This story is still developing, and we'll update this post as hosting companies and the PHP project share more.
On October 21, 2026, the PHP project released emergency security updates for two critical vulnerabilities. Their official names are CVE-2026-109618 and CVE-2026-109619, and security researchers have nicknamed them "PHP2Shell." If your business has a WordPress website, it almost certainly runs on PHP. That makes this worth a call to whoever looks after your hosting this week.
No need to panic, though. Here's what's going on in plain English, and what to do about it.
What is PHP?
If WordPress is the car, PHP is the engine under the hood. It's the software on your web server that actually runs WordPress, your theme and your plugins every time someone visits your site. Plenty of other website platforms and online stores run on it too.
These problems are in PHP itself, not in WordPress. So that reassuring "everything is up to date" message in your WordPress dashboard doesn't cover it. Keeping WordPress and your plugins updated is still a good idea, but here it's a bit like getting a fresh paint job when the recall notice is for the engine.
How serious is this?
Pretty serious. The PHP project's security advisory says both flaws can allow "unauthenticated remote code execution." In other words, under the right conditions, someone who has never logged into your site could run their own code on your web server.
That said, running PHP doesn't mean your site has been hacked, or even that it can be. Hosting companies have already started rolling out fixes. You also can't tell by looking: an unpatched site looks exactly like a patched one. Cloudflare has reported attack traffic targeting these vulnerabilities. With the details now public, this one shouldn't sit on the back burner.
How it gets fixed
The PHP project released fixed versions on October 21, 2026: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The PHP Foundation didn't mince words: "it is imperative that you update now." The PHP project also says there's no complete workaround. Updating is the only safe choice.
Checking whether your site has the fix isn't as simple as looking up a version number, though. Many hosting companies don't install PHP straight from the PHP project. They use their own builds, and they often patch older versions without changing the version number. So a site that reports an older-looking version might actually be protected. And a site showing a newer version might not be, if the host hasn't installed the update yet.
You can see your site's PHP version in WordPress under Tools → Site Health → Info → Server, and some online checkers will guess at it too. Those are useful clues, but the real answer has to come from your host. Ask them: "Has the security fix for CVE-2026-109618 and CVE-2026-109619 been installed on the server that runs my site?"
There's good news in this, too. Many hosts update PHP on their own, so a website nobody has touched in three years may already be patched. The reverse is also true, though: a perfectly maintained WordPress dashboard tells you nothing about the server underneath it.
Older websites need more care
If your website was built years ago, it may still be running an older version of PHP, such as 7.2 or 7.4. The PHP project stopped updating those a while ago, which is a problem in its own right. But "unsupported" doesn't always mean "unpatchable." Some hosting companies and commercial support vendors provide emergency fixes for older versions. If your host can confirm one of those is installed, you've bought some time to bring the site up to date properly, rather than in a hurry.
Bringing an older site up to date takes some care. Installing a security fix within the version a site already uses is generally the gentler step. Moving an older site from PHP 7 to PHP 8 is a bigger move. Plugins, themes or custom code that have worked fine for years can suddenly break, and your contact form may quit right when you'd like customers to be able to reach you. That's not a reason to avoid upgrading, just a reason to test first.
Most hosting control panels, including GoDaddy, cPanel, Plesk and the managed WordPress services, have a setting for choosing a PHP version (here's GoDaddy's guide for Managed WordPress). That setting only picks from versions the host has installed, so choosing a newer number doesn't confirm the security fix is there. And switching an older site to a newer version without testing can cause exactly the problems above.
How we can help
If you're not sure who manages your hosting, or what any of this means for your site, that's where we come in. We can:
- Find out where your website is hosted and what PHP setup it's running
- Work with your hosting provider to confirm the fix is installed, or get it arranged
- Back up your website and its database before anything changes
- Test bigger PHP upgrades on a staging copy of your site first
- Track down and fix outdated plugins, themes or custom code that don't get along with newer PHP
- Check that contact forms, email delivery, file uploads and checkout pages still work afterward
- Help plan a move to a new host if your current one can't offer a good solution
How much work this takes depends on your hosting and the shape your website is in. Sometimes it's a quick confirmation from the host. Sometimes an older site needs more care to bring up to date.
If you're not sure who's in charge of your website, or you'd like a hand checking and updating it, contact us and we'll help you sort it out.