PHP2Shell · Guide for small businesses

PHP2Shell: What small businesses need to do now

By Markus Bruckgraber, Co-Founder, Joize FlexCo. Published on 22 October 2026, updated on 22 October 2026.

On 21 October 2026, two serious security flaws in PHP were made public. Almost every business website built with WordPress, Joomla, TYPO3 or running an online shop uses PHP. Here is what your business should do now, in plain language.

Key facts

PHP2Shell is the name for two critical flaws in PHP (CVE-2026-109618 and CVE-2026-109619), rated 9.2 out of 10.
Attackers can run malicious code on the web server without a password and take over the website.
Every website that runs on PHP and hasn't been updated yet is affected. Updating WordPress or your plugins won't help, because the flaw is in PHP itself.
PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 and newer are safe. PHP 8.1 and older get no official update.
Attacks are already happening. Contact your hosting provider or web agency today.

What is PHP2Shell?

PHP is the programming language behind the vast majority of websites, including every WordPress site. “PHP2Shell” is the name for two bugs in PHP itself, published together with the fixes on 21 October 2026. They were discovered by security researchers at Calif and Wiz.

By sending a specially crafted request to a website, attackers can run their own code on the server. This happens before WordPress or your shop has even loaded. Passwords, security plugins and login protection therefore don't help.

CERT.at, Austria's national computer emergency response team, issued a joint warning with the Federal Office for Cyber Security. In Germany, the federal IT security agency BSI declared its second-highest alert level. According to Amazon, the first attack attempts were already seen on 17 October, before the flaws were made public.

Is my website affected?

Probably yes, if your website runs on WordPress, WooCommerce, Joomla, TYPO3, Drupal, Contao, Shopware or PrestaShop and your hosting provider hasn't updated PHP yet. All common server setups are affected (PHP-FPM, Apache with mod_php, php-cgi, LiteSpeed, FrankenPHP).

Websites that are delivered without PHP are not affected, for example static sites or website builders such as Wix and Squarespace, where the provider looks after the server.

Free quick check: does your website run on PHP?

Checklist: what small businesses need to do now

Ask your hosting provider or web agency (Today): Ask in writing whether the PHP update from 21 October has been installed. You can copy the email template below. On shared hosting, the hosting provider usually installs the update, but only for the PHP versions it still offers.
Check your PHP version yourself (Today): In WordPress, you'll find the version under Tools → Site Health → Info → Server. PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 and newer are safe. Step-by-step guide
No update possible? Take the website offline (Today): If your site still runs PHP 8.1 or older, or the update can't be installed right away, CERT-EU and other experts advise taking the website offline for now or shielding it, for example behind a web application firewall such as Cloudflare. In Austria, the University of Vienna, TU Wien and the cinema chain Cineplexx did exactly that.
Have the site checked for signs of a break-in (After the update): The update closes the hole, but it doesn't remove a back door that was planted before. Have someone check for new admin accounts, unknown or modified files, errors such as “Allowed memory size exhausted” or lots of 500 errors in the server logs.
Change passwords and keep a backup (After the update): If the website was online without protection for a while, change the logins for the website admin, hosting, FTP/SFTP and database. Keep a clean backup so you can restore it quickly if something goes wrong.
Know your reporting duties (If you suspect a breach): If personal data may have been accessed, for example from your contact form or customer accounts in your shop, you usually have to report it to the Austrian Data Protection Authority (Datenschutzbehörde) within 72 hours (Art. 33 GDPR). Businesses covered by NIS2, the EU directive on cyber security, have additional reporting duties. If in doubt, get legal advice.
Replace old PHP versions (This week): PHP 8.1 and older no longer get official security updates. Switch to PHP 8.3 or newer in your hosting provider's customer area, then test your website. Old plugins sometimes can't handle the change.

Email template for your hosting provider

Subject: PHP2Shell: Is our website protected yet?

Hello,

On 21 October 2026, the critical PHP security flaws known as “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619) were made public.

Please confirm the following for our website [your web address]:

1. Which PHP version is currently running?
2. Has the security update from 21 October been installed (PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer, or the matching package update)?
3. After the update, did you check for signs of a break-in (unknown files, new admin accounts, unusual errors in the logs)?

If the update can't be installed right away, please take the website offline for now or put it behind a web application firewall.

Many thanks and kind regards

Latest updates (as of 22 October 2026)

22 October 2026

Millions of attack attempts are being reported worldwide (Der Standard, Austrian daily). Cloudflare is filtering attacks for sites behind its firewall.
Large hosting providers are installing the updates, in some cases for older PHP versions too. Linux distributions such as Ubuntu have released their own packages, and their version numbers may look different.
In Austria, the University of Vienna, TU Wien, the regional newspaper NÖN and Cineplexx, among others, took their websites offline as a precaution.

21 October 2026

The PHP project publishes the flaws together with updates: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
CERT.at issues a joint warning with the Federal Office for Cyber Security. Germany's BSI declares alert level 3 (orange).

17 October 2026

According to Amazon Threat Intelligence, the first attack attempts take place, four days before the flaws are made public.

In the long run: less to attack

PHP2Shell won't be the last flaw. A PHP website needs constant updates: PHP itself, the CMS and every plugin. If nobody takes care of that reliably, you'll be exposed again when the next flaw comes along.

The alternative is a website without PHP. It is built in advance and served as simple files. No program runs on the server that attackers could exploit. You can still edit your own text, using a content editor that runs separately from the website. That's how joize.at is built.

Ask about a website without PHP

Frequently asked questions

Will a WordPress update protect me from PHP2Shell?

No. The flaw is in PHP, the software on the server, not in WordPress or its plugins. Your hosting provider or whoever manages your server has to install the update.

Do I have to switch off my website?

Only if the PHP update can't be installed soon, for example on PHP 8.1 or older. In that case, CERT-EU and other experts advise taking the website offline for now or shielding it, for example behind a web application firewall.

Who is responsible, me or my hosting provider?

On shared hosting, the hosting provider installs PHP updates. But it's up to you to choose a PHP version that is still supported. If you have your own server (VPS), you or your agency are responsible.

How can I tell whether my website has already been attacked?

Usually not from the outside. Warning signs include new admin accounts, unknown files, redirects to other websites or unusual errors in the server logs. Ask your hosting provider or a specialist firm to check.

My PHP version is older, but my hosting provider says it's protected. Is that true?

It can be. Linux distributions and some hosting providers apply the fix without changing the version number. Ask them to confirm it in writing.

Is my online shop affected too?

Yes, if it runs on WooCommerce, Shopware, PrestaShop, Magento or another PHP system and hasn't been updated. Hosted shops such as Shopify look after their own servers.

Sources

Need help?

15 minutes with Markus. Free and no obligation. Just pick a time that suits you. Book a call (Markus Bruckgraber, Co-Founder). Joize FlexCo, Vorarlberg. Email: hello@joize.at