This week, security researchers and government agencies raised the alarm about two flaws in PHP, nicknamed PHP2Shell. If you have never heard of PHP, you are in good company. But there is a strong chance your business website runs on it.

The technical write-ups are full of terms like “use-after-free” and “unauthenticated RCE.” This post skips all of that. Here is what happened, why it matters, and the short list of things worth doing this week.

The short version

PHP2Shell is a pair of flaws in PHP, the behind-the-scenes engine that runs most websites, including every WordPress site.
Fixes are available, but they have to be installed by whoever manages your web server, which is usually your hosting company. Updating WordPress does not fix it.
As of October 23, attack attempts are widespread, but no successful break-ins have been confirmed. That makes right now the best time to get patched.

First, what is PHP?

Think of your website as a restaurant. WordPress, your theme, and your plugins are the dining room and the menu: the parts visitors see. PHP is the kitchen. Every time someone loads a page or submits a contact form, PHP takes the order and prepares what comes out.

Visitors never see the kitchen, which is exactly why most business owners don’t know it is there. And it is everywhere:

70.8%

of websites with an identifiable server-side language run on PHP

W3Techs, July 2026

~42%

of all websites run WordPress, which is built entirely on PHP

W3Techs data, March 2026

9.2 / 10

severity score given to each PHP2Shell flaw

Zscaler ThreatLabz

What actually went wrong

The flaws were discovered in August by researchers at Wiz, OpenAI, and Calif, according to SecurityWeek. Both come down to how PHP cleans up after itself.

When a request pushes PHP past its memory limit, PHP stops abruptly. In that rushed stop, some of its internal notes get left half-written or pointing at space that has already been handed back. A carefully built request can take advantage of that mess and get the server to run the attacker’s own instructions.

Back to the restaurant: imagine an order ticket gets torn in half during a rush. A clever customer scribbles their own instructions on the leftover half, and the next cook follows them without question.

Why it earned a 9.2 out of 10

No login required. An attacker does not need a username or password.
No one has to click anything. There is no phishing email involved, so attacks can be fully automated.
It reaches back more than a decade. Every PHP version from 5.4 onward is affected, per Zscaler ThreatLabz.

Where the flaw lives (and why that matters)

This is the part most coverage misses for non-technical readers. Your website is built in layers, and PHP2Shell sits in the middle one.

Your website

WordPress, theme, plugins, content

You can update this

from your WordPress dashboard

PHP engine

Processes every page load and form

PHP2Shell

Only your host or IT team

can update this layer

Server and operating system

The machine your host runs

Managed by your host

or your IT provider

Most WordPress security issues live in the top layer, so a plugin update fixes them. PHP2Shell is different. The flaw is in the engine underneath, before WordPress even loads. As WordPress security firm Wordfence put it to site owners, the fix will not arrive through automatic updates, so you need to find out who is responsible for your PHP (via Martin Cid Magazine).

How it unfolded

August 2026

Researchers privately discover the flaws and report them to the PHP team, which begins building fixes.

October 17

Amazon’s decoy servers record a first attempt to use the flaw while details were still under wraps (SecurityWeek).

October 20

Details leak online ahead of the planned release. PHP tells users to prepare to update immediately (SecurityWeek).

October 21

PHP releases the fixes a day early. CISA urges organizations to update right away. Some government, school, and hospital sites in Europe go offline as a precaution.

October 23

Botnet operators start trying the flaws too. Still no confirmed successful break-in reported by any security vendor.

How fast attack attempts grew

Attempts seen across Cloudflare’s network. Each bar is roughly ten times the one above it.

10 hours before the announcementThousands

45 minutes afterTens of thousands

2 hours afterHundreds of thousands

The next morningMillions

Source: Cloudflare CEO Matthew Prince, as reported by SecurityWeek

That speed is the real lesson. Once a flaw like this goes public, automated tools start knocking on every door on the internet within minutes. Attackers do not need to know your business exists.

Who installs the fix for your setup?

The answer depends on how your website is hosted. Here’s a quick guide.

Your setup	Who installs the fix	What to do
Shared hosting (cPanel-style plans)	Your hosting company	Ask when the patched PHP version will be live on your account.
Managed WordPress hosting	Your hosting company	Get the patch date in writing, then confirm your version once it lands.
Your own cloud server or VPS	You or your IT provider	Update PHP now. This one is on your team.
Website builders (Wix, Squarespace, Shopify)	The platform	Generally nothing for you to install. Check the platform’s status page.
Vendor portals and software with a web dashboard	The vendor	Ask whether the product uses PHP and when a fix ships.

Five steps for this week

1

Find your PHP version

In WordPress, go to Tools > Site Health > Info > Server. Many hosting control panels also show it, often under a setting called MultiPHP Manager or PHP Configuration.

2

Compare it to the fixed versions

You want 8.5.12, 8.4.27, 8.3.36, or 8.2.35 (or newer). Some hosts apply the fix without changing the version number, so if you are unsure, ask them to confirm in writing.

3

Plan a move off old versions

If you are on PHP 8.1 or older, there is no official fix. Zscaler recommends moving to a supported version right away. Test first, since older plugins and themes can break on newer PHP.

4

Look beyond the main website

Client portals, booking tools, intranets, and some vendor products also run PHP. Make a quick list of every web-based tool your business hosts or pays for.

5

Keep a fresh backup and watch for oddities

Signs worth flagging: admin accounts you did not create, unfamiliar files, or a site that suddenly slows down or crashes.

The bigger lesson for business owners

31%

of breaches now start with attackers exploiting a software flaw, the top entry point for the first time

Verizon 2026 DBIR via SC World

20%

was the share just one year earlier, a 55% jump in a single year

Verizon 2026 DBIR via watchTowr

PHP2Shell is one example of a bigger shift. Attackers increasingly get in through unpatched software rather than stolen passwords, and the window between a fix being released and attacks starting has shrunk to hours.

Several security leaders quoted by SecurityWeek made the same point: the hardest part is often not applying the patch. It is knowing every place you run the affected software in the first place. Forgotten test sites and old vendor tools are where trouble tends to hide.

The businesses that handle events like this calmly are the ones that already have three things in place: an up-to-date list of what they run and where, a routine for applying updates quickly, and someone watching for suspicious activity around the clock.

Common questions

Has my website been hacked?

Probably not. As of October 23, no successful compromise has been confirmed by any security vendor. The goal is to get patched before that changes.

Will updating WordPress or my plugins fix this?

No. The flaw is in PHP, the engine underneath WordPress. Keep WordPress updated for other reasons, but this fix has to come from your host or IT team.

Does a security plugin protect me?

A web firewall can block some known attack patterns, which helps as a stopgap. It is not a substitute for the patch, because the flaw sits below the level where WordPress plugins run.

Is this as big as Log4Shell?

Some experts compare the two. Security researcher Marcus Hutchins estimated PHP2Shell is about halfway to Log4Shell’s scale: very widespread, but less buried inside other products, which should make it easier to find and fix (SecurityWeek).

Not sure what is running behind your website?

SBT Partners' team keeps an inventory of what each client runs, applies updates on a schedule, and monitors for suspicious activity 24/7, so news like this is a quick check instead of a scramble.

TALK TO OUR TEAM→

Share this post

More like this