Two critical security flaws have been found in PHP, the software that quietly runs a huge share of the world's websites, including every WordPress site. Together they are being called PHP2Shell. A fix is out, attacks have started, and governments and large organisations have been taking websites offline while they patch. If your business has a WordPress site or sits on ordinary shared hosting, this one is worth ten minutes of your week.

What happened

Details of the two flaws leaked on social media on Tuesday 20 October, before the PHP developers had planned to announce them. That forced an early announcement, and the fixed version went live at around 1345 GMT (2:45pm UK time) on Wednesday 21 October, according to CNBC.

The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 for severity, as TechTarget reports. In plain terms, they can let an attacker run their own code on a web server. The PHP Foundation says it has seen a working attack where a request from someone who has not logged in triggers the problem before the website's own code even runs. Palo Alto Networks has counted more than 22.6 million exposed systems that could be vulnerable.

Attacks are already appearing. Cloudflare's chief technology officer said the company was "seeing early attacks emerging" and called its own protections a "stopgap only" (BBC). The UK's National Cyber Security Centre has urged anyone using PHP to apply the fixes and, where that isn't possible straight away, to consider taking the system offline.

Many organisations did exactly that. Finland took its government's public web services offline as a precaution, the Dutch cyber security agency took down its own site, and the Wikimedia Foundation took a number of systems down, leaving parts of Wikipedia unreachable for a time. Edinburgh council's website and the sites for several BBC programmes also went offline, though the BBC notes those organisations had not confirmed a link to PHP.

Why it matters to a small business

PHP sits underneath WordPress, Joomla, Drupal and Magento, plus most shared hosting and control panels. Most small business websites in the UK fall into one of those groups.

There is one detail that catches people out. Wordfence, a popular WordPress security plugin, warns that WordPress automatic updates will not apply this fix (CNBC). PHP is updated on the server, usually by your hosting company or whoever manages your site, not inside WordPress. If nobody has told you it is done, don't assume it is.

Security experts quoted by CNBC also say small sites on shared hosting may take longer to patch and stay exposed well after the fix is available. Older setups are a particular worry: support for PHP 8.1 and earlier has ended, so those sites need an upgrade or a special fix from their provider.

What to do this week

  1. Ask your hosting company or web person, in writing: "Has the PHP on our server been updated with the 21 October PHP2Shell fix?" Ask what PHP version you are on. If it is 8.1 or older, ask what their plan is.
  2. Update WordPress, your theme and all plugins, and delete plugins you no longer use. This won't fix PHP, but attackers will be busy and older plugins are an easy way in.
  3. Check your backups. Make sure a recent copy of your site exists, is stored away from the website itself, and that someone knows how to restore it.
  4. Keep an eye on your site. Visit it every day or two, and watch for it going down, strange pages, unfamiliar admin users or warnings from Google. Experts stress that patching closes the hole but does not remove an attacker who got in first.
  5. If your site or web app is built on Next.js, a different technology, check that too. A separate critical Next.js flaw (CVE-2026-94545) is on Rootshell's October list of priority vulnerabilities, so ask your developer whether it has been updated.

The short version

You don't need to understand memory errors or CVE numbers. You need one clear answer from whoever runs your website: has PHP been patched, yes or no? If you can't get that answer this week, that is the real problem to fix. If you'd like a second pair of eyes on your website setup, we are happy to help.