Fort York DigitalPHP2Shell: the 2026 PHP vulnerability and what to do about your website
On October 21, 2026, the PHP team patched two critical security flaws known as PHP2Shell. PHP runs most small business websites, including almost every WordPress site, so if your company has a website, this probably affects you.
You don't need to be technical to deal with it. This page explains what happened in plain language, how to find out if your site is exposed, and the exact message to send whoever runs your website.
The short version
- Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, were fixed on October 21, 2026
- Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or newer
- PHP 8.1 and older get no official fix
- The fix happens on your web server, not in WordPress
- Ask your host or web person to confirm it this week
What happened
PHP is the software that runs on your web server and builds your pages. Researchers found two flaws in it that let an attacker run their own code on a server with a single specially built request, without a password. Both are rated critical.
The NSA told organizations to install the update right away, and to take affected systems offline if they can't update yet. Attacks were reported the same day the fix came out, and attack tools are public. This is a worldwide issue: a website in Canada is exposed in exactly the same way as one in the US.
Why it matters for a local business
Attackers don't pick targets by size. They scan the whole internet for servers that haven't been updated, and small business sites are often the last to get patched. A hacked site can:
- Get a "This site may be hacked" warning in Google, which scares off homeowners before they call
- Redirect visitors to spam or scam pages
- Leak the names, phone numbers and addresses people sent through your quote form
- Get your email flagged as spam if the server starts sending junk
Your website is also where people go after they find you on the Google map. If that link leads to a warning page, you lose the call.
How to check if your site is affected
You need one number: the PHP version your website runs.
- WordPress: log in, go to Tools, then Site Health, open the Info tab and the Server section, and read "PHP version".
- Hosting panel: look for "PHP version", "MultiPHP Manager" or "PHP Manager". Panels often show only 8.3 or 8.4, not the full number.
- Not sure who hosts it? Ask whoever built the site, or check your credit card statement for a hosting charge.
Compare the full number with the fixed list: 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or newer in the same line. PHP 8.3.30 is still vulnerable; 8.3.36 is fixed. If your site runs PHP 8.1 or older, it is out of date on top of this: PHP 8.1 stopped getting security updates at the end of 2025, and it won't get this fix from the PHP team.
How to get it fixed
For most small business sites, the fix is done by the hosting company or by whoever looks after the website. Send them this:
Hi, please confirm that the PHP running my website (yourdomain.com) is patched for CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), meaning PHP 8.3.36, 8.4.27 or newer, or a backported fix. If it isn't patched yet, please tell me when it will be. Please take a backup before any change and check that my contact form still works afterwards. Thank you.
If you manage the hosting yourself and your panel lets you pick a PHP version, take a backup first, switch to the newest version offered (8.3 or 8.4), then check your home page, your quote form and your login. If something breaks, switch back and get help.
Updating WordPress, plugins or a security plugin does not fix this. Neither does putting the site in maintenance mode. It has to be fixed on the server.
After it's fixed
- Confirm the full PHP version number one more time
- Send yourself a test through your contact or quote form
- Search Google for your business name and check there's no "may be hacked" warning
- Make sure someone is responsible for updates from now on, not just after the next big alert
FAQ
What is PHP2Shell?
PHP2Shell is the name for two critical flaws in PHP, CVE-2026-109618 and CVE-2026-109619. They can let an attacker run code on a web server without logging in. PHP released fixes on October 21, 2026.
Does it affect websites in Canada?
Yes. PHP runs on web servers everywhere, and attackers scan the whole internet. A Canadian site on an unpatched server is exposed the same way as any other.
My site is on Wix, Squarespace or Shopify. Am I affected?
Those platforms run and patch their own servers, so there is nothing for you to update. This mainly affects WordPress and other sites on regular web hosting.
Is PHP 8.1 safe?
No. PHP 8.1 reached end of life at the end of 2025 and does not get this fix from the PHP team. Some hosts patch their own builds, but the safe move is to upgrade to PHP 8.3 or 8.4.
Can you check my website for me?
Yes. Book a free call and we will look at your site with you, tell you whether it needs action, and what it involves. If your site is outdated or hard to keep updated, we can also rebuild it as part of our website work.
Not sure where your site stands?
Book a free call. We will look at your website with you, tell you whether it needs the update, and explain your options in plain language.
More guides: Google Business Profile for roofing companies and lead generation for roofing companies.