If you run a website, you may have had an email this week warning about two critical security flaws in PHP, known as PHP2Shell. The short version: it’s serious, but the fix is already out, and for most WordPress sites it’s a quick update for your hosting provider.
This post explains what PHP2Shell is, whether it affects you, and exactly what to check – in plain English.
What is PHP2Shell?
PHP is the programming language that powers WordPress and a huge share of the web. PHP2Shell is the nickname for two security holes in PHP itself, made public on 20 October 2026 and fixed the following day. (If a customer or IT team asks, the official reference numbers are CVE-2026-109618 and CVE-2026-109619.)
Why it’s serious:
- No login needed – a hacker can take over the computer your website runs on (the server) without needing a password, if it hasn’t been updated
- It’s not about your website’s code – the flaw sits in PHP, so a perfectly maintained WordPress site with every plugin updated is still exposed if the server’s PHP hasn’t been updated
- Attacks have already started – security firms saw hackers trying it before the fix was even released, and ready-made hacking tools are now freely available
If exploited, an attacker could steal data, change your site’s content, or use your site to send visitors to fake login pages or harmful downloads.
Who is affected?
If your website is built with WordPress (including WooCommerce shops), it runs on PHP and could be affected until your hosting provider updates it. It doesn’t matter which theme, page builder or plugins you use.
If your site is on Wix, Squarespace or Shopify, the platform looks after its own servers, so there’s nothing for you to do.
The fix is in these PHP versions:
| If your PHP version starts with | It’s safe if it’s at least |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
| 8.1 and older | No fix – move to a supported version |
That last row matters. PHP 8.1, 8.0 and all 7.x versions are no longer supported, so they won’t receive this fix. Sites still running them need moving to a newer version, ideally after testing on a copy of the site first.
What to do if you own a website
You can’t fix this from inside WordPress – PHP is part of the server, so it’s your hosting provider’s job. Here’s what to do:
- Check your PHP version (see the next section) – if it’s on the safe list above, you’re covered.
- If it isn’t, contact your host and ask them to confirm the PHP update is installed and active, not just scheduled. Not sure who your host is? Check who you pay for hosting, or ask whoever built your website.
- Check your host’s status page or blog first – most have already published a statement this week.
- On PHP 8.1 or older? Ask your host to move your site to PHP 8.3 or 8.4. Get a backup taken first, as older plugins and themes sometimes need updating to work on newer PHP.
- If your site uses Cloudflare (a security and speed service – your web developer will know), you have an extra layer of protection, as Cloudflare is blocking this attack for all its customers, including free accounts. It’s not a replacement for updating, but it helps.
If your host can’t update promptly, it’s reasonable to ask whether the site should be taken offline until they can – especially if it handles customer data or payments.
Supplying public sector organisations? Some councils and NHS bodies are asking suppliers to confirm they’re protected. The PHP version number from your site is good evidence, but they may also want written confirmation from your host.
How to check your PHP version in WordPress
It takes under a minute:
- Log in to your WordPress dashboard.
- Go to Tools > Site Health.
- Click the Info tab.
- Open the Server section and look at the PHP version line.
Compare the number with the table above. For example, 8.3.36 is safe, but 8.3.33 isn’t yet.
One caveat: some shared hosts use their own custom builds of PHP, where the version number doesn’t always show whether the fix is included. If your number looks old but your host says you’re patched, their confirmation is the one to trust.
Signs your site may have been compromised
Updating stops new attacks, but it won’t undo one that already happened. Because attacks began before the fix was released, it’s worth a quick look for:
- Administrator accounts you don’t recognise – check Users and filter by Administrator
- Unexpected redirects – visitors being sent to other sites, especially from Google results or on mobile
- New pages, posts or links you didn’t add, often spammy or in another language
- Warnings from Google or your browser that the site is unsafe
- Unexplained slowdowns or a jump in server usage
If you spot any of these, don’t just delete the obvious problem – get your developer or host to investigate, as attackers usually leave more than one way back in.
As a precaution, ask your developer to reset your WordPress security keys. This logs everyone out and means anyone who stole a login can’t keep using it.
If you’re just visiting websites
There’s nothing to install on your own computer or phone – PHP runs on web servers, not on your device. Just stay alert for the next few weeks:
- Be wary of unexpected downloads, pop-ups or redirects, even on sites you know well
- Be suspicious if a familiar site suddenly asks you to log in again or enter payment details
- If something looks off, close the page rather than clicking through
Sites hosted with Sitecrafter
If your website is hosted with Sitecrafter, you’re already protected. The security fixes were installed on all our servers as soon as they were released, and we’ve checked every server for signs of compromise. There’s nothing you need to do.
If your site is hosted elsewhere and you’d like a second pair of eyes – or help getting a straight answer from your host – get in touch and I’ll take a look.
