You may have heard about a big security flaw in something called PHP, sometimes nicknamed PHP2Shell, and wondered whether it has anything to do with your business. If you have a website, it might. Here’s what it is in plain English, what it means for a business here in the Milwaukee area, and where we can help.
The short version: PHP, the software that runs most websites, had two serious security flaws. Fixes came out on October 21, 2026. Those fixes go on the web server, not in WordPress, so the question for your business is whether whoever hosts your site has installed them.
What PHP2Shell is
PHP is a programming language that runs on the web server, the computer that sends your website to visitors. You never see it, but if your site is built on WordPress, Drupal, or Joomla, it runs on PHP (Wiz, 2026). W3Techs puts PHP behind 69.3% of the websites whose server language it can identify (W3Techs, October 2026).
PHP2Shell is the nickname for two flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 on the standard severity scale (Rapid7, 2026). Security people call this kind of flaw “unauthenticated remote code execution.” It means someone anywhere on the internet could get your web server to run their commands, with no password, just by sending it the right requests. The researchers at Wiz who found the flaws used them to take over test copies of the latest WordPress, Drupal, and Joomla.
Sources: W3Techs, data as of October 23, 2026; Rapid7, October 21, 2026 (CVSS 4.0). The 34.6% is W3Techs’ 26.9% on PHP 7 plus 7.7% on PHP 5.
PHP also shows up in places you might not think of as “the website.” Customer portals, intranets, online forms and booking tools, older custom business apps, and the control panels a lot of hosting companies use (cPanel and Plesk, for example) can all run on it (Huntress, 2026).
As for where things stand: attackers moved fast. Cloudflare’s CTO said, “We are seeing early attacks emerging” (The Hacker News, 2026). On the other hand, Rapid7 looked at the public proof-of-concept code and said “none appears to be broadly reliable,” though researchers expect that to change. Either way, the safe move is to get the update installed rather than wait to see who gets hit.
Why updating WordPress won’t fix it
This is the part that’s easy to get wrong. Updating WordPress or your plugins doesn’t touch PHP (Malwarebytes, 2026). PHP sits on the server underneath WordPress, and that’s where the fix has to happen. Keep doing your WordPress updates. They just don’t cover this.
WordPress, your theme, your plugins. You or your web developer update these. Doesn’t fix PHP2Shell.
Your host or IT provider updates this. The fix goes here.
The computer your website actually runs on.
Where the PHP2Shell fix happens, and who usually handles each layer.
Who’s responsible for fixing your site
If your site runs on PHP and hasn’t been updated, it’s exposed. Who does the updating depends on how your site is hosted. Pick the one that sounds like you:
Shared or managed WordPress hosting. The hosting company updates PHP on its servers. You may be able to choose which PHP version your site uses from your control panel. Check the host’s status page or ask support whether the fix is installed.
A server you, your web developer, or your IT provider manages (a VPS, a cloud server, or a machine in your office). One of you has to install the update and restart PHP.
Squarespace, Wix, or Shopify. You don’t manage the server, so this one’s on the platform. Check its status page if you want to double-check.
Not sure? That’s common, and it’s the first thing we help with. Your hosting invoice or your web developer should be able to tell you, or you can call us.
To see your PHP version in WordPress, log in and go to the Site Health screen: Tools → Site Health → Info → Server. Then compare the number to this table.
| Your PHP version | Fixed in | Status |
|---|---|---|
| 8.5 | 8.5.12 | Fix available |
| 8.4 | 8.4.27 | Fix available |
| 8.3 | 8.3.36 | Fix available |
| 8.2 | 8.2.35 | Fixed, but end of life Dec 31, 2026 |
| 8.1, 8.0, 7.4 | No official release | Vendor packages or source fixes only |
| 7.3 and older, including PHP 5 | None | Upgrade required |
Sources: Rapid7; watchTowr; The Hacker News (October 2026).
Some Linux vendors ship the fix under an older-looking version number (The Hacker News, 2026), so a lower number doesn’t automatically mean you’re exposed. That’s the reason to get your host’s answer in writing.
If your site is on an old version of PHP
A lot of sites are. W3Techs’ October 2026 numbers show 26.9% of PHP websites still on PHP 7 and 7.7% on PHP 5 (W3Techs). PHP 7.4, 8.0, and 8.1 don’t get an official release for this. PHP published limited source fixes, and some Linux and long-term-support vendors ship patched packages, so ask your host which applies to you. On 7.3 or anything older, including PHP 5, there’s no fix at all, and you need to upgrade (watchTowr, 2026).
If you’re upgrading anyway, go past 8.2. It reaches end of life on December 31, 2026 (The Hacker News, 2026), which would put you right back here in about ten weeks. PHP 8.3 or newer gives you more runway.
The usual reason sites get stuck on old PHP is that older themes and plugins can break on newer versions. Test the upgrade on a copy of your site first, with a backup you can actually restore in hand.
What to ask your host
Whoever manages your server, whether that’s a hosting company, a web developer, or an IT provider, should be able to answer a few questions in writing. You can copy this one:
Subject: PHP2Shell (CVE-2026-109618 / CVE-2026-109619): is our site patched?
Hi,
Can you confirm in writing:
1. What version of PHP our website runs on
2. Whether the fix for CVE-2026-109618 and CVE-2026-109619 has been installed (not just scheduled) and PHP has been restarted
3. If we’re on PHP 8.1 or older, what the plan and timeline are to move to a supported version
4. When our last full backup was taken, and whether anyone has test-restored it
Thank you
Check your PHP version yourself with the Site Health steps above so you can tell whether their answer adds up. Make a list of your other tools that run on PHP, such as a customer portal, an intranet, or a custom web app, and ask each vendor the same questions.
If the fix can’t go in right away, ask what’s protecting the site in the meantime (firewall rules, for example) or whether it should go offline until it’s patched. Canada’s Cyber Centre suggests considering cutting unpatched internet-facing apps off from public networks until they’re fixed (Canadian Centre for Cyber Security, October 21, 2026). A host that says it has “mitigated” the problem has lowered the risk, but the actual PHP update is still the real fix.
How Tobin can help your Milwaukee business
Most business owners don’t want to become experts in PHP versions. They want somebody local to tell them whether their website is exposed and what to do about it. Here’s where we come in:
Common questions
I saw this in the news a few days ago. Is it still a risk?
Yes, until the update is installed on the server your site runs on. The news cycle moves on faster than patching does. If a website you use was down for a while, that doesn’t mean it was hacked. Plenty of organizations took their sites offline on purpose while they patched (Malwarebytes, 2026).
We’re a small business. Why would anyone go after our site?
They probably wouldn’t pick you by name. Attackers run automated tools that scan the whole internet for vulnerable servers, and those tools don’t care how big you are.
Do I need to update my own computer or phone?
No. PHP runs on web servers, so there’s nothing to install on your laptop or phone (Malwarebytes, 2026).
Our host says they “mitigated” it. Are we done?
Not yet. A mitigation lowers the risk while you wait for the real fix. Ask when the actual PHP update will be installed, and get that in writing too.
Not sure where your website stands? Call Tobin.
If you don’t know who hosts your website, or whether your portals and vendor tools are affected, call us at 414-443-9999 or contact us. We’re a Milwaukee-area IT team, and we’ll help you work out what to check and who to ask.
Call 414-443-9999Contact usTobin Solutions supports businesses across Milwaukee, Waukesha, Racine, Kenosha, Madison, the Fox Valley, and northern Illinois from our office in Wauwatosa.
Keep reading
Sources (8)
- W3Techs, “Usage statistics of PHP for websites,” data as of October 23, 2026. Link
- Wiz Research, “PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet,” October 21, 2026. Link
- Rapid7, “CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP,” October 21, 2026 (updated October 22). Link
- The Hacker News, “PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge,” October 2026. Link
- watchTowr, “PHP2Shell FAQ: CVE-2026-109618 & CVE-2026-109619,” October 20, 2026 (updated October 22). Link
- Huntress, “Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities,” October 21, 2026. Link
- Malwarebytes, “PHP2Shell: Why websites are going offline for emergency security updates,” October 21, 2026. Link
- Canadian Centre for Cyber Security, Alert AL26-026, October 21, 2026. Link