In October 2026 the people who look after PHP, the programming language behind a huge share of the world's websites, issued an emergency warning. Two critical flaws had been found that could let an attacker take control of a web server without logging in. The flaws were nicknamed PHP2Shell, and if your website runs on WordPress, Joomla, Drupal or almost any traditional hosting, it was in the firing line.
This post explains what happened in plain English, why it happened, what you should check today, and how a managed website plan deals with this kind of thing for you.
What happened
On 20 October 2026 the PHP security team gave advance notice that an emergency release was coming the next day to fix two critical vulnerabilities. Both were rated 9.2 out of 10 for severity. Within hours, details that were meant to stay under wraps until the fix was ready had leaked.
On 21 October PHP released fixed versions: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Security researchers showed that, on unpatched servers, the flaws could be used to run code on sites built with WordPress, Drupal and Joomla without needing a password. Reports of attack attempts started almost straight away.
Two days later, on 23 October, PHP published advice about a third, related flaw that only affects servers set up in a non-default way. There was no fix for that one at first, just a setting to switch off.
Why it happened
PHP is the engine that sits underneath most websites. You never see it, but every time someone loads a page or submits a contact form on a WordPress site, PHP is doing the work on the server.
Like any large piece of software, PHP has bugs. These two were in the way PHP handles memory and visitor sessions, deep inside the engine rather than in any one website. That is what made them serious: the problem was not a badly built plugin on one site, it was in the foundations that millions of sites share.
The first signs of one of the bugs actually surfaced in 2024, during a security audit of PHP. Finding and fixing a deep flaw like this takes time, and attackers move fast once details are out.
Who was most at risk
The fix only arrived for versions of PHP that are still supported. That left a big group of websites exposed with no official patch at all: anything running PHP 8.1 or older. Security firms counted hundreds of thousands of internet-facing servers still advertising those old versions.
That is the uncomfortable part. Plenty of small business websites were built once, years ago, and have not been touched since. The hosting still works and the site still loads, so nobody notices that the engine underneath is several versions out of date. Those are exactly the sites that had no easy way out this time.
It is also worth knowing that PHP 8.2 stops getting security fixes on 31 December 2026. If your site is on 8.2, it was patched this time, but it needs moving to a newer version before the end of the year.
What to check on your own website
If you look after your own site, or you are not sure who does, here is what to check:
- Find out which PHP version your site runs on. It is usually shown in your hosting control panel, often under a heading like PHP configuration.
- Make sure it is one of the patched releases: 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or newer. Hosting companies sometimes use their own version numbers, so if in doubt, ask them directly whether the PHP2Shell fix is applied.
- If you are on PHP 8.1 or older, treat it as urgent. Ask your host to move you to a supported version. Test your site afterwards, because very old sites and plugins can break on newer PHP.
- Update WordPress, your theme and every plugin at the same time. Newer PHP versions and old plugins do not always get on.
- Check you have a recent backup you could restore from, stored somewhere other than the website itself.
If none of that makes sense, or you cannot get into your hosting account at all, that is a sign your site is not really being looked after. You are not alone, and it is fixable.
How a managed website handles this
This is exactly the kind of week a website care plan exists for. With a managed site, the owner does not need to read security news, know what PHP is or log into anything. Here is what happens instead:
- The server gets updated. Security updates to the software underneath the site are applied as they are released. The site you are reading right now runs on PHP 8.3.36, the patched release from 21 October.
- Sites stay on supported versions. Moving off old versions before they stop getting fixes is part of the routine, not an emergency.
- Features that are not needed stay switched off. The less a website has running, the less there is to attack.
- There are backups. If the worst happens, the site can be put back.
- Someone checks. After a big update, someone actually loads the site and tests the contact form, rather than assuming it all still works.
Our care plans start at £14.99 a month and include hosting, the SSL certificate, security updates, backups and small fixes, with a real person on the end of the line. You can see exactly what each plan covers on our pricing page.
The bigger lesson
PHP2Shell will not be the last flaw of its kind. Software ages, and the websites that get hurt are rarely the ones being watched. They are the ones built years ago and left alone.
A website is not a leaflet you print once. It is more like a van: it needs looking after to stay safe and keep earning for you.
If you are not sure what your current site is running on, or you would rather not have to think about any of this again, get in touch. We will tell you honestly where you stand, and if you want a new site, you can see your design before you pay anything.