A serious flaw in PHP, the software under most business websites, was fixed on Oct 21. Here's how to check your site in 15 minutes.

What happened

On October 21, 2026, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. Both are rated 9.2 out of 10. In plain terms: under the right conditions, an attacker can send a specially crafted web request and run their own code on the server, without a password. PHP says the risk is highest on Apache with mod_php, where an exploit was demonstrated before any website code even runs.

PHP is the language underneath WordPress, WooCommerce, Drupal, Joomla and Magento. Cloudflare says PHP is used by almost 70% of websites.

A few details matter for a business owner:

WordPress itself doesn't need an update. WordPress.org said on Oct 21 that no WordPress update is required or planned. The fix is a PHP update on the server, and your WordPress dashboard can't do that.
Attack attempts started early. Cloudflare says details leaked before the official release and it saw attack traffic aimed at its customers; it turned on firewall protection for free and paid plans by default about nine hours before disclosure. CISA said it had not seen successful exploitation as of its Oct 21 alert, and still urges immediate patching.
Old PHP has no official fix. PHP 8.1 and older no longer get updates from the PHP project. Some hosts and vendors backported fixes. CISA and WordPress.org both say self-managed servers that can't be updated should be taken offline until they are.
A firewall helps but isn't the fix. Cloudflare, PHP and CISA all say firewall rules reduce risk while you patch, but only the PHP update closes the hole.
A third, lower-risk bug was announced on Oct 23. CVE-2026-115560 is not fixed yet and only affects an unusual setup; PHP suggests turning off one setting (session.upload_progress.enabled) until its next regular release.
AI found it first. OpenAI says researchers at Calif found one of the flaws using its GPT-5.6 Sol model as part of its Patch the Planet program, and Wiz found both independently. OpenAI expects similar findings to increase sharply in the coming months.

Who it helps

Owners with a WordPress, WooCommerce, Drupal, Joomla or Magento site who aren't sure whether their host has patched it.
Teams whose site lives on a VPS or a cloud server someone set up years ago. On these plans, updating PHP is your job, not the host's.
Anyone still on PHP 8.1 or older, which covers many older sites that "just work."
Agencies and freelancers who look after client sites and need to confirm each one is covered.

How to apply

List every site you own (5 minutes). Main website, online store, landing pages, booking or membership sites, and any staging or old copies that are still online.
Check the PHP version (5 minutes). In WordPress, go to Tools > Site Health > Info > Server. Many hosting control panels show it too. Fixed versions are 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later. Some hosts apply the fix without changing the version number, so if your number looks old, check your host's notice before you worry.
Know who patches it. On shared or managed hosting, the host patches PHP. Here is what six large hosts say on their own pages:
- Hostinger: fix installed on every plan except VPS, completed Oct 22, no action needed. VPS customers must update PHP themselves. To confirm, a PHP Info Build Date of Oct 21, 2026 or later means the fix is in.
- GoDaddy: all PHP versions patched on Managed Hosting for WordPress, Web Hosting and Windows Hosting, no action needed. On Web Hosting the version number may not change, so check for a build date of Oct 21, 2026 or later. VPS customers update PHP themselves or use GoDaddy's paid Expert Services.
- SiteGround: protections were in place on all servers before the release, and PHP's official fixes were applied across all servers. No action needed.
- WP Engine: all customer sites run fully patched PHP. No action needed.
- Kinsta: updates deployed for PHP 7.4 through 8.5, including staging, and the incident was marked resolved on Oct 22. No action needed.
- WordPress.com (and Automattic's WordPress VIP, WP Cloud and Pressable): sites are already protected. Nothing to do.
If your host isn't on this list, or you're not sure which plan you have, ask support one question: "Is the PHP2Shell fix installed on my server, not just scheduled?"
If you're on a VPS or self-managed server, patch now. Take a backup, update PHP through your control panel or package manager, then restart PHP and the web server. If you restore an old backup or snapshot later, check the PHP version again, since it may bring back the vulnerable build.
If you're on PHP 8.1 or older, plan the upgrade. Ask your host whether they've backported the fix. Either way, move to PHP 8.2 or newer, testing on a staging copy first because old plugins can break. Since PHP 8.2 itself stops getting security fixes on Dec 31, 2026, aim for 8.3 or newer if your plugins allow it.
Look for anything odd. New admin users you didn't create, changed pages, strange redirects, or unfamiliar files. If you use Cloudflare, keep its protection on; paid-plan customers should confirm the Managed Ruleset is set to block.
Skip the panic updates. Updating every plugin at once doesn't fix PHP and can break your site. Fix the right layer.

How CerpaMedia can help

If you'd rather not dig through hosting panels, we can check it for you. We list every site you run, confirm the PHP version and who is responsible for patching it, and get your host's confirmation in writing. Where something is on you, we back it up, apply the fix or upgrade, and test the site before and after. Then we leave you a one-page record of what runs where, who patches it, and when each PHP version reaches end of life, so the next security notice is a quick check instead of a scramble. To talk through your setup, book a strategy call.