Major security hole in PHP: how to check your website

On Wednesday 21 October an urgent update to PHP was released. That probably does not mean much to most people. But if your business has a website built in WordPress, this concerns you too.

PHP is what runs behind your website. You never see it, but the site does not work without it. Two serious flaws have now been found in it, and in the worst case a hacker can use them to take over the entire website. Without knowing your password.

The flaws have been named PHP2Shell. You can safely forget that name again. The important thing is that it is easy to get under control.

Is my website affected?

If it is built in WordPress, it runs on PHP. In fact, that goes for around seven out of ten websites where you can see what they are built with. So you are far from alone.

If you built your site in Wix or Squarespace, you can relax. The company behind them takes care of that sort of thing.

Do you not know what your site is built in? Then ask whoever built it. Or write to us, and we will find out.

How worried should I be?

A little. But no more than that you should send one email today.

The flaws have been rated 9.2 on a scale of 10, and Amazon has seen hackers trying to exploit them. The first attempt Amazon caught was as early as 17 October. That is four days before the flaws were made public.

On the other hand, we have not yet been able to find anyone who has confirmed an actual break-in. And the hacking tools freely available online only work under very particular conditions so far, according to the security companies Rapid7 and Sansec. But tools like that improve quickly, so this is not something to leave lying.

Surely my security plugin protects me?

Not here, unfortunately. The flaw is not in WordPress or in your plugins. It sits one layer further down, in PHP itself. So you can be affected even if you always remember to update your plugins.

It is PHP on the server that needs updating. And that is typically not something you do yourself.

What to do (it takes five minutes)

Find out who hosts your website. That is usually your web host or the company that built the site. Then send them this message:

"Hi. I have read about the new security holes in PHP (CVE-2026-109618 and CVE-2026-109619). Is my website updated, and was PHP restarted afterwards?"

That is all. If they say yes, you are on the safe side. If they say something like "we will have to look into that", keep asking until you get a yes.

If you want to check for yourself, log in to WordPress and go to Tools → Site Health. Open the tab with information about the site and look under Server. It shows which PHP version the site is running.

If it says 8.1 or a lower number, the site is on a version in which PHP no longer fixes bugs. It should be upgraded as soon as possible. The US cybersecurity agency, CISA, even recommends taking such sites offline until they have been updated.

If it says 8.2, you are fine for now, provided your provider has updated. But 8.2 stops receiving fixes on 31 December 2026, so mark your calendar. And whatever number it shows, it is your provider who can tell you whether the fix has been applied.

Websites need servicing too

Many people think of a website as something you have made once. But it needs servicing just like the company car, or something will eventually go wrong.

More holes are also being found than before. The researchers behind PHP2Shell used AI, among other things, to find the flaws, and hackers can use the same tools. At the same time, a great many sites run on old versions that nobody has looked at for years. Among customers of the security company Qualys, that applied to 71% of all PHP installations.

Do we host your site?

Then you do not need to do anything. Keeping PHP and the server updated is our job, and it is exactly the kind of thing we keep an eye on. If you are unsure about anything, just write.

Is your site somewhere else, and can you not face dealing with it? Then write to us. We are happy to take a look, and we are only an email away. If the site is getting on in years, it may also be time for a redesign or for moving it over to hosting with us. You can also read how we build WordPress sites.

Want to read more?

We have gathered this from these sources:

• PHP: The announcement of the update (21 October 2026) and the advisories on CVE-2026-109618 and CVE-2026-109619
• CISA: Critical Vulnerabilities in PHP Require Immediate Patching (21 October 2026)
• Amazon: Attack attempts before the flaws became public (21 October 2026)
• Rapid7: A technical walkthrough of the flaws
• Sansec: A test of the public hacking tools
• Qualys: Figures for old PHP versions
• Tenable: Questions and answers about PHP2Shell, including the researchers' use of AI
• W3Techs: how widespread PHP and WordPress is (22 October 2026)