PHP2Shell: What Oxfordshire Business Owners Need to Know (October 2026)

If you have seen headlines this week about a serious PHP security flaw and wondered whether your website is at risk, this guide is for you. It explains what happened in plain English, how to check your own site in about five minutes, and what to do if something needs fixing.

What happened?

PHP is the behind-the-scenes programming language that runs a large share of the world’s websites, including every WordPress site. On 20 October 2026, the PHP security team gave advance warning of an urgent security release, and public reports quickly suggested the flaws could let attackers take control of web servers. On 21 October, the fixes were released.

The problem is made up of two flaws, known together as PHP2Shell:

• CVE-2026-109618, which involves how PHP handles running out of memory during a request
• CVE-2026-109619, which involves leftover data from one request being reused by the next

Both are rated critical, with a severity score of 9.2 out of 10. In simple terms, they can allow an attacker to run their own code on a web server without needing to log in, which could let them plant malicious files or steal data.

The UK’s National Cyber Security Centre (NCSC) has asked organisations to take immediate action, and some organisations have taken websites offline as a precaution while they update. Cloudflare reported seeing early attack attempts before the fixes were released. However, at the time of writing there is no confirmed public list of hacked sites, so there is no need to panic. There is, though, a real need to check.

Does it affect my website?

It depends on how your website is built and hosted.

Probably yes, if your site runs on WordPress or similar

If your website uses WordPress, WooCommerce, Joomla, Drupal or another PHP-based system on your own hosting account, it is running PHP and you should check it.

The key point most people miss: updating WordPress or your plugins does not fix this. The flaw is in PHP itself, which sits underneath WordPress on your hosting server. Your host, or whoever manages your server, needs to update the PHP version.

Probably not your concern, if you use a hosted website builder

If your site is built on Wix, Squarespace, Shopify or a similar platform, the platform manages the servers for you, so there is nothing for you to update. The same goes for static websites (simple sites with no database or login area), which do not run PHP when visitors view them. If you are not sure which type you have, ask whoever built your site.

The 5-minute check

Here are three ways to find out which PHP version your site uses. You only need one of them.

1. WordPress Site Health

Log in to your WordPress dashboard and go to Tools > Site Health > Info, then open the Server section. Look for the line that says PHP version.

2. Your hosting control panel

Log in to your hosting account (for example cPanel, Plesk or your host’s own dashboard) and look for a section called something like PHP version, Select PHP version or PHP settings.

3. Ask your host

Send your hosting company a short message: “Have you applied the 21 October 2026 PHP security update for CVE-2026-109618 and CVE-2026-109619 to my account, and which PHP version is my site running?” A good host will be able to answer quickly.

What “fixed” looks like

Once you know your version number, compare it with this list. Your site is on a fixed version if it shows one of these, or anything newer in the same series:

• PHP 8.2.35 or newer
• PHP 8.3.36 or newer
• PHP 8.4.27 or newer
• PHP 8.5.12 or newer

Two important caveats:

• PHP 8.1 and older no longer receive official fixes from the PHP project. Some hosting companies and Linux vendors provide their own patched versions, so ask your host. In most cases the safest answer is to upgrade to a supported version.
• PHP 8.2 support ends on 31 December 2026. If your site is on 8.2.35 you are covered for now, but plan an upgrade to 8.3 or newer before the end of the year.

Moving to a newer PHP version can occasionally break older themes or plugins, so take a full backup first and check your key pages and forms afterwards.

What if my host hasn’t patched yet?

The NCSC’s advice for organisations is clear:

1. Update to a fixed version of PHP as the first priority.
2. If you cannot update straight away, apply the temporary mitigations published by the PHP team. These are server settings that reduce some known routes of attack. They are a stop-gap only and do not make a site fully safe. They are a job for your host or developer, not something most owners should attempt.
3. If neither is possible quickly, consider taking the site offline until it can be fixed. A few days offline is far less damaging than a compromised site.

Signs your site may have been compromised

Most sites will simply need updating. But if your site was running an unpatched version, it is worth looking out for these warning signs:

• Admin users in WordPress that you do not recognise
• Unfamiliar files or folders in your hosting file manager, especially recently changed PHP files
• Spam pages appearing on your site or in Google search results for your domain, often selling pills, casinos or counterfeit goods
• Google Search Console or your browser warning that the site is “deceptive” or “may be hacked”

When to get professional help

If you spot any of these, do not just delete the odd file and hope for the best, because attackers often leave hidden backdoors. Contact your developer or host to investigate and clean up properly. If you have a confirmed breach involving customer data, the NCSC recommends using an NCSC-assured Cyber Incident Response provider, and you may also have reporting duties under data protection law.

Reducing your risk in future

PHP2Shell will not be the last serious security issue. The businesses that come through these moments calmly tend to have a few basics in place:

• A supported PHP version, kept up to date by your host or developer
• Managed updates for WordPress, themes and plugins, with someone checking the site afterwards
• Regular off-site backups, so you can restore quickly if the worst happens
• A firewall, such as Cloudflare or a WordPress security plugin, to block known attacks (helpful, but never a replacement for updating)
• Uptime and security monitoring, so problems are spotted early rather than by your customers

That is exactly what our Code-Flux Care plans cover. From £75 a month, we keep your website, plugins and PHP version up to date, take regular backups, monitor your site and act quickly when issues like this appear, so you do not have to follow the security news yourself.

Free PHP version check until Friday 6 November

Not sure where to look, or not confident what the numbers mean? Until Friday 6 November 2026, Code-Flux is offering a free PHP version check for local businesses. We will tell you which PHP version your site is running, whether it has the 21 October fix, and what, if anything, you need to do next. No obligation.

Email info@code-flux.co.uk or call 07458 382 083.

Frequently asked questions

Sources

• NCSC: Critical security issue affecting PHP
• PHP project: PHP security advisory and releases
• CERT-EU: Security Advisory 2026-018, Critical Vulnerabilities in PHP
• BleepingComputer: PHP ships emergency patches for critical PHP2Shell flaws