> ## Content Index > Fetch the complete content index at: https://grizzlyray.com/llms.txt > Use this file to discover other available public pages before exploring further. # PHP2Shell: What Small Business Owners Should Do Today to Protect Their Website - URL: https://grizzlyray.com/php2shell-small-business-website-fix/ - Published: 2026-10-21T21:25:14.000Z - Updated: 2026-10-21T21:25:14.000Z - Description: PHP2Shell is a critical flaw in the software behind most websites, including WordPress. Here's what small business owners should do today, in plain English. - Author: Jacob Warren - Tags: Small Business, #security, #wordpress, #websites, #practical-tech If you run a small business with a website, there's a good chance it runs on something called PHP. On October 21, 2026, the people who make PHP shipped emergency fixes for two critical security holes. Security folks are calling them **PHP2Shell**. I'm not writing this to try to scare you. I'm writing it because this one's serious enough that it needs your attention, the fix is straightforward, and a lot of small business owners won't hear about it until it's too late. So here's what it is in plain English, what I'd do today, and how to keep your site safer after the headlines move on to the next thing. ## What Happened, in Plain English **PHP** is the behind-the-scenes programming language that builds your web pages on the server before they show up in a visitor's browser. BleepingComputer reports it powers roughly 75% to 80% of all websites, including sites built on WordPress, Joomla, and Drupal. The two flaws are tracked as **CVE-2026-109618** and **CVE-2026-109619**. (A CVE is just an ID number the security world gives each known flaw so everyone's talking about the same thing.) Both are rated 9.2 out of 10, which is "critical." Short answer: this one's bad. Long answer: both flaws can allow **remote code execution**, which means someone on the internet could make your web server run their commands. And they're **unauthenticated**, which means the attacker doesn't need a password or an account on your site. PHP's own advisory says one demonstrated attack works before any of your website's code even runs. This isn't just theory. Before the patches came out, Cloudflare's CTO said they were already seeing early attacks. The UK's National Cyber Security Centre told organizations to update right away or take systems offline until they can be patched. The flaws were found by researchers from Calif, Wiz, and OpenAI, and they affect PHP installs that serve web pages, including the common setups (PHP-FPM, Apache with mod\_php, php-cgi, FrankenPHP, and LiteSpeed). You don't need to know what those are. Just know it covers pretty much every way PHP websites run. ## Do This Today: The Quick Checklist ![A clipboard checklist on a wooden workbench with five checked rows](https://storage.ghost.io/c/3f/f6/3ff6176f-3185-4bdc-932e-7c48d6eccf49/content/images/2026/10/checklist.jpg) 1. **Find out if your site uses PHP.** If it's WordPress, Joomla, Drupal, WooCommerce, or Magento, the answer is yes. (More on how to tell below.) 2. **Update PHP to a fixed version.** The fixed versions are **PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35**. Pick the one that matches the version line you're already on. 3. **Restart PHP after updating.** Installing the update isn't enough if the old version is still running in memory. PHP services and workers need a restart, and sites running in containers may need to be rebuilt and redeployed. 4. **Confirm the version that's actually running.** Don't assume. Check it, or get your host to confirm it in writing. 5. **Check for signs someone already got in.** An update closes the door, but it doesn't kick out anyone who's already inside. If you're on **PHP 8.1 or older**, the PHP project doesn't send updates for those anymore (meaning there is no “official” fix if you don’t upgrade). Some Linux distributions and long-term support vendors offer backported fixes (that just means they copy the fix into the older version), so ask your provider. Otherwise, it's time to upgrade to a supported version. Here's one that trips people up: on Linux servers, a host may patch your existing version without changing the version number you see. Switzerland's National Cyber Security Centre points this out. So "it still says 8.3" doesn't automatically mean it's unpatched. That's why I'd ask your host to confirm it. It's the cleanest answer. ## How to Tell If Your Site Uses PHP - **You log in at a web address ending in /wp-admin.** That's WordPress, and WordPress runs on PHP. - **Your site was built on Joomla, Drupal, WooCommerce, or Magento.** Those run on PHP too. - **Your hosting dashboard (like cPanel or Plesk) has a "PHP version" or "Select PHP Version" setting.** That's a strong clue, and it's usually where you can see which version you're on. - **Your site is on Squarespace, Wix, or Shopify.** These are hosted platforms, so the platform handles its own servers. You can't update anything there yourself. If you're worried, check their status or support pages. - **You honestly don't know.** That's fine. Send the email below to whoever built or hosts your site. Don't stop at your public website. Switzerland's NCSC also warns that PHP can be hiding inside admin portals, internal business apps, and devices, and the people running them don't always know it's there. If you have a booking system, customer portal, or office device with a web login, I'd ask the vendor too. ## What to Do Based on Where Your Site Is Hosted ### Shared Hosting (GoDaddy, Bluehost, Hostinger, and Similar) You share a server with other customers, and the host controls the PHP install. Your job is to log in, check which PHP version your site is set to, switch it to a supported version if it's old, and ask the host to confirm in writing that they've applied the PHP2Shell fixes. If your site is pinned to an old version like 7.4 or 8.0, test switching to a newer one. Older plugins can break, so have a backup first. ### Managed WordPress Hosting Managed hosts usually handle PHP updates for you. That's the good news. Still, trust but verify. Ask them to confirm the patch and the date it was applied, and check that your site isn't sitting on an old PHP version they no longer patch. ### Your Own Server or VPS If you (or your web person) rent your own server from someone like DigitalOcean, Linode, or AWS, nobody's patching it but you. Install the fixed PHP release or your Linux distribution's security update, restart every PHP service, rebuild any containers, and check the running version afterward. Hand the official PHP advisories (linked below) to whoever manages it. ## Questions to Ask Your Host or Web Person Here's an email you can copy, paste, and send today: Subject: Have you patched PHP2Shell (CVE-2026-109618 and CVE-2026-109619) on my site? Hi, I saw that PHP released emergency security fixes on October 21, 2026 for two critical flaws called PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Can you please confirm a few things for my website, \[your website address\]? 1. Does my site run on PHP, and which version? 2. Has the fix been applied (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35, or a patched package from your provider), and on what date? 3. Were the PHP services restarted afterward so the fixed version is actually running? 4. If my site is on PHP 8.1 or older, what's the plan to patch or upgrade it? 5. Have you checked the server for signs of compromise, like unusual requests, crashes, changed files, or unexpected processes? 6. Do I have a recent backup stored somewhere separate from the website? Thanks for your help. ## If You Can't Patch Right Away Sometimes an update can't happen today. PHP has shared some temporary settings, like turning off a little-used feature called upload progress, and blocking certain types of form uploads (called multipart requests) before they reach PHP. Cloudflare has also rolled out firewall rules aimed at known attacks. Here's the hard truth: **none of these fully protect you.** PHP's own advisory says updating is the only complete fix, and Switzerland's NCSC says even a web application firewall alone isn't enough. Some of these changes can also break uploads and forms on your site, so they need someone who knows your setup. If you truly can't patch, limit who can reach the site, or take it offline until it's fixed. A few hours offline costs a lot less than cleaning up a hacked site. ## Signs Someone May Have Already Gotten In An update doesn't undo damage that already happened. Ask your host or web person to look for: - Unusual requests in the server logs, or a spike in errors and crashes - Files that changed when nobody on your team made changes - Unexpected programs or processes running on the server - New admin users on your site you didn't create - Your site redirecting visitors to strange pages, or a browser or Google warning about your site PHP notes that a clean log isn't proof you're safe, so if something feels off, get help. The UK NCSC specifically recommends looking for backdoors (hidden ways back in) and bringing in an incident response professional if you're not confident doing it yourself. **The takeaway:** PHP2Shell lets attackers run commands on a PHP web server without logging in, and attacks have already been seen. If your site runs on PHP, which includes WordPress, get it updated to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 (or a patched package from your host), make sure PHP was restarted, confirm the running version, and check for signs of trouble. Workarounds only buy time. ## Protect Your Small Business Website for the Long Haul PHP2Shell will fade from the headlines. There'll be a next one. These habits make the next emergency a lot less stressful: - **Know what you run.** Keep a simple list of your website, where it's hosted, who manages it, and what software it uses. - **Stay on supported versions.** Software that no longer gets updates is a sitting duck. - **Turn on automatic updates** for WordPress, plugins, and themes where you can, and delete plugins you don't use. - **Back up regularly** and keep a copy somewhere separate from your website, so you can restore if something goes wrong. - **Use multi-factor authentication** on your hosting account, website admin, and domain registrar. - **Know who to call.** Decide now who you'll contact if your site gets hacked, before it happens. ## Resources Worth Bookmarking **About PHP2Shell** - [PHP advisory for CVE-2026-109618](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w?ref=grizzlyray.com) (for your web person) - [PHP advisory for CVE-2026-109619](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp?ref=grizzlyray.com) (for your web person) - [UK NCSC alert on PHP](https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php?ref=grizzlyray.com) - [Swiss National Cyber Security Centre warning](https://www.bacs.admin.ch/en/warnung-php-en?ref=grizzlyray.com) - [BleepingComputer's news coverage](https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/?ref=grizzlyray.com) **Lasting small business resources** - [PHP supported versions](https://www.php.net/supported-versions.php?ref=grizzlyray.com): see which PHP versions still get security fixes - [CISA Known Exploited Vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?ref=grizzlyray.com): the US government's list of flaws attackers are actively using - [CISA cyber guidance for small businesses](https://www.cisa.gov/cyber-guidance-small-businesses?ref=grizzlyray.com) - [CISA Secure Our World](https://www.cisa.gov/secure-our-world?ref=grizzlyray.com): simple everyday security steps - [FTC Cybersecurity for Small Business](https://www.ftc.gov/business-guidance/small-businesses/cybersecurity?ref=grizzlyray.com), including what to ask when hiring a web host - [SBA: Strengthen your cybersecurity](https://www.sba.gov/business-guide/manage-your-business/strengthen-your-cybersecurity?ref=grizzlyray.com) - [UK NCSC Small Business Guide](https://www.ncsc.gov.uk/collection/small-business-guide?ref=grizzlyray.com) - [WordPress hardening guide](https://developer.wordpress.org/advanced-administration/security/hardening/?ref=grizzlyray.com) - [How to update WordPress](https://wordpress.org/documentation/article/updating-wordpress/?ref=grizzlyray.com) ## Your Next Step Send that email to your host or web person today. It takes two minutes, and the answer tells you whether you're covered or whether you've got work to do. Here's my question: do you know, right now, who would fix your website if it got hacked tonight?