Two serious flaws in PHP were fixed on Wednesday 21 October. PHP runs WordPress and a lot of small business websites. Here's what it means for yours, what you can check today, and how I can help if you'd rather hand it over.
Written by Olly Gore, Goreblimey, Cheltenham. Correct at 10.20pm on Sunday 25 October 2026, and updated as news comes in. Get updates by email.
PHP is the programming language that runs WordPress, Drupal and Joomla, plus a lot of online shops, booking systems and older custom-built sites. If you log in to your website at /wp-admin, it runs on PHP.
Two flaws in PHP itself let someone send a specially made request to a website and run their own code on the server, without logging in. That's as serious as it gets. Code on your server can change your pages, hide a back door, send spam or read customer details.
Security researchers at Calif, OpenAI and Wiz, among others, found the flaws and reported them to PHP privately. Cloudflare says they leaked before the planned release date, and PHP released its fix on Wednesday 21 October.
Amazon's threat intelligence team saw an attempt to use the flaws on 17 October, before anything was public. On 21 October it said it was seeing broad attempts to use them in the wild, and that anyone checking for a break-in should look back to 17 October. No confirmed break-ins have been published yet. The UK's National Cyber Security Centre (NCSC) is telling organisations to update, to look for back doors if they can't update straight away, and to consider taking a system offline if they can't protect it quickly.
PHP2Shell is still moving. Hosts are rolling out the fix, and the advice may change. I'll update this page as news comes in. Leave your email and I'll let you know when something changes what you should do.
I'll stop when the story does, and you can reply "stop" to any update to come off the list sooner. Privacy policy.
123Updating PHP stops anyone new getting in this way. It doesn't remove anything that got in before the update. If someone used the flaw first, they may have left a file or a login behind so they can come back whatever you patch. So a proper fix is two jobs: update PHP, then check nothing's been left behind.
Find the one that sounds like you.
Your host runs PHP for you, so updating it is their job. 20i and IONOS say they've finished. Check yours has, then check nothing got in before they did.
Older sites often run older PHP. On 8.1 or earlier there's no new PHP release, only patches that have to be built by hand. Some hosts have applied them. If yours hasn't, that's the case I'd worry about most.
A VPS or cloud server that you or a previous developer set up. Nobody updates PHP on it unless you do. Do it today, or ask whoever set it up.
WooCommerce, Magento, PrestaShop, OpenCart and most other shop software run on PHP. Same fix, higher stakes: orders and customer details. Look closely at your checkout pages too.
If someone built it for you, there's a good chance it's PHP. Ask them which version it runs and whether it's been updated.
Don't just update and move on. Take a backup and note what you've seen, then get it updated and checked for back doors.
You don't run PHP yourself, so there's nothing for you to update. The platform looks after its own servers.
Most people don't know, and that's fine. Check 1 below tells you in a couple of minutes, or send me the address and I'll find out.
Six checks you can do yourself, in this order. If any of it feels like too much, send it my way.
In WordPress, go to Tools, then Site Health, then Info, and open Server. It lists the PHP version. In a hosting control panel such as cPanel, look for Select PHP Version or MultiPHP Manager. Or ask your host.
The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Match the first two numbers: on 8.3 you need 8.3.36 or higher, on 8.4 you need 8.4.27 or higher, and so on. Some hosts add the fix without changing the number, so if yours looks lower, ask before you panic. On 8.1 or older there's no new release, so ask your host whether they've applied PHP's patches.
Send the message below from your hosting account, so the answer's on record.
Before anyone changes anything. Use your host's backup tool or a backup plugin, then download a copy so it isn't only on the same server.
Go through the list below. Most take a few minutes. The file-date and log checks are easier for your host or developer.
Your hosting account, FTP or SFTP, and WordPress admins. Leave the database password to your host or developer, because WordPress needs it changing in its settings file too, or the site stops working. Turn on two-step login where you can. Do it after the fix, not before, or someone already inside could pick up the new ones too.
Copy this into your host's support form or email. Put your own web address in.
Hello, could you confirm whether the PHP running my website, [your web address], has been updated for CVE-2026-109618 and CVE-2026-109619 (PHP2Shell)? If it hasn't, when will it be? And which PHP version is my site using? Thanks.
Found something? Don't start deleting. Take a backup first and get help. What's been left behind shows how they got in, and what else to check.
I've built and looked after PHP and WordPress sites since 2011. If you'd rather hand this over, this is what I do.
Send me your web address and what's worrying you. I'll get back to you straight away, and if there's nothing to worry about, I'll say so.
Rather email? olly@goreblimey.com. I'll only use your details to reply about this. Privacy policy.