If you run a website for your business — a WordPress site, an online ordering page, a booking form — there’s a decent chance it depends on a programming language called PHP without you ever knowing it. That usually doesn’t matter. This week, it does.
On October 21, 2026, security researchers and government agencies around the world sounded the alarm on a pair of critical vulnerabilities in PHP, nicknamed “php2shell” (formally CVE-2026-109618 and CVE-2026-109619). The flaws let an attacker take over a web server remotely, without a password, and they sit in the software that powers roughly 70% of all websites on the internet. The U.S. Cybersecurity and Infrastructure Security Agency issued an emergency advisory urging immediate patching, and within 45 minutes of the details going public, Cloudflare recorded tens of thousands of exploit attempts against sites on its network — a number that climbed into the millions within days, according to reporting from The Conversation. European government agencies and even the Port of Rotterdam pulled systems offline as a precaution.
That’s the kind of headline that’s easy to scroll past if you’re not a developer. But if your business website runs on WordPress — which a large share of small business sites do — this is worth five minutes of your attention today.
Why This One Is Different From the Usual “Update Your Plugins” Advice
Most of the security advice small business owners get about their website boils down to “keep WordPress and your plugins updated.” That’s still good advice, but it won’t fix this particular problem. php2shell isn’t a bug in WordPress, Drupal, or any plugin — it’s a flaw in PHP itself, the underlying engine that runs those applications on the server. Patching WordPress core or a plugin does nothing to close this hole, because the vulnerability lives one layer below, in the software your hosting provider installed to run PHP in the first place.
That distinction matters because it changes who’s actually responsible for fixing it. If you built your own site on a server you manage, the responsibility is yours. If you’re on shared or managed hosting — which covers most small business websites — the fix has to come from your host.
Does This Actually Affect Your Website?
Work through this quickly:
- Shopify, Wix, or Squarespace: These platforms don’t run on PHP the way a self-hosted site does, and the vendor handles server-level patching for you. You’re very unlikely to need to do anything, though a quick check of their status pages costs nothing.
- Self-hosted WordPress on shared hosting (Bluehost, GoDaddy, SiteGround, etc.): This is the group most exposed. Your hosting company controls the PHP runtime, and you need to confirm they’ve patched it.
- Managed WordPress hosting (WP Engine, Kinsta, Flywheel, etc.): These providers typically patch runtime vulnerabilities quickly and communicate with customers when they do — but don’t assume. Check for an email or status update from them dated around October 21–23.
- A custom site built by a freelancer or agency: Contact whoever maintains it and ask directly whether the server’s PHP version has been updated.
What to Actually Say to Your Host or Developer
Don’t just ask “are we safe?” — ask the specific question: “Has the PHP version on our server been updated to address CVE-2026-109618 and CVE-2026-109619 (php2shell)?” According to CISA’s guidance, the fix requires upgrading to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 (or a distribution’s backported equivalent), and then restarting the web server processes — not just clicking “update” in a WordPress dashboard.
If your site is running on PHP 8.1 or earlier, there’s no patch available for those versions at all. CISA’s recommendation in that case is blunt: take the site offline until it’s upgraded to a supported, patched version. That’s a hard conversation to have with a host, but it’s a much easier one than explaining a data breach to your customers.
Signs Something Already Went Wrong
If you can’t get confirmation that your server was patched before this week, it’s worth having someone technical check for red flags: unexpected admin accounts on your WordPress site, new files in your plugin or theme directories you didn’t add, unusual outbound traffic reported by your host, or customers reporting strange redirects when visiting your site. None of these are definitive on their own, but any of them combined with an unpatched server is worth escalating immediately — most hosting providers have a security or abuse team you can contact directly, even on a basic plan.
What to Do Before the Week Is Out
- Identify what your site actually runs on (ask your web person if you’re not sure).
- If it’s self-hosted PHP or WordPress on shared/managed hosting, email or call your host today and ask the specific patch-version question above.
- Get the answer in writing — a support ticket number or email confirmation, not just a verbal “yeah we’re on it.”
- If you manage your own server, patch now and don’t wait for a maintenance window.
- Rotate admin passwords for your website and hosting account as a precaution, especially if you’ve reused them anywhere else.
This is the kind of event that mostly resolves itself at the hosting-company level — but “mostly” isn’t “entirely,” and the businesses that get burned in events like this are almost always the ones that assumed someone else was handling it without checking. A five-minute email today is a lot cheaper than cleaning up a compromised website and explaining it to customers next month.
