PHP2Shell: what the PHP security flaw means for your website

On 21 October 2026, PHP released an urgent fix for two serious flaws nicknamed PHP2Shell. PHP is the software that runs most business websites. Unpatched, the flaws let an attacker take control of a website's server without logging in. Attacks started within hours of the announcement, so if your website runs on PHP, it's worth checking this week that it has been updated.

What PHP2Shell is and what's changed

PHP is the engine underneath WordPress, Drupal, Joomla, WooCommerce shops and countless booking and quoting systems. Wiz, one of the security firms that found the problem, estimates it powers around 70% of the web. Because the flaws are in PHP itself, a website can be at risk even if its own code and plugins are perfectly up to date.

The flaws were found with the help of AI. Researchers at Wiz, Calif and OpenAI used AI models to find the bugs in August. They then showed the bugs could take over WordPress and Drupal sites. They reported them privately, and the PHP team prepared a fix. Details leaked online on 20 October, a day before the planned release, and the fixed versions came out on 21 October.

Attacks went up overnight

This is what makes PHP2Shell different from the usual "please update" notice. Cloudflare sits in front of millions of websites. It saw thousands of attempts to use the flaw in the 10 hours before it was announced. That jumped to tens of thousands within 45 minutes of the announcement, hundreds of thousands within two hours, and millions by the next day. Amazon's security team found the first attempt on 17 October, four days before the fix existed.

AI works on both sides. It found these bugs quickly, and security firms warn it also helps attackers turn a new announcement into a working attack within hours. The gap between "a fix is out" and "someone is trying it on your website" is now measured in hours, not weeks.

What it means for you

You're likely to be affected if:

• your website runs on WordPress, Drupal, Joomla or another PHP system (most small business websites do);
• you run your own web server or virtual server, rather than shared hosting where the provider updates PHP for you;
• your site is old and still on PHP 7 or 8.1, which many sites built five or more years ago are.

You're less likely to be affected if your website is on a hosted platform like Wix, Squarespace or Shopify, which don't let you run your own PHP.

The UK's National Cyber Security Centre (NCSC) says organisations should find every PHP installation they have and update it. If a system can't be updated or protected quickly, it says to consider taking it offline. Remember the less obvious places too: an old client portal, a booking page, a staff intranet, or a shop on a different server.

If you hold Cyber Essentials, this counts as a critical update. The rules say critical and high-risk fixes must be installed within 14 days of release. For PHP2Shell, that means by 4 November 2026.

What to do now

1. Find out what your website runs on. In WordPress, go to Tools, then Site Health, then Info, and open Server to see the PHP version.
2. Ask whoever hosts it whether PHP has been updated to one of the fixed versions above, and when. Get a yes or no in writing.
3. If your site is on PHP 8.1 or older, plan an upgrade now. Older sites sometimes need plugin or theme updates to run on a newer PHP, so test it first.
4. Don't forget the extras: shops, portals, intranets and test copies of the site all need checking.
5. Look for signs of trouble if the update was slow: new admin users you don't recognise, unexpected files, or a site that suddenly errors or slows down. If you see any, get help before you change anything else.

How we can help

We host and look after business websites in-house in Dereham, and keep them updated and secure. Our web, hosting and SEO page has the details, with hosting from £50 +VAT a month. Hosted elsewhere and not sure it's been patched? Our cyber security team can check it for you. Working towards Cyber Essentials? We can tell you where this leaves you. Get in touch and we'll take a look.