On 21 October 2026, PHP released emergency security updates for two critical vulnerabilities that have since made headlines around the world.
Nicknamed “PHP2Shell”, these flaws could allow an attacker to take control of a web server without needing a password. Within hours of the announcement, attacks were being seen across the internet.
If you run a business website, especially one built on WordPress, you may be wondering whether you’re affected and what you should do. This article explains what happened, in plain English, and how we protect the websites we look after.
PHP is the programming language that runs behind the scenes on a huge share of the world’s websites.
Every time someone visits a page, submits a contact form or logs in, PHP is usually doing the work on the server. Popular platforms such as WordPress, WooCommerce and many online shops and booking systems are built on it.
Because it’s so widely used, a serious flaw in PHP affects millions of websites at once, which is why this news has been taken so seriously.
PHP’s developers fixed two critical security holes in the core of PHP on 21 October 2026, known as CVE-2026-109618 and CVE-2026-109619.
Both were given a severity score of 9.2 out of 10. In the worst case, they could let an attacker run their own code on a web server remotely, without logging in. That could mean stolen data, a defaced website or a server used to attack others.
The flaws affect a very wide range of PHP versions, from the older 5.4 right up to the current 8.5. Attacks started almost immediately, rising from tens of thousands of attempts in the first hour to millions the following day.
Two days later, on 23 October, PHP announced a third, lower-risk issue. It only affects websites set up in an unusual way, and PHP has shared a simple setting change to protect against it until the next update.
For a business, a compromised website is far more than a technical problem. It can lead to:
The good news is that the fixes are already available. The websites at risk are the ones running on servers that haven’t been updated yet.
Any website running on an unpatched version of PHP could be at risk. That includes:
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If your website is running on anything older than these, it should be updated as soon as possible.
At Stradcom, we take security very seriously, and keeping software up to date is part of how we look after our customers every day.
In response to PHP2Shell, we:
If your website is hosted with us through our Web Hosting service, there’s nothing you need to do. We keep the websites and servers we manage on supported, up-to-date versions of PHP, and we’re Cyber Essentials certified, so security is built into how we work.
If we built your website through our Web Design service, we also keep WordPress, themes and plugins updated as part of our care, so your site stays fast, secure and running smoothly.
If your website isn’t hosted with Stradcom, here are four simple steps:
Not sure who looks after your website, or where it’s hosted? We’re happy to take a look for you.
Security issues like PHP2Shell are a reminder that a website isn’t something you can set up once and forget.
If you’d like peace of mind that your website is secure, up to date and in safe hands, speak to the Stradcom team. Whether it’s hosting, website care or wider IT Support, we’ll make sure you’re protected.
Call us on 0333 366 1000 or email sales@stradcom.co.uk.
