On 21 October 2026, the PHP project released an emergency security update to fix two critical vulnerabilities. If your business website runs on WordPress, or any other PHP-based platform, this affects you. Here’s what’s happened, in plain English, and exactly what you need to do.

PHP is the programming language that powers most websites on the internet, including every WordPress site. Two serious flaws have been found in PHP itself. Security researchers have nicknamed them “PHP2Shell”, and they’re tracked as CVE-2026-109618 and CVE-2026-109619.

Both are rated critical, scoring 9.2 out of 10. In the worst case, they could let an attacker take control of a website’s server without needing a password. Researchers showed this working against up-to-date WordPress, Drupal and Joomla sites.

Details of the flaws leaked online before the fix was released, and security companies, including Cloudflare, have already reported attacks.

If your website runs on WordPress, it runs on PHP, so it’s potentially affected until your server’s PHP has been updated.

The flaw is in PHP on the server, not in WordPress itself. That means:

It’s a solid, no-frills starting point for small businesses that need a proper online presence without paying agency prices. If your current site needs replacing rather than starting from scratch, our website rebuilds start from £1,195.

1. Find out who looks after your hosting. This decides who needs to act:

2. Check your PHP version. In WordPress, go to Tools → Site Health → Info → Server. The fixed versions are:

Some hosts apply the fix without changing the version number, so if in doubt, ask your host directly.

3. If you’re on PHP 8.1 or older, act now. These versions are no longer supported by PHP and won’t get an official fix. Your site needs moving to PHP 8.2 or newer. Ideally test it on a staging copy first, as older themes and plugins can break. For self-managed servers that can’t be upgraded straight away, WordPress and the UK’s National Cyber Security Centre suggest taking the site offline until it can be.

4. Avoid “quick fix” plugins. Unofficial plugins or code snippets claiming to fix this aren’t verified and could break your site. The only real fix is updating PHP.

Signs to look out for include unexplained errors or the site going down, unfamiliar admin users, or pages and files you don’t recognise. None of these prove a site has been compromised, but if you notice anything unusual, get it checked and change your passwords, including hosting, WordPress and database logins.

Most small business owners never think about what their website runs on until something goes wrong. Situations like this are why hosting and maintenance matter. A well-looked-after website gets patched quickly, while an unmanaged one can sit vulnerable for weeks without anyone noticing.

If we host your website with Eightfold Digital, our servers have already been updated to the patched version of PHP, so there’s nothing you need to do.

If you’re not sure whether your website is affected, or you don’t know who looks after your hosting, get in touch. We’re happy to take a quick look and tell you where you stand, with no obligation.