Is Your Business Website Affected by PHP2Shell?

If your website runs on WordPress, Drupal, Joomla, or almost any site with a login and plugins, it runs on PHP, and PHP2Shell affects it until your host installs a patched version of PHP. The fix came out on October 21, 2026. It's not something you install yourself, and updating WordPress doesn't fix it.

This post explains what happened in plain English, what to ask your hosting company this week, and why the sites I build had nothing for this flaw to attack.

What is PHP2Shell, in plain English?

PHP2Shell is the nickname for two critical security flaws in PHP, the programming language that runs on the server behind most websites. In the worst case, they let an attacker take over the server a website runs on without needing a password. The PHP team rated both 9.2 out of 10 in severity.

Researchers at Wiz found the flaws in August with the help of AI tools and reported them privately so a fix could be built quietly. On October 20, details leaked two days early, and PHP rushed out emergency fixes the next day.

This was a big deal because PHP is everywhere. About 69% of websites whose server software is known use it. Government websites in Germany and France were taken offline while they patched, and the UK's National Cyber Security Centre told organizations to update their PHP servers immediately or take them offline until they could.

Is anyone actually being attacked?

Yes. Amazon's security team saw the first attempts on October 17, four days before the fix existed, and now describes the flaws as broadly exploited. What isn't clear yet is how many of those attempts actually succeeded.

That's the honest picture: real attacks, no confirmed wave of hacked small business sites so far, and a window that stays open for every server that hasn't been updated.

How do I know if my website runs on PHP?

If your site was built on WordPress, WooCommerce, Drupal, Joomla, or Magento, it runs on PHP. The same goes for most sites where you log in at an address ending in /wp-admin or /administrator to make changes.

If you're on a hosted builder like Wix or Squarespace, the platform runs the servers, and patching is their job, not yours. If you don't know what your site is built on, whoever built it or your hosting company can tell you in one email.

What should I do about PHP2Shell this week?

Email your hosting company and ask two direct questions: what PHP version is my site running, and has it been patched for PHP2Shell? Get the answer in writing. Most of this is on your host, but you want to know it's actually done.

• Ask your host for the version and the date it was patched. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, or a patched build from your host.
• Ask what happens if you're on an old version. About 35% of WordPress sites run PHP versions that no longer get regular updates. If that's you, your host needs to move you to a supported version.
• Don't count on a plugin update. Updating WordPress, your theme, or your plugins is still good practice, but it doesn't touch the PHP underneath.
• Look for anything that isn't yours. Admin users you didn't create, pages you didn't write, or a Google warning on your site in search results are all reasons to call your host or developer right away.

Some hosts were ahead of this. Automattic said sites on WordPress.com, WordPress VIP, WP Cloud, and Pressable were already protected and those customers didn't need to do anything. If your host can't give you a straight answer, that tells you something too.

What does a hacked website actually cost a business?

For a local business, the hack itself is usually not the expensive part. The cost is what happens to your leads, your Google presence, and your reputation while the site is compromised and while it gets cleaned up.

• Lost leads. A site that's down or redirecting visitors somewhere else isn't booking jobs, and most people won't call to tell you.
• Google warnings. Google can flag a hacked site in search results or show visitors a warning page, and getting that cleared takes time after the cleanup.
• Trust. If someone looking up a roofer or a wedding venue hits a spam page with your name on it, they move on to the next result.
• Cleanup time and money. Someone has to find what was changed, remove it, and lock the site down, and it usually lands in the middle of a busy week.

Most owners don't think about any of this until it happens. It doesn't happen to most sites. But when it does, it's rarely on a convenient day.

Why I build websites without PHP

Every site I build is a static site: plain HTML and CSS files, hand-coded and served from Cloudflare's network. There's no PHP, no database, no plugins, and no login page on the server, so PHP2Shell had nothing to attack on any of them.

I didn't choose this because of PHP2Shell. I chose it because fewer moving parts means fewer things that can break, slow down, or need an emergency update at 10 p.m. The same setup is a big part of why my builds load fast. The All Star Entertainment Florida site scores 96/100 on Google PageSpeed, and the Captain Franks site scores 98/100.

A static site isn't unhackable, and I won't tell you it is. Your domain account, your hosting account, and your email still need strong passwords and two-factor login, and anything that handles form submissions still needs care. The difference is that there's far less sitting on a server waiting for the next flaw to be found.

That's also why ongoing care is part of every monthly plan I offer. When news like this breaks, you shouldn't have to wonder whether someone is on it.

Does this mean WordPress is a bad choice?

No. WordPress runs a huge share of the web, and plenty of businesses are well served by it on a good managed host. The issue PHP2Shell exposed is that a site with a server, a database, and plugins needs someone actively keeping all of it updated. I go deeper on the tradeoffs in Custom Code vs. WordPress.

If your current setup has that person and a host that patched quickly, you're in decent shape. If nobody's really watching your site, or it was built years ago and hasn't been touched since, that's worth fixing whether or not you ever switch platforms.

Frequently Asked Questions About PHP2Shell

Do I need to update my phone or computer for PHP2Shell?

No. PHP2Shell affects PHP running on web servers, not your personal devices. The fix is the responsibility of whoever runs the server your website lives on, which for most small businesses is the hosting company.

Will a WordPress security plugin protect me from PHP2Shell?

Not on its own. The flaw is in PHP, which runs underneath WordPress, and the attack can happen before WordPress or its plugins even load. The real fix is a patched PHP version on the server.

Is a static website impossible to hack?

No website is impossible to hack. A static site removes the server software, database and plugins that flaws like PHP2Shell target, but your domain, hosting and email accounts still need strong passwords and two-factor login.