PHP2Shell vulnerability: is your WordPress site at risk?

Categories:
  • educational
  • security
Geoffrey Le Meur avatar
Geoffrey Le Meur
•
PHP2Shell vulnerability: is your WordPress site at risk?

Yesterday, on 21/10/2026, the PHP team rushed out fixes for two critical vulnerabilities nicknamed “PHP2Shell”. If your website runs on WordPress, Joomla, Drupal or PrestaShop, it relies on PHP and you may be affected, whether your business is in Mazamet, Castres or anywhere else. Here’s what you need to know, without the jargon, and above all what you can do today.

What happened

PHP is the language that powers most small business websites and online shops. The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, are rated 9.2 out of 10 for severity. In practical terms, they can let an attacker run their own code on your website’s server, without needing a username or password.

The timing makes things worse. Details leaked online before the planned release date, which forced the PHP team to bring the fixes forward by a day. According to Amazon, exploitation attempts were already spotted on 17/10, and Cloudflare reports seeing the first attacks since yesterday. The researchers who found the flaws say they managed to take over specific versions of WordPress, Drupal, Joomla and Magento.

Am I affected?

It depends on the technology behind your website and the PHP version installed on your server.

Your site is affected if:

  • it runs on WordPress, WooCommerce, PrestaShop, Joomla or another PHP-based CMS;
  • it’s hosted on a server whose PHP version hasn’t been updated since yesterday;
  • it runs on an old PHP version (8.1 or earlier), which won’t get any official fix.

The patched versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything older is still vulnerable.

The most exposed sites are the ones built five or six years ago and then left alone, still running PHP 7.4 or 8.0. For them, no simple update will close the hole: they’ll need to move to a recent version.

What to do today

1. Contact your hosting provider or web agency

On shared hosting, PHP is managed by your host, not by you. Email them today with two specific questions: “Which PHP version is my site running?” and “Have you applied the PHP security fixes from 21 October?”. If an agency looks after your site, ask them the same questions.

2. Take a full backup

Before anything else, export your site’s files and database. If something goes wrong during an update, or if the site has already been compromised, you’ll have something to roll back to.

3. Update PHP, then your CMS and plugins

Most hosts let you switch PHP versions from your customer dashboard. Moving to a patched version is the only complete fix. Be careful, though: an old theme or an abandoned plugin may not support a recent version and can break your site. That’s exactly the kind of problem I described in my article on why WordPress holds small businesses back.

4. Watch for signs of intrusion

Over the coming days, keep an eye out for an admin user you didn’t create, unknown pages showing up in Google, redirects to suspicious sites, or warnings from your antivirus or Google Search Console. If anything looks off, have a professional check your site.

Why our sites aren’t affected

The websites we build at Montagne Noire Web Studio are custom-built with Astro and published as static files. There’s no PHP on the server, no exposed database and no third-party plugins to keep an eye on. A flaw like PHP2Shell simply has nothing to grab onto.

That’s not an absolute guarantee against every risk (no website is), but the attack surface is in a different league from a typical WordPress install. If you’d like to understand the difference in more detail, I wrote an article comparing hand-coded websites and page builders.

In short

PHP2Shell is one of the most serious vulnerabilities in years for small business websites. If your site runs on WordPress or another PHP-based CMS, contact your host today, take a backup and make sure the update has been applied. The older your PHP version, the more urgent it is to act.

Not sure where to start, or your site no longer has anyone looking after it? Request a free website audit: I’ll check its technology and propose a migration plan to secure your online presence together.

Back to all posts