Opens in a new tab

The PHP Security Issue: What It Means for Your Website

If we host your website, the fix for the PHP security issue known as PHP2Shell is already in place, and there is nothing you need to do. Here is what happened, how we dealt with it on our servers, and what to ask your host if your site is elsewhere.

Written by

Sampi Kamffer

What happened

PHP is the programming language most of the web runs on, WordPress included. On 20 October 2026, the PHP project announced a critical security release for the next day. It fixes two flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and widely reported under the name PHP2Shell.

The flaws are in PHP itself, in how it handles requests on the server, and not in WordPress, your theme or your plugins. That cuts both ways: nothing in your website caused this, and nothing in your website could fix it. The fix belongs on the server, which is the part of hosting we look after.

What we did

  • Wednesday 21 October, morning. A temporary protective measure was in place on every server we run, before an official fix existed.
  • Wednesday 21 October, 16:00. PHP released the fixed versions, and we began installing them across our servers that evening.
  • Thursday 22 October. The fix was installed and checked on every server.

Every WordPress website we host runs PHP 8.4, on servers carrying the fixed release. Our monitoring checks each site every five minutes, and it recorded no outages from 21 to 23 October. The smaller sites we host on our lightweight platform do not use PHP at all, so they were never exposed.

If your website is hosted elsewhere

Ask your host two questions.

  1. Has the PHP security update been installed on the server? The fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
  2. Is the website on PHP 8.2 or newer? PHP 8.1 and older are no longer supported by the PHP project. A site on one of those needs moving to a current version, not only patching.

If both answers are yes, you are in good shape.

For your IT team

  • CVE-2026-109618 and CVE-2026-109619, both rated critical (CVSS v4.0 9.2) by the PHP project.
  • Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026 at 14:00 UTC.
  • The PHP project’s own advisory: php.net, 21 October 2026.

The part you should never have to think about

Server-level security is the least visible part of a website and one of the most important. It is why we manage it for the sites we host, rather than leave it to each business to keep track of.

If you have a question about your website, or would like us to check one hosted elsewhere, get in touch.

Related Content

View All News
Two people photographed from behind with their heads close together, against a pale background
Insights

Facebook vs. Twitter: Which Social Media Platform Should You Choose?

Weigh the pros and cons of Facebook and Twitter to determine which platform aligns best with your brand’s goals and audience engagement strategies.

WooCommerce logo in purple and white on a dark grey background
Insights

Is WooCommerce the best eCommerce platform?

Delve into the features and benefits of WooCommerce, the world’s most popular eCommerce platform, and determine if it’s the right fit for your online store needs.

Halved strawberries scattered across a yellow-orange background, casting hard shadows
Insights

The Remarkable Advantage of Abundant Thinking

Shift your mindset from scarcity to abundance and unlock new opportunities. Learn how abundant thinking fosters creativity, resilience, and business growth.

Let's craft your
brand's next chapter.

Get in touch