PHP2Shell: What Small Business Website Owners Need to Do Right Now
Updated October 30, 2026
If you heard that “most of the internet” had a security emergency last week and wondered whether your business website is affected, this is for you. The short answer: if your website runs on WordPress or almost any other common platform, PHP2Shell applies to you, and there are a few things you should check today.
Here’s what happened, what it means for a small business website, and a plain-English checklist to make sure you’re protected.
What is PHP2Shell?
PHP2Shell is the nickname for two critical security flaws in PHP, the programming language that runs behind the scenes on most websites. They are officially tracked as CVE-2026-109618 and CVE-2026-109619.
PHP powers roughly 69% of websites whose server language is known, according to W3Techs. It runs WordPress, Joomla, Drupal, WooCommerce and Magento, plus the contact forms, logins and checkouts on millions of small business sites.
The flaws let an attacker send a specially crafted request to a website and run their own code on the server. No password or login is needed. Once in, an attacker could change your pages, add themselves as an admin, read customer data from your database, or take the site offline.
Timeline: how PHP2Shell unfolded
- August 2026: Security researchers privately report the flaws to the PHP team.
- October 17: Amazon’s decoy servers record an exploit attempt, days before any public announcement.
- October 20: Details leak online ahead of schedule.
- October 21: PHP releases emergency fixes. Government agencies, banks and retailers in several countries take sites offline as a precaution while they patch. Cloudflare switches on firewall protection for its customers.
- October 22: Cloudflare reports exploit attempts climbing into the millions. Wordfence reports more than 74,000 blocked attempts against WordPress sites.
- October 23: PHP discloses a related third flaw (CVE-2026-115560) with a temporary workaround.
- October 27: The US Cybersecurity and Infrastructure Security Agency (CISA) confirms the PHP2Shell flaws are being exploited in real attacks.
Is my small business website affected?
If your site runs on PHP and hasn’t been updated to a patched version, yes, it’s exposed. The important thing to understand is where the fix has to happen.
Updating WordPress and plugins will not fix it
This is the most common misunderstanding. PHP2Shell sits underneath WordPress, so clicking “Update all” in your dashboard won’t protect you. The fix has to be applied to PHP itself on your server. Keep updating WordPress anyway, but don’t assume it covers this.
If you’re on shared or managed hosting
If you pay a hosting company like Bluehost, SiteGround, Hostinger or GoDaddy for standard hosting, your host is responsible for patching PHP, and most major hosts rolled out fixes within a day or two. You should still confirm it (see the checklist below).
If your site is on a VPS or cloud server
If your website runs on a virtual private server (DigitalOcean, Vultr, Linode, AWS and similar), often managed through a panel like ServerAvatar, RunCloud, Cloudways or cPanel, patching may be your job, or your developer’s. This is where unpatched sites are most likely to be hiding.
If you use Wix, Squarespace or Shopify
These platforms manage their own infrastructure. You don’t need to do anything.
6-step checklist: make sure your website is safe
1. Ask your host (or developer) directly. Send a one-line message: “Is my site running a PHP version patched for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)?” Any decent host will answer within hours.
2. Check your PHP version. In WordPress, go to Tools → Site Health → Info → Server. The patched versions released on October 21 are:
| PHP branch | Patched version (or newer) |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
| 8.1 and older | No patch. Upgrade to a supported version |
Some managed hosts patch older version numbers in place, so if your number looks old, check with your host before panicking.
3. If you’re on PHP 8.1 or older, upgrade. There’s no official fix for these versions. Test the upgrade on a staging copy first if you can, since very old themes and plugins sometimes break on newer PHP.
4. Turn off session upload progress (VPS owners). For the third flaw, PHP recommends setting session.upload_progress.enabled = Off in php.ini, then restarting PHP. WordPress doesn’t use this feature, so it’s safe to disable.
5. Put a firewall in front of your site. Cloudflare’s free plan includes PHP2Shell protection. It buys time while you patch but isn’t a substitute for patching.
6. Look for signs of a break-in. Check for admin users you don’t recognise (Users → All Users), unexpected new pages or files, and redirects to strange sites. Make sure you have a recent backup stored off the server before you change anything.
What this means for small businesses long term
PHP2Shell is a reminder that a website isn’t a one-off purchase. The software under every site needs regular updates, and the businesses that got caught out were mostly the ones where nobody was clearly responsible for maintenance.
Three takeaways for any small business owner:
- Know who maintains your site. If you don’t know who would patch it in an emergency, nobody will.
- Keep off-site backups. If the worst happens, a clean backup turns a disaster into an inconvenience.
- Don’t run an abandoned website. Sites built years ago and never touched are the most likely to run unsupported PHP versions.
Need help?
If you’re not sure whether your site is patched, or you’d rather someone else handled updates, backups and security, our website maintenance plans cover exactly that from $49 a month.
And if your current website is old enough that patching feels like propping up something that should be replaced (here’s what a website redesign costs), we’ll design your new homepage for free. No obligation. Don’t love it? You don’t pay a thing.
PHP2Shell FAQ
Can visiting a hacked website infect my computer through PHP2Shell?
No. PHP2Shell attacks the web server, not visitors’ devices. The risk is to the website and any customer data stored on it.
Does PHP2Shell affect WordPress sites?
Yes, if the server running WordPress uses an unpatched PHP version. WordPress itself isn’t the flaw, which is why updating WordPress or plugins alone doesn’t fix it.
Has anyone actually been hacked through PHP2Shell?
CISA confirmed on October 27, 2026 that the flaws are being exploited in attacks, and researchers have recorded successful takeovers of test servers. Millions of attempts have been blocked by firewalls, so patching quickly matters.
Which PHP versions fix PHP2Shell?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, all released on October 21, 2026. PHP 8.1 and older did not receive a fix.
Sources
- PHP.net security announcements (October 21 and 23, 2026)
- CISA Known Exploited Vulnerabilities catalog
- BleepingComputer: CISA confirms PHP2Shell vulnerabilities now exploited in attacks
- Hostinger: PHP2Shell, what website owners need to know
- Cybernews: Amazon and Cloudflare report PHP2Shell attack attempts
- W3Techs: usage statistics of PHP
Need a website that brings in inquiries?
Get a professional website, live in two weeks
We build fast, mobile-friendly websites for local businesses, planned around what you need your website to do. Five pages from $750, with unlimited revisions until you approve.
You’ll talk directly with Govind,
founder of Crazy Media Design.
$750
Five-page website · starting price
- Delivered in two weeks
- Unlimited revisions
- Mobile-friendly and fast
- You own your website
