PHP2Shell Explained: Is Your WordPress Site at Risk?

PHP2Shell: What the Critical PHP Flaw Means for Your Website and Web Applications

If your business has a WordPress website, an online shop, a client portal or any web application built on PHP, this week’s security news affects you directly.

On 21 October 2026, the PHP project released emergency fixes for two critical vulnerabilities, collectively nicknamed PHP2Shell. Security agencies on both sides of the Atlantic responded unusually strongly. The US National Security Agency and the UK’s National Cyber Security Centre (NCSC) both told organisations to update immediately, and to consider taking systems offline if they could not.

Here’s what PHP2Shell is, why it matters to businesses across Surrey, Hampshire and West Sussex, and what you should do now.

What Is PHP2Shell?

PHP is the programming language that powers most of the web. WordPress, WooCommerce, Joomla, Drupal, Magento and Laravel all run on it, along with countless bespoke business systems and portals.

PHP2Shell is a pair of flaws tracked as CVE-2026-109618 and CVE-2026-109619. Each one is rated 9.2 out of 10 for severity. Together they could allow an attacker to take control of a web server remotely, without needing a username or password.

Once inside, an attacker could:

• Read or steal data from your website’s database, including customer details and form submissions
• Alter your website, inject malicious code or redirect visitors elsewhere
• Use the server as a foothold to move deeper into your network

Why This Isn’t a “Normal” WordPress Security Issue

Most website security problems sit in a plugin, a theme or the CMS itself. PHP2Shell is different. The flaw sits in PHP, the engine underneath your website, not in WordPress or your site’s own code.

That has three important consequences.

Updating WordPress won’t fix it. Clicking “update” on WordPress core, your theme or your plugins does nothing to the PHP version on the server. The fix has to come from whoever manages your hosting.

Security plugins won’t fully protect you. WordPress security plugins run on top of PHP, so they sit above the layer being attacked.

Maintenance mode isn’t the same as offline. A maintenance mode plugin still relies on PHP running in the background, so the server remains exposed. If a site needs to come offline, it has to be done at server level.

Is It Being Exploited?

Yes. Details leaked before the official fix was ready, and public proof of concept code appeared online quickly. Amazon reported spotting exploit attempts on its monitoring systems as early as 17 October, four days before the fix was released. Cloudflare also reported early attacks.

The vulnerability is technically difficult to exploit, but the security community widely expects attacks to increase now that the details are public.

Which PHP Versions Are Affected?

Every PHP installation that serves web pages and has not been updated should be treated as vulnerable. The fixed versions are:

PHP 8.1 and older are the real concern. These versions are end of life, so there are no official updated releases for them. Around a third of WordPress sites still run PHP 8.1 or older. If your site is one of them, upgrading to a supported version of PHP is the only permanent fix. This may need some testing first, since older themes and plugins aren’t always compatible with newer PHP.

What the NCSC Is Advising

The NCSC’s guidance for UK organisations is clear:

1. Update every system running PHP, starting with anything facing the internet
2. Consider taking systems offline if they cannot be updated straight away
3. Watch for updates from suppliers whose products have PHP built in, such as some network equipment and hosted business tools

That last point is easy to overlook. PHP doesn’t only run websites. It can sit inside appliances, booking systems, intranets and other software your business relies on without you realising.

How Disking IT Responded

For all websites and systems hosted and managed by Disking IT, our team completed patching to the fixed PHP versions within a few hours of the NSA advisory. No action is needed from clients whose sites or systems we host.

“PHP2Shell is a good example of why the boring work matters,” said our director, Jack Calloway. “Most business owners will never need to know what version of PHP their website runs on. That’s our job. Patching within hours, rather than waiting for a scheduled maintenance window, is what being proactive actually looks like when something serious lands.”

What You Should Do Now

If your website or web application is not hosted by Disking IT, here’s what we recommend:

• Contact your host or developer today and ask them to confirm, in writing, which PHP version your site runs and that it has been patched
• Check whether you’re on PHP 8.1 or older. If so, plan an upgrade to a supported version as a priority
• Take the site offline at server level if your host can’t confirm a fix, in line with NCSC advice
• Keep a backup from before 17 October in case you need to investigate or restore later
• Rotate passwords and credentials stored on any web server that was exposed, including database, FTP and admin logins
• Review other systems that may run PHP behind the scenes, such as portals, intranets and supplier tools
• Know your reporting duties. If personal data is compromised and puts people at risk, UK organisations normally have 72 hours to report it to the Information Commissioner’s Office

 

Not sure where your website is hosted, who manages it, or what else in your business might be running PHP? That’s exactly what our free cyber security audit is for. We’ll give you a clear, plain English picture of your exposure and what needs fixing.

Speak to our team on 0333 038 9060 or email hello@diskingit.co.uk.