PHP Vulnerability 2026: What Website Owners Should Do Now

Key takeaways

• The fix is a PHP update on the server. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix both flaws, according to php.net's security advisory of 21 October 2026.
• Both flaws are rated critical. GitHub's advisories give each a CVSS v4 score of 9.2 out of 10, and say an attacker needs no login to reach them.
• WordPress itself needs no update. WordPress.org says these flaws are not specific to WordPress, and that no WordPress update is required or planned. The server's PHP is what needs updating.
• Old PHP gets no official fix. The PHP project has stopped updating 8.1 and everything older. For 7.4, 8.0 and 8.1 it published only small source patches, and it tells you to ask your vendor about backports.
• Settings only reduce the risk. The workarounds PHP lists "do not make an installation safe". Only the update is a full fix.
• Most small business owners cannot do this alone. PHP lives on your host's server. Your job is to find out which version you run, ask the host to update it, and confirm it was done.

What happened

On 21 October 2026, php.net put a banner on its front page headed "Security advisory: Critical remote code execution vulnerabilities, update now". It says two critical vulnerabilities in PHP can allow unauthenticated remote code execution, which means an outsider could run commands on the server without logging in.

Sources: php.net front page (21 October 2026) and the php-src GitHub advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp, read on 22 October 2026.

Headlines from The Hacker News and Wiz call the pair "PHP2Shell". That is a press name, not an official one, and the CVE numbers above are what you should quote to a host. A Hacker News headline on 21 October also says exploit attempts have emerged. We have not independently confirmed that, so treat it as a reason to move quickly and not as a measured fact.

Who is affected

php.net says the risk is to "all PHP installations serving web requests", including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates mod_php highest, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.

The GitHub advisories say the affected versions are anything below 8.2.35, 8.3.36, 8.4.27 or 8.5.12 on the matching branch. The UK's National Cyber Security Centre goes further and says organisations using any version of PHP are affected, and should not limit their search to old versions.

What this means for the kinds of site people ask us about:

Webflow's own Trust Center, in a notice of 21 October 2026, says no customer action is required. For Shopify, Wix, Squarespace and Framer we found nothing on 22 October 2026, so for those four the row is the logic of the setup, not a quote, and a direct question to each is the way to be sure. Our guide to Webflow security goes through Webflow's notice.

What to do, in this order

1. Find out if you run PHP. If your site is on WordPress, you do. WordPress shows the number in Site Health: use the Info tab and its Server block. WordPress.org gives this route. Many hosts show it in their control panel as well.
2. Compare it with the fixed releases. You want 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a newer release on that branch. Some Linux hosts backport a fix and keep the old version number, which is why php.net tells you to check your vendor's package notes.
3. Ask your host in writing whether the fixed version is live for your site, or when it will be. We have written questions to send your host about the PHP security fix that you can paste. WordPress.org says some hosts may already be patching or filtering traffic for you.
4. If you control the version, update it. Back up first, update WordPress, themes and plugins, and test. Our guide to checking and updating your PHP version on WordPress goes through it.
5. If the version is 8.1 or older, move off it. There is no official fix. Your host may sell a backported fix or extended support, or you need a newer PHP.
6. Know what the NCSC says about waiting. If you cannot update or apply the temporary measures quickly, it says to consider taking the system offline until it is mitigated. WordPress.org repeats this for servers you run yourself on PHP older than 8.2. For a shop that takes orders, that is a real cost, so decide it on purpose.
7. Look for signs of compromise if you stayed exposed. The NCSC advises checking for evidence of compromise and for backdoors before you upgrade. If you are not confident doing that yourself, it points to assured incident response providers, and WordPress.org has an FAQ on what to do if your site was hacked.

Settings PHP lists if you cannot update yet

These come from the php.net advisory. They apply to your server's configuration, so they are for whoever manages it, and they should be applied in php.ini, the FPM pool or the web server configuration. The advisory warns they do not make an installation safe.

Do not set a hard operating-system memory cap as a substitute. The advisory specifically says RLIMIT_AS and RLIMIT_DATA can cause the vulnerable allocation failure.

What is still unclear

• Real-world attacks. The reports we could read were headlines. We have no verified count of hacked sites, and the numbers circulating will change over the next days.
• Your host's status. Hosts patch on their own timetable. A host can say "done" for new accounts while an old plan still runs an older PHP.
• Version strings. A distribution can fix the bug and keep the old number, so a version check alone can mislead. Ask for confirmation, not only a number.
• Plugins. Neither WordPress.org nor PHP says plugins make the flaws better or worse. The risk sits below the plugin layer, so cleaning up plugins does not replace the update.

What it means for how you run a website

A PHP site needs someone to keep PHP, the CMS and the plugins current, and to answer on the day a flaw like this lands. That is a normal part of owning a WordPress site, and it is one of the lines in our guide to website maintenance costs. If you are weighing platforms, our comparison of Webflow and WordPress for a service business and our WordPress cost guide put this ongoing work in the sum. Our notes on moving amariq.com off Webflow to a static site show what a site with no PHP looks like in practice.

This is not a reason to panic-move a site. A well-kept WordPress site on a host that updates quickly is fine. It is a reason to know who owns the update. Related reading: RCE explained, PHP end of life, hacked WordPress sites, firewalls versus updates and WooCommerce shop advice.

How we help

At Amariq, we build and look after sites on WordPress, Webflow and Framer. On WordPress sites we limit plugins to reputable ones, apply updates carefully, keep backups and test ahead of a PHP change, and maintenance can include all of that. Our WordPress development and Webflow maintenance pages describe the work, and if you would rather leave PHP behind altogether, Webflow migration moves a WordPress site across with its URLs and rankings protected. Pricing follows each project's scope. After the final payment the files, text and design are yours, and the logins for domain, hosting and analytics stay in your name.

Frequently asked questions

What is PHP2Shell?

It is the name that security press and researchers have given to the two PHP flaws fixed on 21 October 2026, CVE-2026-109618 and CVE-2026-109619. The official names are the CVE numbers and the php.net advisory. Both allow unauthenticated remote code execution under the conditions the advisory describes.

Is my WordPress site affected?

If your host runs a PHP version below the fixed release for its branch, or a branch that has no fix, yes. WordPress.org says the flaws affect any server hosting a PHP application and that no WordPress update is needed. The fix is on the server.

Do I need to update WordPress?

Not for this. WordPress.org says no WordPress update is required or planned for these issues. Keep WordPress, themes and plugins current anyway, and do it before you change the PHP version.

Which PHP version should I be on?

At least the fixed release for your branch, which is 8.2.35, 8.3.36, 8.4.27 or 8.5.12. WordPress.org's current recommendation is PHP 8.3 or newer. PHP 8.1 and older no longer get fixes from the PHP project.

Can I protect my site without updating?

Only partly. The php.net settings above cut off some attack paths, and the advisory says they do not make an installation safe. A host's web application firewall rules may help too, but WordPress.org still tells owners to update.

Does this affect Webflow, Shopify or a static site?

The advisory is about servers that run PHP. A static site has no PHP serving its pages, and hosted builders run their own servers. Webflow's Trust Center notice of 21 October 2026 calls its core services unaffected. Shopify, Wix, Squarespace and Framer had no statement that we could find on 22 October 2026, so ask them directly.

Has my site already been hacked?

You cannot tell from the news alone. If your site was on an old PHP and stayed exposed, the NCSC advises checking for evidence of compromise and backdoors. Unexpected files, new admin users, odd redirects or a host warning are the signs to take seriously, and an incident response provider can help.