php2shell: What the PHP Security Flaw Means for Your Business Website

What PHP is, and why you might be using it

PHP is behind-the-scenes software that a lot of websites run on. It often builds each page on the web server (the computer that hosts your site). Visitors never see it.

It's also very common. WordPress, the popular website builder, needs PHP to run, and the PHP Foundation says PHP also runs online stores and much of the software businesses rely on. On October 24, 2026, W3Techs, which tracks website technology, reported PHP on 69.3% of the websites where it could identify the behind-the-scenes language.

What happened

On October 21, 2026, the team that maintains PHP released updates fixing two critical flaws known as "php2shell."

In plain terms: under the right conditions, someone with no username or password could send specially crafted requests to a website and make the server run instructions of their own choosing.

Both are rated 9.2 out of 10 for severity. According to the PHP project, they affect every PHP setup that serves web pages, though how easy they are to exploit varies, and the risk is highest on one common setup.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) "strongly urges organizations to immediately patch."

How concerned should you be?

Don't panic, but don't wait. CISA's October 21 alert said it hadn't seen successful attacks, and as of October 24 it hasn't added these flaws to its list of security flaws known to be used in real attacks. Since then, security firms have reported widespread attack attempts, and on October 23 Palo Alto Networks reported at least one successful break-in, at a government organization in Europe. Not every early report has held up: the security firm Sophos withdrew its claim of a successful attack after finding only failed attempts. Amazon has also reported an attack attempt on October 17, four days before the fixes came out.

The fix exists. Update now, and if your site was running an unpatched version at any point after October 17, ask your host to check it for signs of a break-in.

On October 23, the PHP project also disclosed a third, related flaw. PHP says it only affects unusually set-up websites and is an unlikely risk. The October 21 updates don't fix it, but a simple settings change protects against it until the next regular update; this applies even to sites already on the fixed versions. Details are in the box below.

How to tell if you're affected

You don't need the technical details. Ask two questions:

1. Does my website run on WordPress or another PHP-based tool? If you manage your site at an address ending in /wp-admin, that's WordPress.
2. Who looks after the web server? On a managed or shared hosting plan, the hosting company usually handles PHP updates, but confirm it, and if your hosting control panel lets you choose a PHP version, make sure it isn't 8.1 or older. If you or your developer run your own server, whoever manages it applies the update.

Ask even if you don't think you use PHP. CISA notes that PHP "is often a component of other software."

PHP 8.1 and older no longer get official updates, and PHP 7.3 and older, including PHP 5, get no fix from the PHP project at all. Some companies that sell long-term support for older software offer patched versions; otherwise, move to a supported version, which can take some testing. For systems that can't be updated straight away, CISA's advice is to take them offline until they're patched or updated.

What to do now

• Ask your host or developer to confirm PHP is on a fixed version. The versions are in the box below. Ask for a clear yes, not a "probably."
• Update your plugins and themes too. It won't fix php2shell, but it clears other pending fixes.
• Make sure you have a recent backup you can restore, ideally one that has actually been tested. More in Your Backups Are a Hope Unless You Restore Them.
• Watch for odd behavior, such as pages you didn't create, admin users you don't recognize, or your site suddenly slowing down or sending visitors elsewhere. Many break-ins show no visible signs, so ask your host to check server logs and running processes too.
• If updating will take time, ask about a stopgap. CISA says a web application firewall (a filter that blocks suspicious traffic) "may provide some protection," but only the update is a full fix.