Security notice · PHP2Shell

A big PHP flaw dropped this week. Most business sites run on PHP.

On 21 October 2026, the people who maintain PHP shipped an emergency fix for two serious bugs. If your website runs on PHP — and most do, including nearly every WordPress site — here is what it means in plain words, and how to find out in two minutes whether you are exposed.

Check my website — free Ask us about my site

Last updated 21 October 2026 · written for business owners, not engineers

What actually happened

Two flaws were found in PHP itself — the software that runs the back end of a huge share of the web. Nicknamed PHP2Shell, they are tracked as CVE-2026-109618 and CVE-2026-109619, and both are rated 9.2 out of 10 for severity. That is about as serious as these ratings go.

In plain terms: under the right conditions, an attacker on the internet could make a PHP website run commands it was never meant to run — without any password. That is the kind of hole used to deface a site, steal what is in its database, or quietly plant malware that infects your visitors.

The details leaked a day early, on 20 October, so the PHP team released the fix ahead of schedule on the 21st. That is good news: the patch exists. The risk now is every site that has not applied it yet.

The facts, briefly

What it is
Two critical PHP flaws (PHP2Shell)
Tracking numbers
CVE-2026-109618, CVE-2026-109619
Severity
9.2 / 10 — critical
Patched on
21 October 2026
Fixed versions
PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35
Who it affects
Any website serving pages with PHP

Are you exposed?

You almost certainly run PHP if any of these is true. You do not need to know the technical details — the point is simply that PHP is probably involved.

Two reassuring exceptions: sites built on Squarespace, Wix, Shopify or Webflow are run by those companies, who patch their own servers — you do not have to do anything. And a site that is plain static pages, with no PHP at all, is not affected by this.

What to do

  1. Find out if your site runs PHP, and which version. If you are on a managed builder (Squarespace, Wix, Shopify), you are covered — stop here. Otherwise, keep going.
  2. Ask your host or web person to confirm the patch is applied. The fixed versions are 8.5.12, 8.4.27, 8.3.36 or 8.2.35. A good host will have done this automatically; many have not. It is a fair question to ask them today.
  3. If your PHP version is older than 8.2, you have a bigger problem. Those versions are end-of-life: the PHP project no longer ships updates for them, so any fix depends on your host or vendor. The real fix is to move off them, which is a good idea for most sites anyway.
  4. Keep your plugins and themes updated. On WordPress, outdated add-ons are the usual way these holes actually get exploited. Update them, and remove any you do not use.

We are not going to pretend this is a five-minute job you should fear. For most owners it is one honest conversation with whoever runs your site. If you do not have that person, that is what we are for.

Not sure where you stand? We will look — free.

Our free website check reads your public pages the way a visitor and Google do, and tells you in plain English what your site shows the world — including the kind of signals that reveal an outdated, exposed setup. No card, about a minute, and we send it to your inbox.

Run the free check Book a 15-minute call

Straight talk: Station is not a server-patching service, and nobody can promise you will never be hacked. What we do is build and host business sites on a modern setup where this whole class of problem does not apply, and watch them so you are not the last to know. If your site is on an old PHP stack, moving it is usually cheaper than you think — and we will tell you honestly if you are already fine.

Common questions

Is my website affected?
If it runs on WordPress or sits on ordinary shared hosting, PHP is involved, so the flaw applies until your host confirms the patch. If you are on Squarespace, Wix, Shopify or Webflow, those companies run the servers and handle it for you. Run our free check if you are not sure which you have.
Does this mean I have already been hacked?
No. A flaw being published is not the same as your site being broken into. It means the door could be opened if it is left unpatched. The sensible move is to confirm the patch and tighten the obvious things, not to panic.
Do you fix the PHP on my server?
We do not patch other people's servers — that is your host's job, and we will point you to the exact question to ask them. What we do is move sites onto a modern, managed setup where this kind of flaw does not reach you, and keep an eye on them. If a rebuild is the right call, we scope it with a fixed price.
What does the free check actually tell me?
It reads your live site and reports, in plain words, what it can see about how your site is built and what it exposes, along with the things customers and Google notice. It only claims what it can actually observe — if it cannot tell something, it says so rather than guessing.
How much does it cost to be safe?
The check is free. If your site needs to move off an old stack, a new business site from Station starts in the range of a one-time build with month-to-month hosting and care — far less than the cost of a site that gets defaced or taken down. We will give you a real number before you commit to anything.