PHP2Shell: what it means for your WordPress site, and what we did
On Wednesday 21 October 2026, PHP released an emergency fix for two critical security flaws known as PHP2Shell. PHP is the software that runs underneath WordPress, so almost every WordPress site in the world was in scope.
In plain English: on an unpatched server, an attacker could send a specially crafted request and run their own commands. No password needed. Both flaws were rated 9.2 out of 10 for severity.
If you have a WordPress site, here’s how to tell whether you’re covered, and what we did for the sites we look after.
Is your site affected?
It depends on which PHP version your hosting runs. The fix arrived in these versions:
| PHP version | Safe from |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
| 8.1 and older | No official fix |
To check yours: log in to WordPress, go to Tools → Site Health → Info, and open the Server section. Your PHP version is listed there. Your hosting control panel will show it too.
If you’re on 8.1 or older, there is no official patch coming. Talk to your host or your web developer this week.
What we did
Credit where it’s due: our hosting partners applied the fix almost as soon as it was released. Our job was to make sure it had actually reached every site we look after, rather than assume it had.
| When | What happened |
|---|---|
| Since then | Continued monitoring of every site. No signs of anything unusual so far. |
| Thu 22 Oct, by 10am | Every site in our care checked: through our monitoring, and by logging in directly to the few sites outside it |
| Wed 21 Oct | PHP releases the fix; our hosting partners patch their servers |
At the time, no attacks had been reported. Security researchers have since said attempts began before the flaws were made public, which is why we haven’t stopped watching.
The sites that can’t simply be updated
A few older sites we look after can’t move to a supported PHP version without breaking, usually because they rely on themes or plugins that stopped being maintained years ago. We’ve told each of those owners about the risk directly, and given them a fixed quote to rebuild or repair the site.
If your site is in that position, it isn’t a reason to panic. But it is a reason to act. An out-of-date site will only get harder and more expensive to fix. Our WordPress web design service covers rebuilds like this.
Who’s watching your site?
To be fair to the website builders, this is one area where they have an advantage: Wix and Squarespace run their own servers, so their customers never had to think about PHP2Shell.
WordPress gives you more freedom and ownership, but someone has to take responsibility for it. Cheap hosting usually means the server gets patched and nobody checks whether your site is fine. Having that someone is the difference between reading about a flaw like this in the news and knowing your site was checked by 10am the next morning.
We look after more than 150 WordPress sites in Hampshire, West Sussex and beyond. If nobody is keeping an eye on yours, have a look at our website support or get in touch. We’ll check your PHP version for you, no strings attached.
