Security alert

PHP2Shell PHP vulnerability: what UK small businesses should do (2026)

On 21 October 2026, PHP released fixes for two serious security flaws. PHP quietly runs a large share of small business websites, shops and booking systems. You may never have heard of it. This guide explains what to check and who to ask, in plain English.

Last updated:

What is PHP2Shell?

PHP is the programming language behind WordPress and many online shops and booking systems. It runs on your web server, not your computer.

PHP has published a security advisory for two flaws, known as CVE-2026-109618 and CVE-2026-109619. They are nicknamed "PHP2Shell" and rated 9.2 out of 10 for severity. At worst, an attacker could take control of a web server without logging in.

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything older on those branches needs updating. PHP 8.1 and older no longer get official fixes, so sites on them need moving to a supported version.

The UK's National Cyber Security Centre (NCSC) has published an alert urging UK organisations to update. Amazon's security team reported attack attempts from 17 October, before the fix was public. So this is worth sorting this week, not next month.

Is my website affected?

You are probably using PHP if you have any of these:

  • A WordPress website or WooCommerce shop.
  • A website your developer built and you pay a monthly hosting fee for.
  • Hosting with a control panel such as cPanel or Plesk.
  • An online booking, membership or customer portal your web developer set up.

Fully hosted builders such as Wix, Squarespace and Shopify run their own servers. You cannot update PHP there, and it is their job to patch.

How do I check my PHP version?

  • WordPress: log in, go to Tools, then Site Health, then the Info tab. Open the Server section to see the PHP version. WordPress explains this in its Site Health guide.
  • cPanel: look for MultiPHP Manager. It shows the PHP version each domain uses. See cPanel's guide.
  • Not sure? Ask your web host or developer. It is a normal, quick question for them.

One catch. A control panel may say "PHP 8.3" without the last number. The last number is what matters here. 8.3.36 is fixed. 8.3.35 is not. If you cannot see the full number, ask your host.

What should I do today?

1. Ask your host or developer to update PHP

On most small business hosting, the host updates PHP, not you. Ask them to confirm, in writing, that your site now runs a fixed version. The email template below does the work for you.

2. Make sure you have a recent backup

Before anything changes, check you have a recent backup of the website and its database, and know how to restore it. The NCSC has simple advice on backing up your data, and our backup guide covers testing a restore.

3. Update WordPress, plugins and themes

This does not fix the PHP flaw on its own, but it is good practice. In WordPress, go to Dashboard, then Updates. WordPress has a guide to updating WordPress. Delete plugins and themes you no longer use.

4. Check for signs of trouble

Because attacks were seen before the fix came out, it is sensible to look for anything odd since mid October. You do not need to be technical to spot these:

  • New admin users in WordPress that nobody recognises.
  • Pages, links or pop-ups on your site that you did not add.
  • Your host, Google or a customer warning that the site looks hacked.
  • The site suddenly slow, broken or offline.

If you see any of these, ask your host or developer to check the server straight away.

5. Change key passwords and turn on MFA

Change the passwords for your hosting account, website admin and any FTP or database logins. Then turn on MFA (multi-factor authentication) on hosting and WordPress admin. MFA adds a second check, such as a code from a phone app. The NCSC explains how to turn on 2-step verification. See our guide to authenticator apps.

Whatever tool you use, give each login its own password. Our password manager guide compares options.

Who updates PHP: my host or me?

Managed or shared hosting. You pay a host to run the server. They should update PHP for you. Your job is to ask, confirm, and handle the WordPress side.

Self-managed server or VPS. You or your developer run the server. Nobody else will update PHP. Your developer needs to install the fixed version, restart PHP, and check the site still works. PHP's advisory lists temporary measures if an update must wait, but it is clear that only updating fully fixes the problem.

Email template for your host or developer

Copy, paste and fill in the gaps:

Subject: PHP security update (CVE-2026-109618 and CVE-2026-109619)

Hi [name], PHP released security fixes on 21 October 2026 for CVE-2026-109618 and CVE-2026-109619. The NCSC has asked UK organisations to update. Please could you confirm: 1. Which PHP version our website [web address] runs, including the last number. 2. Whether it has been updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or when it will be. 3. Whether we have a recent backup, and when it was taken. 4. Whether you have seen any signs of compromise since 17 October. 5. If we are on PHP 8.1 or older, what you recommend. Thanks, [your name]

When to get help

Get help from your developer or an IT professional if:

  • Your host cannot tell you which PHP version you run.
  • You are on PHP 8.1 or older, or nobody looks after the server.
  • You see any of the warning signs above.
  • Your site stores customer data and you are unsure what was exposed.

If you think you have been hacked, the NCSC lists assured incident response providers. If personal data may have been exposed, you may need to report it to the ICO within 72 hours. This guide is general information, not legal or IT advice.

After this week

  • Plan an upgrade if you are on PHP 8.2. PHP says it stops getting security fixes on 31 December 2026.
  • Ask your host how quickly they apply security updates.
  • Consider Cyber Essentials. It covers keeping software updated. See our beginner's guide.

Not sure where you stand? Try our free exposure checker. Ten yes or no questions. About two minutes.

Copyable PHP update checklist

FAQ

Is my website affected by PHP2Shell?
Probably, if it runs on WordPress, WooCommerce or another PHP system, until your host installs a fixed PHP version. Find the full PHP version, including the last number, and compare it with the fixed versions: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Some hosts add the fix without changing the number, so if in doubt, ask your host to confirm in writing.
Does updating WordPress fix the PHP flaw?
No. PHP is the software underneath WordPress, and it is updated separately, usually by your web host. You should still update WordPress and plugins, but the PHP update is the fix for this flaw.
Do I need to take my website offline?
Most owners do not. The NCSC suggests taking a system offline only if it cannot be updated or protected in time. If your host cannot update PHP soon, ask them what they recommend, and agree it in writing.
My site is on Wix, Squarespace or Shopify. Do I need to do anything?
Not for PHP itself. Those platforms run their own servers, so patching is their job. If you use Shopify apps, you can ask the app makers whether their systems use PHP and have been updated.
Will updating PHP break my website?
It should not. The fixes are small updates within the same PHP version line. Back up first, then click through your key pages, forms and checkout afterwards. Moving from PHP 8.1 or older to a newer version is a bigger change, so ask your developer to test it first.

Sources we checked

Bottom line

If your website runs on PHP, ask your host or developer today to confirm it is on a fixed version. Back up first, update WordPress and plugins, and look for anything odd. Change your hosting and admin passwords and turn on MFA. Most owners can sort this with one email and an hour of checking.

Written for UK SME owners. More guides · How we make money