If you have seen the headlines this week about a serious security flaw putting around 70% of the world’s websites at risk, you are probably wondering whether your website is one of them.
The flaw, known as PHP2Shell, affects PHP: the software that quietly powers most websites on the internet, including every WordPress website. Government websites in Europe were taken offline as a precaution, and the UK’s National Cyber Security Centre (NCSC) has urged UK organisations to take immediate action.
If matm hosts your website, it is already protected. Our hosting servers have been updated with the official security fix, and there is nothing you need to do.
If your website is hosted somewhere else, read on to find out what the PHP vulnerability is, how to check whether your website is affected and what to do next.
What is the PHP vulnerability in the news?
PHP is a programming language that runs on the server behind your website.
Think of it as the engine under the bonnet. Visitors never see it, but almost everything a WordPress, WooCommerce, Drupal, Joomla or Laravel website does depends on it – from loading pages to processing contact forms and online payments.
PHP2Shell is the name given to two critical security weaknesses found in PHP itself. They were discovered by security researchers at Wiz, OpenAI and Calif, with the help of AI tools, and are rated 9.2 out of 10 for severity. The PHP team released a fix on 21 October 2026.
You can read the full details in the official PHP security advisory and on the researchers’ PHP2Shell website.
The important point for website owners is this: the flaw is in the engine, not in your website. A site with a fully up-to-date theme and plugins can still be at risk if the server it runs on has not been updated.
Is this the same as the wp2shell WordPress vulnerability?
No, although the names are similar.
In July we wrote about wp2shell, a vulnerability in WordPress itself. That one was fixed by updating WordPress.
PHP2Shell sits a layer below WordPress, in PHP. Updating WordPress, your plugins or your theme will not fix it. The fix has to be applied to the server, which is normally the responsibility of your hosting provider.
Why this PHP security flaw is so serious
Most website security issues affect one plugin or one type of website. PHP2Shell is different because of how widely PHP is used.
- No login is needed. An attacker does not need a username, password or any help from someone at your business.
- An attacker could take control of the server. That means they could change your website, add malicious code or use the server to attack others.
- Private information could be exposed. The flaw can leak information held in the server’s memory, including passwords and access keys.
- Almost every PHP version is affected. Researchers found affected versions going back to PHP 5.4, released in 2012.
- Attack code is already circulating. Details leaked before the fix was released, proof-of-concept attack code is being shared publicly, and Cloudflare has seen attack traffic targeting websites.
There is no need to panic, but this is not a security update that should be left until next week.
What could happen if your website is affected?
If an attacker exploits the PHP vulnerability on your server, the consequences could include:
- Visitors being redirected to scam or harmful websites.
- Spam pages or adverts appearing on your website and in Google.
- Customer details or enquiry form submissions being exposed.
- Google or web browsers showing “this site may be hacked” warnings.
- Online shops, bookings or payment pages being disrupted.
- Your website being taken offline by your host.
- Data protection obligations if personal information is compromised.
- Lost enquiries, lost sales and damage to your reputation.
Is my website affected? How to check
1. Find out who hosts your website
If you are not sure, check your invoices or ask whoever built your website. If matm hosts it, you are already protected.
2. Ask your hosting provider directly
This is the most reliable check. Send your host a short message such as:
“Has PHP on the server hosting my website been updated to fix the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619)? If so, when?”
A good hosting provider should give you a clear yes or no and a date.
3. Check your PHP version in WordPress
Log in to WordPress and go to Tools → Site Health → Info → Server. You will see the PHP version your website is running.
The versions that include the official fix are:
| PHP Version | Fixed In |
|---|---|
| PHP 8.5 | 8.5.12 or later |
| PHP 8.4 | 8.4.27 or later |
| PHP 8.3 | 8.3.36 or later |
| PHP 8.2 | 8.2.35 or later |
| PHP 8.1 and older | No official update – depends on your host |
Some hosting providers apply the fix to older versions without changing the version number, so a lower number does not always mean you are unprotected. If in doubt, confirm with your host.
4. Running PHP 8.1 or older? Take note
Older versions of PHP no longer receive official updates. Your website is only protected if your host has applied the fix themselves. If your host cannot confirm this, it is a strong sign your website needs a move or an upgrade.
5. Manage your own server?
If your website runs on a VPS or dedicated server that you or your developer manage, PHP needs to be updated on the server and the web server restarted. Updating WordPress through the dashboard does not update PHP.
What to do if your hosting provider has not fixed it
The NCSC’s guidance goes a step further: if a system cannot be updated or protected quickly, it advises considering taking it offline until it can be.
- Chase them for a date. A delay of days rather than hours is a concern for a vulnerability this serious.
- Use a web application firewall. Services such as Cloudflare have added rules to block known attacks. This reduces risk, but it does not replace the fix.
- Check for warning signs. Look out for unfamiliar admin users, redirects or spam pages. Our guide to 13 warning signs your WordPress website has been hacked explains what to look for.
- Change important passwords once the server is fixed. Because the flaw can expose information held in memory, it is sensible to change WordPress admin, hosting and database passwords after the update.
- Consider moving to a host that patches promptly. If your host is slow to respond to a vulnerability on this scale, it will likely be slow next time too.
How matm can help
Our hosting servers received the official PHP security fix across every PHP version we run, including older versions, so websites we host are protected against PHP2Shell.
If your website is hosted elsewhere and you are worried, we can help:
- Move your website to our secure hosting. We handle the migration for you, with minimal disruption to your website and email.
- Check your website before it moves. We look for signs of compromise first, so a problem is not carried over to a new server.
- Keep it protected afterwards. Our web services include managed WordPress updates, Cloudflare protection, security monitoring and regular backups.
You can see our hosting prices here.
If you are not sure whether your website is protected from the PHP vulnerability, contact matm at [email protected] or call 01952 883 526 and we will check it for you.
Frequently asked questions about the PHP vulnerability
PHP2Shell is the name for two critical security flaws in PHP, the programming language behind most websites. They could allow an attacker to take control of a website’s server without logging in. A fix was released on 21 October 2026.
WordPress runs on PHP, so any WordPress website on a server that has not been updated could be at risk. Whether your site is protected depends on your hosting provider, not on WordPress itself.
No. The flaw is in PHP on the server, not in WordPress. Your hosting provider needs to update PHP.
Yes. Our servers have been updated with the official fix and no action is needed.
Common signs include unfamiliar administrator accounts, visitors being redirected elsewhere, spam pages appearing in Google and browser security warnings. See our 13 warning signs guide.
Ask them for a date, make sure a web application firewall is in place, and consider moving to a host that applies security updates promptly. We can move your website for you.
Technical details are from the PHP security advisory, the PHP2Shell research site, the National Cyber Security Centre and CISA.
