In short: in October 2026 two critical security flaws were found in PHP itself – the programming language that runs WordPress and roughly three-quarters of all websites. Nicknamed “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619), they could let an attacker run their own commands on a web server without logging in. The fix is a PHP update on the server, not a WordPress update, so it’s your host’s job – but it’s worth checking it has actually been done.
What actually happened
The PHP project published fixes on 21 October 2026, a day earlier than planned, because details had started leaking. Both flaws are rated 9.2 out of 10 for severity. One involves the way PHP tidies up memory when a request runs out of it; the other lets leftover data from one visitor’s request be misused by the next request handled by the same server process. In plain terms: a specially crafted web request could, in the worst case, give an attacker control of the server.
The UK’s National Cyber Security Centre (NCSC) and the US agency CISA both issued alerts the same day telling organisations to patch immediately. Security firms reported attack attempts within days, and Amazon’s threat team said it had seen probing as early as 17 October.
Is my website affected?
If your website runs on PHP – and almost every WordPress, WooCommerce, Joomla or Drupal site does – the answer was “yes” until your host updated it. The flaws affect PHP versions going back to 5.4, released in 2012. It doesn’t matter which plugins or theme you use, because the problem sits underneath WordPress, in the language itself.
Website builders such as Wix, Squarespace and Shopify manage their own servers, so their customers don’t need to do anything themselves.
Which PHP versions are fixed?
- PHP 8.5.12 or later
- PHP 8.4.27 or later
- PHP 8.3.36 or later
- PHP 8.2.35 or later
Older versions (PHP 8.1 and below) are past the end of their official support. The PHP project published source-code fixes for some of them, but there are no ready-made updates. If your site still runs on one of these, this is the moment to move it to a supported version – CISA’s advice was to take unpatched older systems offline until they’re upgraded.
What should I do?
- Ask your host, in writing: “Has the PHP on my hosting been updated for CVE-2026-109618 and CVE-2026-109619, and what version is it now?”
- Check your PHP version yourself: in WordPress, go to Tools, then Site Health, then Info, and open “Server”. The PHP version is listed there.
- If you’re on PHP 8.1 or older, plan an upgrade now. Test the site on the newer version first – old plugins and themes are the usual reason sites get stuck on old PHP.
- Change your passwords for WordPress admin, hosting and FTP if your host can’t confirm when it patched, and check for admin accounts you don’t recognise.
- Make sure you have a recent, off-site backup you could restore from if anything had been tampered with.
Won’t my security plugin protect me?
Not fully. WordPress security plugins run inside PHP, and the most dangerous version of this attack can happen before WordPress even starts. Firewalls at the network edge (such as Cloudflare, which released rules for all its customers) help, but only as a stopgap. The only complete fix is the PHP update.
The bigger lesson
Most small business owners never think about PHP – and they shouldn’t have to. But this is exactly why “hosting” isn’t just disk space: someone has to watch for problems like this and act on the day they’re announced. If you don’t know who that person is for your website, that’s the real risk.
For sites ChrisXCreative hosts and maintains, we check the PHP version has been patched and scan for vulnerabilities with tools including Nuclei. If you’re not sure whether your own site was patched, get in touch and we’ll check it for you.
