If your website runs on WordPress, it runs on PHP, and PHP just released an urgent security fix. On October 21, 2026, PHP fixed two critical flaws, nicknamed "PHP2Shell", that can let an attacker take over a website's server without a password. Your site is safe from them once its server runs PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a version your host has patched. The FBI's Cyber Division has urged organizations to update right away. Checking takes about ten minutes.
Is your website affected?
It depends on what your site is built on.
| Your website | Affected? | Who fixes it |
|---|---|---|
| WordPress or WooCommerce on regular web hosting | Yes, until the server's PHP is updated | Your web host, or whoever manages the server |
| Joomla, Drupal, Magento or another PHP-based site | Yes, the same way | Your web host |
| WordPress.com or managed WordPress hosting | Usually handled for you | Your host, but confirm it |
| Shopify, Squarespace or Wix | Not directly, since you don't run PHP on these | The platform |
How do you check your PHP version?
In WordPress, it's a one-minute check:
- Log in to your WordPress dashboard.
- Go to Tools, then Site Health, and open the Info tab.
- Open the Server section and find "PHP version".
If it shows 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a higher number in the same series, the fix is in. A lower number in those series needs updating. Some hosts patch PHP without changing the number, so if you see an older one, ask your host before assuming the worst.
In your hosting account, look for a setting called something like "PHP version", "Select PHP version" or "MultiPHP Manager". Many hosting panels only show "8.2", without the last digits, and that isn't enough to tell. Ask your host for the exact version.
What should you ask your web host?
Send this through your host's support chat or ticket system:
Hi, is [your domain] running a PHP version patched for CVE-2026-109618 and CVE-2026-109619 (8.5.12, 8.4.27, 8.3.36, 8.2.35 or a vendor patch)? If not, when will it be updated?
A good host answers within a day. If yours can't give you a straight answer on a critical fix, it may be time to look at a different host.
Do WordPress or plugin updates fix it?
No. The flaw is in PHP, the software WordPress runs on, so only a PHP update fixes it. Keep WordPress, your theme and your plugins up to date anyway, because out-of-date plugins are a common way into WordPress sites.
What if your site is on an older PHP version?
PHP 8.1 and older don't get official fixes anymore. W3Techs counts about a third of PHP websites still running PHP 7 or older, and those are the most exposed. The real fix is moving the site to a current PHP version, and that's where websites break: older themes and plugins often stop working on PHP 8.
Do it on a copy of the site first, called a staging site. Fix whatever breaks there, then move the live site over. On a small site it's often an afternoon's work, and longer on a big one. Our website maintenance covers it.
How can you tell if your site was already hacked?
Look for:
- admin users you didn't create
- visitors getting redirected to spam or strange sites
- files you don't recognize in your hosting file manager
- a "This site may be hacked" note under your site in Google search results, or a warning email from your host
If you see any of these, don't start deleting things. Ask your host for a backup from before the problem started, and get help cleaning the site so it doesn't come back.
Frequently asked questions
My site is on Shopify, Squarespace or Wix. Do I need to do anything?
Not for this one. Those platforms run their own servers, and your site doesn't run PHP.
How quickly should this be fixed?
Today if you can. Both flaws are rated 9.2 out of 10, and CERT-EU reports that early proof-of-concept code is already circulating. PHP's own advice is that updating is the only safe choice.
Will a PHP update break my site?
A small step, like 8.2.34 to 8.2.35, is a security update and rarely breaks anything. A jump from PHP 7 to PHP 8 is the risky one, so test it on a copy first.
Your website may not be the only thing in your business running PHP. Our IT side, Nexanova Systems, has a checklist for servers, portals and other systems.
Not sure what your site runs on? Book a free consultation and send us your website address. We'll check its PHP version and tell you what needs doing.
Sources: PHP security advisory, October 21, 2026, CVE-2026-109618, CVE-2026-109619, CERT-EU Security Advisory 2026-018, FBI Cyber Division on X, W3Techs PHP usage statistics.