PHP2Shell: Is Your Business Website Patched? A Plain-English Check for UK Owners
On Wednesday 21 October, the people who maintain PHP released an emergency fix for two flaws that let a stranger take control of a web server without logging in. The same day, ahead of the fix, dozens of UK and European government and police websites went offline, with Finland shutting its public government services and the Dutch cyber agency pulling its own site.
If your business website runs on WordPress, WooCommerce, Joomla, Drupal, Magento or most shared hosting, it runs on PHP. That makes this your problem as well, and it has one awkward detail most owners miss: updating WordPress does not fix it.
This post explains what happened, who is responsible for patching your site, and the five checks to do this week.
What happened
PHP is the programming language underneath a large share of the web, including every WordPress site. On 21 October the PHP project published a critical security advisory for two vulnerabilities, now known as PHP2Shell:
| CVE-2026-109618 | CVE-2026-109619 |
|---|---|---|
What it is | PHP can be pushed to run out of memory mid-request, leaving its internal data half set up. The clean-up step then trusts that broken data. (advisory) | Data from one visitor's request can outlive the memory behind it, and a later request on the same server process reads it. (advisory) |
Severity | Critical, 9.2 out of 10 (CVSS v4.0) | Critical, 9.2 out of 10 (CVSS v4.0) |
What an attacker gets | Runs their own commands on your server, no password needed | Runs their own commands on your server, no password needed |
"Remote code execution without authentication" is the worst category there is. It means someone on the internet can send your website a crafted request and end up running commands on the machine it lives on. From there they can read your customer database, plant a card skimmer on your checkout, send spam from your domain, or quietly install a backdoor to use later.
PHP says the risk is highest for servers running Apache with mod_php, a common setup on older and shared hosting, where it has a working exploit that fires before your website's own code even runs. PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are also affected.
Is anyone actually being attacked?
Amazon's threat intelligence team recorded an exploitation attempt on 17 October, four days before the flaws were made public. Somebody had the details early.
The US cyber agency CISA said on 21 October that it had not yet seen successful exploitation, but called the flaws a serious risk if left unpatched. The UK's National Cyber Security Centre told organisations to find every system running PHP and update it, and to consider taking a site offline if it cannot be fixed straight away.
When national cyber agencies say "consider switching it off", it is not a routine patch.
Why WordPress updates won't save you
This is the part that catches small businesses out.
Most WordPress owners have learned one security habit: keep WordPress and the plugins updated. That habit is good, and it does nothing here. The flaw is in PHP, the layer underneath WordPress. WordPress's automatic updates can't touch it, and neither can a security plugin installed inside WordPress.
The fix has to come from whoever runs the server your site sits on. For most UK small businesses that is one of three people:
How your site is hosted | Who installs the PHP fix | What you do |
|---|---|---|
Shared or managed hosting (e.g. a hosting package with cPanel or Plesk, or a managed WordPress host) | Your hosting company | Ask them, in writing, to confirm your PHP version is patched |
A server your developer or agency set up (a VPS, a cloud server, a Docker container) | Your developer or agency, unless your contract says otherwise | Ask them to confirm the PHP version and that they restarted PHP afterwards |
A server you look after yourself | You | Update PHP through your package manager or rebuild your container image, then restart |
Many large hosts patched within hours. SiteGround, for example, says the fix is applied across all its servers. But "most hosts have patched" is not the same as "my site is patched", and the businesses most at risk are the ones where nobody is quite sure who looks after the server.
The five checks to do this week
1. Find out which PHP version your site runs. Your hosting control panel usually shows it, often under "PHP version" or "PHP selector". In WordPress, go to Tools → Site Health → Info → Server. You are safe from these two flaws on:
- PHP 8.5.12 or later
- PHP 8.4.27 or later
- PHP 8.3.36 or later
- PHP 8.2.35 or later
One catch: some Linux distributions ship the fix under their own version numbers, so a version number alone isn't proof either way. If yours doesn't match the list, ask your host before you panic.
2. If you're on PHP 8.1, 8.0, 7.4 or older, treat it as urgent. These versions are no longer supported by PHP and got no official fix. Some hosts and Linux vendors have backported one; many haven't. CISA's advice for unsupported versions is blunt: take the system offline until it is updated. An old site on old PHP needs moving to a supported version, which can break old plugins, so it is a job to plan rather than a button to press.
3. Get confirmation in writing. Email your host or developer: "Please confirm the PHP version on our server, that it includes the fixes for CVE-2026-109618 and CVE-2026-109619, and that PHP was restarted after updating." The restart matters. A server keeps running the old, vulnerable copy until PHP is restarted.
4. Don't rely on a quick config fix. Some guides online suggest switching off a PHP setting called session.upload_progress as a workaround. PHP itself says there is no complete mitigation and updating is the only safe option. Cloudflare and other firewall providers have added rules that block the known attacks, which buys time, but the NCSC and CISA both treat them as a stopgap, not a fix.
5. Check whether anyone got in first. Somebody was trying this before the fix existed, and patching closes the door but doesn't evict anyone already inside. The NCSC advises checking for backdoors. For a small business site, that means asking whoever looks after it to look for:
- WordPress admin accounts nobody recognises
- unfamiliar
.phpfiles in the uploads folder, which should only hold images and documents - recent changes to your checkout or payment pages
- unexpected scheduled tasks or outbound connections on the server
If you take card payments on the site and find anything odd, tell your payment provider. If you find evidence that customer data was accessed, you have 72 hours to report it to the ICO where it poses a risk to people.
The bigger lesson: know who owns your server
PHP2Shell will be patched and forgotten within a month. The weak spot it exposed will still be there.
Plenty of UK small businesses had a website built years ago by a freelancer or an agency who has since moved on. The hosting account sits on someone's personal card, the login is in an old email, and nobody owns the layer between "the website" and "the internet". It works fine until a week like this one, when the question "who patches our server?" has no answer.
Three things are worth sorting once this week's checks are done:
- Write down who is responsible for the server, not just the website, and make sure your contract or hosting plan says so.
- Keep the hosting account in the business's name, with the logins somewhere the business controls.
- Know your PHP version, and when it reaches end of life. PHP 8.2 stops getting security fixes on 31 December 2026. If you're on it now, plan the move before next time.
Not sure where your site stands?
Tell us who hosts your website and what support you have today. We can agree which checks are needed, who should carry them out and what ongoing maintenance would cover.
Talk to us about managed support, or use the call link below to discuss your setup.
Facts in this post are taken from the PHP project, the NCSC and CISA as of 26 October 2026. PHP published a further, lower-risk informational advisory on 23 October that affects only unusually configured sites. If anything changes materially, we'll update this page.
Odoo Community Edition: What It Can and Can’t Do for Your Business
What Odoo Community Edition actually includes, what’s Enterprise-only, the real cost of self-hosting, and when free is the smarter choice for your business.