"php2shell": Why Every PHP and WordPress Site Owner Should Check Their Hosting Now

What happened

On October 21, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) published an alert titled "Critical Vulnerabilities in PHP Require Immediate Patching". It describes two vulnerabilities in PHP, the programming language that powers a large share of the web, including WordPress and many other content management systems and e-commerce platforms.

According to CISA, the vulnerabilities allow unauthenticated remote code execution. In plain language, an attacker who can reach a vulnerable website may be able to run their own commands on the server without logging in. CISA lists affected setups including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.

CISA updated the alert on October 23 with detection guidance, and on October 26 added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. Inclusion in the KEV catalog means CISA has evidence that the vulnerabilities are being exploited.

If your website runs on PHP, this is not a "when you have time" update. It is a "today" update.

Does this affect my website?

Possibly, even if you have never heard of PHP. It is commonly used by:

• WordPress, WooCommerce, and most WordPress plugins.
• Other popular content management systems and forum software.
• Many shared and managed hosting control panels.
• Custom websites and booking systems built in PHP frameworks.

If your site is built on a JavaScript framework and deployed as static files, or runs entirely on a hosted platform where you never manage the server, your exposure may be lower. But many businesses have older subdomains, landing pages, or forgotten installs that still run PHP. CISA itself notes that PHP is often a component of other software and may not be directly visible.

What to do today

1. Find out where PHP runs

Make a quick list of every website and web application your business operates: the main site, any shop, booking pages, client portals, staging sites, and old campaign microsites. For each, find out what it is built on and who hosts it.

2. Check the PHP version

Most hosting control panels show the PHP version per site, often under a "PHP settings" or "Software" section. WordPress also shows the server's PHP version under Tools, then Site Health, then Info. Compare against the fixed versions listed by CISA: 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or later in the same branch.

3. Ask your host directly

If you are on managed or shared hosting, the provider usually controls the PHP binaries. Contact support and ask three specific questions:

1. Have you patched CVE-2026-109618 and CVE-2026-109619 on the servers hosting my sites?
2. Which PHP version is each of my sites running now?
3. Do you have any indication that my sites were targeted?

A good host will answer clearly and quickly. Keep their reply for your records.

4. Update anything you control

If you run your own server or VPS, update PHP through your package manager or distribution's security updates as soon as possible, prioritising internet-facing systems. Restart PHP services afterwards so the new version is actually in use.

5. If you cannot patch immediately

CISA advises that organisations unable to update immediately, or still on PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated. CISA also notes that a web application firewall may provide some protection in the meantime, but it is not a substitute for patching.

Signs to watch for

CISA recommends monitoring for suspicious activity, such as PHP worker processes launching shells or downloading tools. For a typical small business without a security team, practical warning signs include:

• Unfamiliar files appearing in your website directories.
• New administrator accounts you did not create.
• Unexpected redirects, spam pages, or pop-ups on your site.
• Your host notifying you of unusual resource usage or outbound traffic.
• Search Console warnings about hacked content.

If you notice any of these, contact your host and a security professional, change passwords for hosting, CMS, database, and email accounts, and restore from a known-good backup once the server is patched.

A patched server with a tested backup is the difference between a bad afternoon and a bad month.

The bigger lesson: keep an inventory and a patch routine

Vulnerabilities like this appear regularly across all software. The businesses that handle them calmly share three habits:

1. An inventory. They know which sites, plugins, and services they run, and who is responsible for each.
2. A patch routine. Updates are applied on a schedule, with urgent security fixes fast-tracked.
3. Backups that work. Daily off-site backups, with restores tested at least a few times a year.

October is also Cybersecurity Awareness Month. CISA's core steps for everyone remain simple: avoid and report phishing, use strong passwords and a password manager, turn on multi-factor authentication, and keep software updated. Most small business incidents still begin with one of those basics being skipped.

A step-by-step checklist for site owners

Work through this list today, or hand it to whoever manages your hosting.

1. Find out which PHP version your site runs. Most hosting control panels show this, or your host's support team can tell you.
2. Read the official advisory. Check the CISA alert linked above and your host's own announcements for the affected versions and fixes.
3. Confirm whether your host has patched. On shared or managed hosting, the provider usually updates PHP. Ask them directly and keep their answer.
4. Update your CMS, themes and plugins. Even if PHP is patched, outdated WordPress components remain a common route in.
5. Take a fresh backup and store it off the server. Make sure you know how to restore it.
6. Change key passwords. Update hosting, database, admin and SFTP passwords, and enable multi-factor authentication where it is available.
7. Review admin users. Remove accounts you do not recognise or no longer need.
8. Check for unexpected files. Look for recently modified files in your web folders, especially unfamiliar PHP files in upload directories.
9. Set a reminder to check again. Advisories are sometimes updated as more details emerge.

Patching is not a project. It is a habit, and the sites that stay safe are the ones where someone owns that habit.

Shared, managed and self-managed hosting: who is responsible?

Responsibility depends on the type of hosting you use.

Shared hosting. The provider manages the server and PHP. You are still responsible for your website's software, accounts and backups.

Managed WordPress hosting. The provider often handles PHP, some WordPress updates and backups. Confirm exactly what is included, because plugin and theme updates are not always covered.

VPS or dedicated servers. If you or your developer manage the server, you are responsible for applying PHP updates yourself. This is where delays most often happen.

If you are unsure which category you are in, find out today. That single answer tells you who needs to act.

If you think your site was compromised

Do not panic, and do not start deleting files at random. Take a copy of the current site and logs for investigation, then restore from a known clean backup if you have one. Change all passwords after restoring, update everything, and ask your host for help reviewing access logs. If the site handles customer data, take advice on any notification obligations that may apply in your location.

Building a simple patch routine

A one-off fix solves today's problem. A routine prevents the next one. For most small businesses, a monthly rhythm works well. Once a month, check for core, theme and plugin updates, apply them on a staging copy first if your site is complex, confirm the live site works after updating, and review your backup logs. Subscribe to your host's status and security announcements, and to the CISA alerts feed if you want early notice of serious issues. Write the routine down so it does not depend on one person remembering it, and record what was updated and when.

Reducing your exposure in future

Every plugin, theme and unused tool on a server is something that can need patching. Remove plugins and themes you do not use rather than simply deactivating them. Prefer well-maintained components with a clear update history. Limit who has administrator access, and give people only the permissions they need. Consider a web application firewall from your host or a reputable provider, and make sure uptime and security monitoring alert a real person who will act.

Talking to your host

Hosting support teams deal with advisories like this regularly. Contact them with specific questions: which PHP version are we on, has it been patched, and when? Keep their written answer with your records. If your host cannot answer clearly, that may be a sign to review whether your hosting arrangement still fits your needs.

Frequently asked questions

My site is on Shopify or another hosted builder. Do I need to worry? Fully hosted platforms manage their own server software, so this specific issue is generally handled by the provider. It is still worth keeping your account secure with strong passwords and MFA.

Will updating PHP break my site? It can, if your theme or plugins are very old. That is why backups and a staging site matter. Most hosts let you test a version change before applying it to the live site.

How do I know if I am affected? Check the advisory for affected versions and compare them with the version your server runs. Your host can confirm this for you.

Can you check our site for us? Yes. Our hosting and security services include patch management, backups and monitoring. If you need urgent help, contact us.

How we can help

If you are not sure whether your sites are affected, our team can check your hosting setup, PHP versions, and WordPress installs, and help you patch safely. See our website maintenance, WordPress hardening and website security, website security and uptime monitoring, and backup and recovery readiness services, or book a discovery call.

Sources: CISA alert, "Critical Vulnerabilities in PHP Require Immediate Patching", October 21, 2026, last revised October 26, 2026; CISA Cybersecurity Awareness Month.