PHP2Shell: Is Your Business Website at Risk?

On 21 October 2026, the people behind PHP released an urgent fix for two critical security flaws, now known as PHP2Shell. PHP is the software behind a large share of the web, including every WordPress site. On a website that hasn't had the fix, a stranger could run their own commands on the server behind it, without a password. Here's what that means in plain English, how to check your own site, and what to ask your web team this week.

What happened

PHP does the work behind the scenes on a large share of websites. It's what turns your pages, contact forms and online shop into something visitors can use.

On 21 October, PHP's developers released new versions that close two flaws, recorded as CVE-2026-109618 and CVE-2026-109619. Put simply, under certain conditions an attacker could send a specially made request to a website and run their own commands on the server behind it. They wouldn't need a password or an account, and PHP says every PHP installation that serves web pages is at risk.

Here's how fast it moved.

What it could mean for your business

Whoever gets into the server behind your website can often:

• Copy your data. Customer details, enquiries and orders stored on the server.
• Change your website. Add fake pages, plant harmful code or send your visitors to scam sites.
• Use your server against others. Spam sent from it can get your own emails blocked.
• Take you offline. Sometimes for days, while everything is cleaned up and rebuilt.

Google can also label a hacked site in its search results with the words "This site may be hacked", which turns customers away before they even visit. The clean-up usually costs far more than the update would have.

Is your website affected? Three questions for your web team

You don't need to be technical to check. Send these three questions to whoever looks after your website or hosting.

1. Does our website run on PHP?

WordPress, WooCommerce, Magento, Drupal, Joomla and Laravel all do, and so do many custom booking systems and customer portals. If your site is on a hosted builder such as Wix, Squarespace or Shopify, the platform looks after its own servers and there's nothing for you to update.

2. Which PHP version are we on, and does it include the 21 October fix?

A good host or developer can tell you in minutes. Check their answer against this:

Attack attempts began before the fix was public, so also ask them to check the site for signs of a break-in, not just install the update.

3. Is our version still supported?

If the answer is PHP 8.1 or older, the PHP project no longer releases updates for it. PHP 8.1 lost support at the end of 2025, and PHP 7.4, the last version of PHP 7, in November 2022. This time PHP's security team did publish basic code fixes for 7.4, 8.0 and 8.1, but they only help if your host or software supplier builds them in, and nothing was published for anything older. Either way, the lasting fix is an upgrade.

If nobody can give you a clear answer, that tells you something too: your website may have nobody looking after it.

The bigger risk: websites nobody updates

Well-run websites will get this fix quickly. The real danger is the large number of business sites that nobody updates.

PHP 7 and older stopped getting updates years ago, and another 14% or so of PHP websites run PHP 8.0 or 8.1, which are out of support too. The PHP project no longer releases updates for those versions, so those sites rely on their host or software supplier to apply fixes, or on an upgrade.

Owners usually put upgrades off for understandable reasons. The site works, the original developer has moved on, and an old plugin or theme might break on a newer version. But every year of delay makes the eventual move bigger, and it often ends up happening in a hurry, after something has gone wrong.

Why staying current pays off

• You get fixes as soon as they're out. Like the one for PHP2Shell.
• Your site stays quick. Newer PHP versions bring performance improvements, and speed matters to customers and to Google.
• New features are easier to add. Online booking, payments or an AI assistant fit far better on a modern platform.
• Planned upgrades cost less. An upgrade you plan is cheaper and calmer than an emergency repair.

The NCSC's advice to small organisations is simple: keep all your devices up to date, including the software and apps they use. Your website is part of that.

Get a free website review

We updated every website on our servers the night the fix came out, checked them for signs of a break-in, and none of them went offline. That's what good maintenance looks like: quick, planned and invisible to your customers.

Not sure where your website stands? Send us the address of a website you own or manage and we'll look at what anyone can see from the outside: the software and versions your site shows, its security certificate and signs of out-of-date plugins. It's a review of public information, not a security test, so it can't confirm whether the PHP2Shell fix is installed. Only whoever manages your server, usually your host, can do that. We'll tell you in plain English what we found and what to do first. It's free, with no obligation.

Ask for your free website review

If your website needs more than an update, our guide to building platforms that last explains how to break the rebuild cycle.