Your Website Runs on PHP. PHP Just Got a Critical Flaw.
On Wednesday, the team that maintains PHP announced two critical security flaws. If that sounds like something only programmers should worry about, here is why it is not: PHP is the engine behind a huge share of the internet, including WordPress. If your business website, online store, or booking page runs on WordPress, there is a good chance PHP is running it right now.
I want to walk you through this in plain English, tell you what is known and what is not, and give you a short list of things to do this week. No panic needed, but this one deserves a phone call today.
What actually happened
Two flaws, one big problem
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and researchers have nicknamed the pair “PHP2Shell.” Both are rated critical, 9.2 out of 10. In simple terms, they are bugs in how PHP handles memory. A bug like that can let an attacker send one specially crafted request to a web server and make it run the attacker’s commands, without needing a password or any help from you.
Think of it like a front door with a lock that can be opened with a bent paperclip. The door looks closed. It is not.
Is anyone using it yet?
Here is what the reports say as of today. A working proof-of-concept exploit exists. Canada’s Cyber Centre says it has not confirmed active attacks, but warns that could change quickly. Help Net Security reports that Amazon’s security team saw an exploitation attempt four days before the flaws went public. Once a working exploit is out there, criminals move fast, and small sites that nobody is watching are the easiest targets.
Does this affect my business?
Your website
Probably, if it runs on WordPress or another PHP-based platform. The fix has to be applied on the server, which means your web host or whoever manages your site. Updating a plugin will not fix it. The patched versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. If your site runs PHP 8.1 or older, the PHP project no longer supports those versions. Some hosts and vendors backport fixes, so ask them directly.
Other equipment in your office
Some business firewalls and appliances ship with PHP inside. According to Help Net Security’s updates, Palo Alto Networks says its firewall software is affected with no fix yet, and other vendors are still checking. If you manage your own equipment, read your vendors’ security notices this week.
What a good host or IT provider will do
They will update PHP to a fixed version, confirm the new version is actually running, look through server logs for strange activity, and turn on firewall protections where they are available. If you work with us, that is exactly what we do. If you do not, ask your provider to show you proof, not just say it is handled.
One more thing. Criminals ride the headlines. Expect fake “urgent PHP security update” emails and calls in the coming weeks. A good spam and virus filter stops many of them, and regular cybersecurity awareness training teaches your team to pause before clicking. And if something does go wrong, read our post on the recovery company scam before you call anyone for help.
What you can do this week
- Email your web host or web developer today. Ask: “Has our server been updated for CVE-2026-109618 and CVE-2026-109619, and what PHP version are we running?” Get the answer in writing.
- Check your website backup. Make sure one exists and that someone has tested restoring it. Our secure data backups are built for this.
- Update WordPress, themes, and plugins. Old plugins are still the most common way in.
- Warn your staff about fake security-update emails, texts, and phone calls.
- Find out who owns your website. If the honest answer is “nobody,” tell us and we will take a look.
The bottom line
This is not a reason to panic. It is a reason to make one phone call today. The businesses that get hurt by flaws like this are rarely the ones that were targeted. They are the ones nobody was watching when the patch came out. For more of our small business cyber security solutions, see how we keep owners covered.
Not sure if your website is patched?
We will check your PHP version, your backups, and your exposure, free.
More plain-English security reads are on our blog.
Send us a message
Sources: Canadian Centre for Cyber Security, Alert AL26-026 (Oct. 21, 2026) and Help Net Security, PHP2Shell (Oct. 21, 2026).
— Nemuel Cruz, Incognito Cyber Security
