On 21 October 2026 the PHP project released emergency fixes for two critical security flaws, nicknamed PHP2Shell. The same day, the UK’s National Cyber Security Centre told every organisation running PHP to update. If you have a website, there’s a good chance this applies to you, even if you’ve never heard of PHP. Here’s what it means and what to do about it.

What is PHP, and why does it matter to you?

PHP is the programming language that runs most of the web’s websites behind the scenes, including every WordPress site, plus Joomla, Drupal, Magento and WooCommerce. You never see it. Your hosting company runs it on the server that serves your pages. Like any software, it needs updating when flaws are found, and this is a big one.

What happened

PHP2Shell is the nickname for two flaws, CVE-2026-109618 and CVE-2026-109619. Both are rated critical, with a severity score of 9.2 out of 10. Both let an attacker run their own code on a web server, and neither needs a login to do it.

Fixes arrived on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older did not get an official release. The PHP security team published source patches for 7.4, 8.0 and 8.1, but most hosts won’t apply those, so sites on older versions need upgrading to a supported one.

The NCSC alert says organisations using any version of PHP are affected and should update to the latest fixed version.

Why updating WordPress won’t fix it

This is the part most people get wrong. The flaw sits underneath WordPress, your theme and your plugins. Updating any of them cannot touch it, and neither can a security plugin. The fix is a PHP update on the server, which means your hosting company, or whoever manages your server, has to do it.

What to do today

1. Find out what your site runs on. Our free PHP version checker reads what your website shares publicly and tells you in seconds. If you’re on Wix, Squarespace or Shopify, the platform patches its own servers and there’s nothing for you to do.
2. Ask your host. Many servers hide the PHP version, which is sensible, but it means you can’t confirm from outside. Send your host a short message: can you confirm whether my website has been patched for PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which PHP version it runs, and whether that version is supported? The checker gives you this message ready to copy.
3. If you’re on PHP 8.1 or older, plan an upgrade. Those versions won’t get this fix or any future ones. Ask your developer to test the site on a supported version first, make sure there’s a backup, then move it.
4. In WordPress, you can check the version yourself. Go to Tools, then Site Health, then Info, then Server.

Where your site lives decides who does the update

• Managed WordPress hosting (WordPress.com, WP Engine, Kinsta, SiteGround and similar): they patch PHP across the platform. Check their status page or ask support to confirm.
• Shared hosting with a control panel (cPanel, Plesk, hPanel, StackCP and similar): there’s usually a PHP version selector and the patched release may already be there. Ask your developer before changing to a new version, because older plugins can break.
• Your own server or VPS: update the PHP packages from your distribution’s security repository and restart PHP-FPM or the web server.

Why this matters for your Google rankings

A hacked site rarely looks hacked to its owner. Hidden spam pages appear, visitors get redirected to scam sites, and Google notices before you do. Google can label your site “This site may be hacked” in search results, Chrome can show a red warning to visitors, and rankings can drop. Clean-up can take weeks, while your Google Business Profile keeps sending customers to the warning. Keeping PHP patched is far cheaper than that.

Check your site now

Use the free PHP version checker. It takes a few seconds, emails you the result, and gives you the exact message to send your host. If your result comes back hidden or blocked, WhatsApp us on 07510 375 585 and we’ll check it by hand, free.

Sources: NCSC alert, 21 October 2026; PHP security advisories; php.net active releases.