A Serious PHP Security Flaw Came Out This Week. Here’s What It Means for Your Site.

On October 21, the team behind PHP released emergency updates for two critical security flaws. Security researchers nicknamed them PHP2Shell. If your website runs on WordPress, it runs on PHP, so this one is worth a few minutes of your time even if you never think about what’s under the hood.

If we look after your site, here’s the short version: we’ve handled it, and you don’t need to do anything. The rest of this post explains what happened and what we did, so you know what to ask the next time a headline like this comes around.

What PHP is, and why this one matters

PHP is the programming language that lives on your web server and builds each page when someone visits. WordPress is written in it, and so is most of what runs a typical business site. Think of WordPress as the house and PHP as the foundation it sits on.

The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619. (A CVE is the ID number security teams use so everyone is talking about the same problem.) Both are rated 9.2 out of 10 for severity. In plain terms, they could let a stranger run their own code on a web server without logging in, and one of them could expose bits of the server’s memory, which can include passwords and keys. Cloudflare reported attack attempts the same morning the fix came out.

Why updating WordPress doesn’t fix it

Most website security news is about a plugin or WordPress itself, and the fix is an update you click in the dashboard. This one lives in PHP on the server, so the fix has to happen there. The server needs a patched version (8.5.12, 8.4.27, 8.3.36 or 8.2.35), and then PHP has to be restarted. Sites still on PHP 8.1 or older get no official fix at all, which is one more good reason to stay on a current version.

So the real answer depends on who hosts your site and how closely they’re watching.

What we did on every site we look after

• Before the patch existed. The flaws went public on Wednesday, October 21. Protections went in at the network and server level of our hosting that same day, so the known attack paths were blocked while the official fix rolled out.
• The patch. On Thursday, October 22, every site we look after moved to the patched version of PHP.
• We checked it ourselves. We read the PHP version back on our sites ourselves instead of relying on the host’s notice.
• Our own tools. The plugins we build for our clients’ sites check for updates on their own, twice a day, so a fix we release reaches your site within hours.

The question to ask whoever runs your site

If someone else hosts or manages a site for you, like a second business, a side project or a site a relative built, ask them one question: “Is our PHP on a patched version, and when did you check?” A good host or web team can answer that in a sentence.

You can also look for yourself. In your WordPress dashboard, go to Tools, then Site Health, then the Info tab, and open Server. Your PHP version is listed there.

How we think about security

Keeping your site safe is part of the job when we build it. We want you to hear about issues like this from us, with the work already done, so a scary headline never leaves you wondering. If you have a question about your site, or about one we don’t manage, email [email protected] or call us at (984) 325-9661. You can also see how we look after sites day to day on our website security page.

Want to read more?

If you’d like to go straight to the sources, these are the ones we used (checked October 23, 2026):

• PHP’s own release announcement, from the team that makes PHP.
• Help Net Security’s write-up, a plain summary of both flaws and the fixed versions.
• The Hacker News report, including the early attack attempts Cloudflare saw.