The PHP security flaw: is your website affected?
Two serious flaws in PHP, the software that runs about 70% of websites, were patched on October 21, 2026. Here is what happened, how to find out whether your site is affected, and what to do about it.
Last updated October 22, 2026. We'll update this page as the facts change.
What happened
PHP is a programming language that many websites use behind the scenes, for things like logging in, forms and payments. On October 21, 2026, the PHP project released emergency fixes for two flaws, nicknamed "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619). Both are rated 9.2 out of 10 for severity.
On a server that hasn't been updated, an attacker could potentially take control of it without needing a password. That could mean installing malicious software or reaching customer data. The US cyber agency CISA urged organisations to patch immediately.
OpenAI, Wiz and Calif say AI models were used to find the flaws, which is part of why this has made so many headlines.
Where things stand. Fixes are available. As we write this, reports differ about whether anyone has tried to use the flaws against real websites. We don't know either, and you shouldn't have to guess: if your site runs on PHP, updating is the sensible thing to do whatever turns out to be true.
Is my website affected?
Only websites that run PHP are affected. Your site probably does if it is built on:
- WordPress (about 43% of all websites, and all of it runs on PHP),
- Joomla, Drupal, Magento or WooCommerce, or
- a custom site your developer wrote in PHP.
Sites on hosted builders such as Wix, Squarespace or Shopify run on those companies' own platforms rather than on a PHP server you manage, so any fixes are theirs to make. Plain HTML sites don't use PHP at all.
Three ways to find out
1. Our free check. Enter your web address and we'll tell you if the public page shows signs of WordPress or PHP. It only reads what any visitor can see. Run the free check.
2. Ask whoever hosts or built your site. A good host will answer this in one line (see the question below).
3. If you use WordPress, log in and go to Tools, then Site Health, then Info, then Server. The "PHP version" is listed there.
What to do
- Find your PHP version using one of the methods above.
- Compare it with the fixed versions: 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or anything newer. If you're on one of those or higher, you're covered for these flaws.
- If you're on an older release, ask your host to update PHP. Many hosts let you pick the PHP version in the control panel. Versions older than 8.2 no longer get official fixes, so they need moving to a supported release, or a fix from your host.
- Back up first, and test after. An update can occasionally break an old plugin or theme, so take a backup beforehand and click through your site afterwards.
- Keep the rest tidy. Update WordPress, themes and plugins, and delete any you don't use. Most real-world website break-ins come through neglected add-ons.
A question you can copy and send to your host
"Has the server hosting my website been updated to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or newer) to cover CVE-2026-109618 and CVE-2026-109619? If not, when will it be, and what PHP version am I on now?"
When it's more than a patch
If your website is old, hard to update, or built on something that needs constant patching, this is a good moment to ask whether it needs to stay that way. Some sites don't need PHP at all. The websites we build are plain, fast pages that don't run PHP, so there is nothing of this kind to patch. They aren't right for every site (a large shop, say), and you don't have to rebuild anything to deal with this news. We'll tell you honestly which case yours is.
A fair warning about us: we're a web studio, not a security firm. We can tell you what your site is built on and what to ask, but we can't audit your server. If you think your site has already been compromised, contact your host and a security professional straight away.
Not sure what to do next? Ask for a free quote and we'll reply with a plain answer.