PHP2Shell is a critical security flaw in PHP, the software that runs on the hosting server behind most WordPress, Joomla and Drupal websites. Updating your website, theme or plugins will not fix it. The fix has to be applied to the server itself, by whoever hosts your site.
It is not often that a programming language makes the front page of the BBC, but PHP2Shell did this week. If you run a small business website, here is what it means for you in plain English, and what you should do about it.
What is PHP2Shell?
PHP2Shell is the nickname for two vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated critical. They could allow an attacker to run their own code on a web server without needing a username or password, which in practice means taking control of the server and every website on it.
Details of the flaws leaked online on 20 October 2026, before the planned announcement. The PHP team brought its fix forward and released patched versions on 21 October 2026.
Why updating WordPress won’t fix it
Most website owners are used to security updates arriving as WordPress, plugin or theme updates. PHP2Shell is different, because the problem sits one layer lower.
Think of your website as a shop and PHP as the building it trades from. Keeping WordPress and plugins updated is like keeping the shop fittings in good order. PHP2Shell is a fault in the building itself. However well kept the shop is, the building needs fixing, and that is the landlord’s job. For a website, the landlord is your hosting provider.
This applies to almost any website built on PHP, including:
- WordPress sites, including those built with Elementor, Divi or WooCommerce
- Joomla and Drupal sites
- Many online shops, booking systems and customer portals
- Custom PHP applications
Which PHP versions are affected?
The flaws affect a very wide range of PHP versions, going back as far as PHP 5. The PHP team has released fixed versions for the four branches it still supports:
| PHP branch | Fixed version (or newer) |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
PHP 8.1, 8.0, 7.x and older are no longer supported by the PHP project and will not get an official fix. Some Linux distributions and hosting platforms do release their own patched packages for older versions, so an older version number on its own does not always mean a server is unprotected. But if your site still runs on PHP 7.4 or similar, this is a good moment to ask your host what they have done, and to plan an upgrade.
Is it being exploited?
Reports are still developing. Some security firms have reported attack attempts, including one seen several days before the flaws were made public, while others had not yet seen confirmed attacks at the time of the patch. With a flaw this serious and this widely publicised, it is safest to assume attackers are scanning for unpatched servers now.
What should you do?
Send a short email to whoever hosts your website and ask two questions:
- Has the server my website runs on been patched for PHP2Shell?
- Which PHP version is my website running on?
If you are not sure who hosts your website, check who you pay an annual hosting bill to, or ask the web designer who built the site.
If the answer is vague, or your site is on an old PHP version with no plan to upgrade, treat that as a warning sign.
How to check your PHP version in WordPress
If you can log in to your WordPress dashboard, you can see the PHP version yourself:
- Go to Tools > Site Health.
- Click the Info tab.
- Open the Server section and look for PHP version.
Compare it with the table above.
If AGGIA IT hosts your website
The server hosting our clients’ websites has been updated to a patched PHP version. You do not need to do anything, but if you have any questions, please get in touch.
Frequently asked questions
Do I need to update WordPress to fix PHP2Shell?
No. PHP2Shell is a flaw in PHP on the hosting server, not in WordPress. Keeping WordPress and plugins updated is still important, but it will not fix this issue. Your hosting provider needs to update PHP on the server.
Is my website affected if it is not built with WordPress?
If your website runs on PHP, it may be affected. That includes Joomla, Drupal, many online shops and custom-built sites. Websites built purely on platforms such as Wix, Squarespace or Shopify are managed by those companies, who are responsible for their own servers.
What if my site uses an old PHP version?
PHP versions older than 8.2 will not receive an official fix. Some hosts provide their own patched versions, so ask your host directly. Either way, an old PHP version is a sign the site needs attention, as other security problems tend to build up over time too.
How do I know if my website has been hacked?
Warning signs include unfamiliar administrator accounts, unexpected redirects, new files you did not add, or warnings from Google or your antivirus software. If you are concerned, get the site checked and make sure you have a recent backup from before any suspicious activity.
Need a hand?
AGGIA IT provides IT support and website hosting for small businesses in Bicester, Oxford and across Oxfordshire. If you are not sure who hosts your website, what PHP version it runs on, or whether it is safe, get in touch and we will help you find out.
