On October 21, 2026, PHP fixed two critical security flaws, now known as PHP2Shell, that can let an attacker run code on a web server without logging in. If your website or store runs on WordPress, WooCommerce, Magento or anything else built with PHP, PHP’s own advisory puts it at risk until its PHP is updated. Ask whoever looks after your hosting to update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor’s patched build, and to tell you when it went live.
How to check your site’s PHP version
WordPress is built with PHP. The ecommerce security firm Sansec says Magento, Shopware and WooCommerce stores are affected “even when their own code is clean”, because the flaws sit in PHP itself.
If your store runs on a hosted platform such as Shopify, the platform runs its own servers, so PHP is not something you manage.
To see your version in WordPress, go to Tools > Site Health > Info and expand the Server section, which lists your server’s PHP details. WordPress’s guide to the Site Health screen shows the same path. If you don’t use WordPress, ask your host or developer for the number.
The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or a later release in the same line.
Your host may show a lower number and still have the fix. Linux distributions and long-term support vendors received the patches in advance, and some copy a fix into the older version they ship, which is called a backport. If that is your case, ask them to confirm in writing that their build fixes CVE-2026-109618 and CVE-2026-109619.
If the site runs PHP 8.1 or older, the PHP project no longer updates it: ask your vendor about a backported fix, or plan an upgrade to a supported version. If it runs 8.2, plan the next move now, because PHP 8.2 gets no security fixes after December 31, 2026.
Updating WordPress, your theme or your plugins does not update PHP. Sansec puts it plainly: “you cannot fix PHP2Shell from within your store code.”
The checklist to send your host or developer
Send these four questions as they are.
- Which PHP version is serving our website right now?
- Is it 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later, or a vendor build that includes the fix for CVE-2026-109618 and CVE-2026-109619?
- On what date was the update applied, and did it reach every server the site runs on?
- Has anyone checked the site for signs that someone got in before the update?
A staging copy of the site, or an old site that is still online, counts as a server too: PHP says every installation serving web requests is at risk. The last question matters because someone was already trying to exploit these flaws before the fix was public, as the next sections explain.
If the update has to wait
PHP lists stop-gap settings for servers that can’t be updated yet, and says they “reduce exposure to specific attack paths but do not make an installation safe.” Its release notes are shorter: “updating is the only safe choice.”
Sansec adds one more stop-gap: rejecting multipart form requests, the format browsers use to upload files, at the web server. It warns that this breaks uploads, and on some stores the cart or checkout, so it advises a test order and removing the rule once PHP is updated.
Both are jobs for your host or developer. Your part is to ask what is in place and when the real update will happen.
How serious it is
The scale of attacks is uncertain. The reports so far point in different directions.
Help Net Security reports that Amazon Threat Intelligence’s MadPot honeypot network, decoy servers set up to attract attackers, recorded a PHP2Shell exploitation attempt on October 17. That was four days before the fixes were public, and how the attacker got the details early is still unknown.
Unit 42, the threat research team at Palo Alto Networks, says it has seen proof-of-concept code. It describes attackers who targeted a government entity in Europe and then used AI attack tools once they were in. At least one European government took its website offline as a precaution.
Sansec reports that a researcher who tested the public exploits found they “do not work against a default PHP installation.” It now calls mass exploitation “less likely than we expected on release day” and says store owners do not need to take their store offline.
Help Net Security also reports that the UK’s National Cyber Security Centre (NCSC) is urging organizations to “consider taking offline any system that can’t be fixed right away.”
Sansec says an attack needs specific conditions on the target server, and Unit 42 describes one that went ahead. PHP’s advice is the same either way: update.
What a hacked site costs you in Google
If a site is hacked, the damage reaches Google too. Google says a hacked site “can appear with a warning label in search results or an interstitial warning page in the browser”. That second one is a full-page warning shown before your site loads.
Cleaning up part of the site does not lift it. In Google’s words, fixing the issue on just some pages “will not earn you a partial return to search results.” Once every page is clean, you request a review in Search Console’s Security issues report, and a review “can take from a few days to a few weeks to complete.” Your ads send people to the same site in the meantime.
So two jobs need a name next to them. One person, at your company or at your host, owns PHP updates and tells you when one is done. And someone with access to Search Console checks the Security issues report, where Google lists the security problems it found on your site.
Our guide on how to tell if your website has been hacked lists the checks you can run without a developer.
What our own site runs on
Our own site, sp-partners.co, is built as static pages and served by Netlify, so this release had no PHP to fix on that server. The platform you pick decides who has to act when news like this breaks. On your own WordPress or Magento site, that is your host, your developer or you.
Next step
Keeping a site visible in Google is part of our search work. That includes technical SEO, such as how Google crawls and indexes your site, along with the pages people find you through. If you’d like to talk it through, book a call: a 30-minute conversation with Simon or Phillip about your organization and whether we’re the right fit.
Sources
We checked every source in this article on October 25, 2026.
- PHP security advisory, October 21, 2026, and the PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 release notes: php.net news archive
- Unit 42, Palo Alto Networks, October 23, 2026: PHP2Shell threat brief
- Help Net Security, Mirko Zorz, October 21, 2026, updated October 22: PHP2Shell patched
- Sansec, October 21, 2026, updated October 22: PHP2Shell research
- Google Search Console Help: Security issues report
- WordPress documentation, updated July 12, 2026: Site Health screen
Want to see how this plays out in a real engagement?
Start with the proof if you are still evaluating. If you already know where things are getting stuck, a direct conversation with a founder is the faster next step.