On October 21, 2026, the PHP project released emergency security updates for two critical vulnerabilities nicknamed “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619). Details leaked a day early, and Cloudflare has already reported early attacks.
If your business website runs on WordPress, WooCommerce, Drupal, Joomla, or Magento, it runs on PHP. That makes this worth ten minutes of your time today.
What is PHP2Shell?
Both flaws let an attacker run their own code on your web server without logging in. The PHP team rates both as critical (9.2 out of 10). In plain terms, an attacker could take over the server that hosts your website, then deface it, steal form submissions and customer data, or use it to send spam and malware under your name.
According to the PHP team, any PHP installation that serves web requests is at risk, however it is configured.
Who is affected?
- WordPress, WooCommerce, Drupal, Joomla, Magento, Laravel, and most custom PHP sites
- Sites on shared hosting, a VPS, or your own server
- Older sites on PHP 8.1 or earlier, which will not get an official fix
Hosted platforms like Wix, Squarespace, and Shopify manage their own servers, so there is no PHP for you to patch on those.
What to do this week
- Find your PHP version. Check your hosting control panel (cPanel, Plesk, or your host’s dashboard) or ask your web developer. In WordPress, go to Tools, then Site Health, then Info, then Server.
- Update PHP. The patched versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Many hosts are rolling these out automatically, so confirm with yours. If you are on PHP 8.1 or older, plan an upgrade to a supported version, and test first because older plugins can break.
- Put a firewall in front. If you cannot patch right away, place the site behind a web application firewall. Cloudflare has deployed rules for known exploit attempts, including on its free plan. This buys time, but it is not a fix.
- Look for signs of tampering. Watch for unfamiliar admin accounts, new files in your website folder, unexpected redirects, or warnings from your host. If something looks off, save your logs before cleaning anything up and get help.
- Confirm your backups. Make sure you have a recent, working backup of your site stored somewhere other than the web server.
Why small businesses should care
Attackers do not pick targets by size. They scan the entire internet for vulnerable servers, so a local law firm or contractor site is just as likely to be hit as a large retailer. A hacked site can get flagged by Google, break your lead forms, and expose client information.
How SangaIT can help
Not sure whether your website is exposed? We will check your PHP version and hosting setup for free and tell you exactly where you stand. Call 1-844-726-4248 or email info@sangait.com.
Learn more about our website and SEO services and managed IT services, or read about the signs your IT infrastructure needs an upgrade.
Sources: PHP security advisory, Tenable, Huntress, and Qualys research published October 20 and 21, 2026.