themselves will run longer than the outreach, and the firewall rules stay in place until each one is done. We wrote last year about why a PHP update isn’t always one click, and we’d rather do that work on our schedule than on an attacker’s.
Why this will happen again
AI tools found these bugs, and the same tools make it much easier for attackers to turn a public fix into a working attack. Sansec, a security firm, expected mass attacks within 15 minutes of the release, Wired reported. 15 minutes. That’s insane. This won’t be the last PHP vulnerability to move that fast, and very few sites get patched that fast by someone who logs in when they remember to.
Most of the sites we worry about this week aren’t badly built. They’re sites nobody is assigned to. The owner assumes the host has it, the host assumes the developer has it, and the developer moved on two years ago. The businesses that got through today without a scramble already knew their PHP version and who to call. Monthly WordPress security updates and a host that keeps the server itself up to date cover most of it, and tested backups cover the rest. Our post on WordPress security for business owners goes deeper on all of it.
That gap is why our Partnership Plan exists. One team handles your managed WordPress hosting, the monthly core, theme, and plugin updates, firewall and malware protection, daily backups, and a set of discounted support hours each month, and that team knows your site. Plans start at $175 a month and run month to month, with 30 days’ notice to cancel. Most of our partnerships start with a site someone else built, so it doesn’t matter who built yours. If you only want the upkeep, our WordPress maintenance page covers that.
If today left you unsure where your site stands, send us a note, and we’ll talk it through. No pressure either way.
Our goal is your stability. We’ll keep watching this one, and you know where to find us.
Quick answers
What is PHP2Shell?
PHP2Shell is the name Wiz researchers gave their exploit for two PHP vulnerabilities made public on October 21, 2026, CVE-2026-109618 and CVE-2026-109619. Both let someone with no login run code on a server that’s on an unpatched version of PHP.
Is my WordPress site affected by the PHP vulnerabilities?
If your site runs on a server with a version of PHP that hasn’t been updated, yes. That covers most self-hosted WordPress sites. Automattic said sites hosted on WordPress.com and Tumblr are safe, according to Reuters. You can find your PHP version under Tools, Site Health, Info, Server, and your host can tell you whether it’s been patched.
Is PHP 7.4 safe to run?
No. PHP 7.4 stopped getting official security updates in 2022, and it’s vulnerable to PHP2Shell. The PHP team did publish a bare-bones patch for it, but a site on 7.4 should be planning an upgrade to a supported version.
What PHP version should my WordPress site run?
A supported one, meaning PHP 8.2 or newer, updated to at least 8.2.35, 8.3.36, 8.4.27 or 8.5.12. Newer is better, as long as your theme and plugins have been tested on it first.
