--- title: "PHP2Shell: Is My Website Affected? What to Do Today" description: "PHP2Shell is a critical flaw in PHP, behind millions of sites including WordPress. How to tell if yours is affected and exactly what to ask your host today." url: https://wonderworksdesign.net/worth-knowing/php2shell-is-my-website-affected language: en bulgarian: https://wonderworksdesign.net/bg/worth-knowing/php2shell-zasegnat-li-e-saitat-mi updated: 2026-10-22 publisher: Wonder Works (Wonder Works Design Ltd), Blagoevgrad, Bulgaria --- [Worth Knowing](https://wonderworksdesign.net/worth-knowing) Live: updated every day # PHP2Shell: Is Your Business Website Affected, and What to Do Today By [Colin Rooney](https://wonderworksdesign.net/authors/colin-rooney) · Published 22 October 2026 · Updated 22 October 2026, 18:00 · 11 min read **A serious security flaw in PHP, the software behind most of the web, went public this week, and attackers are already trying it. If your website runs on PHP, and every WordPress site does, it is exposed until your hosting company installs the fix.** If you've seen the headlines and wondered whether your own website is in trouble, this page is for you. I'll keep it in plain words, answer the questions I'd be asking if it were my business, and tell you exactly what to do today, whether or not you've ever heard of PHP before. In this piece 1. Which one are you? 2. What happened this week? 3. How big is this? 4. Is my website in danger right now? 5. What exactly should I ask my host or developer today? 6. Will updating break my site? 7. Has my site already been hacked? 8. Should I take my site offline? 9. Free tools to check your site 10. Want to know more? 11. Sources ## Which one are you? Tap the one that sounds like you. The answer opens right there. ### My site is on WordPress WordPress runs on PHP, so the honest answer is yes, you're affected unless your host has already updated it. The researchers who found these flaws showed attacks on WordPress, Drupal and Joomla that worked without logging in, so this isn't a theoretical risk. The flaws live in PHP itself, below WordPress, its plugins and its login screen, so the update button in your WordPress dashboard won't help you here, and neither will a security plugin. The fix has to come from your hosting company, which is why the questions to send your host are the most useful thing you can do today. ### I don't know what my site is built on The simplest way is to ask whoever built it for you. If that's not possible, type your website address followed by /wp-admin into your browser. If a WordPress login page appears, your site is on WordPress. Free tools like BuiltWith or Wappalyzer will also tell you what a site is built on in a few seconds; the links are further down this page. Other common systems that run on PHP include Joomla, Drupal and OpenCart, a common platform for online shops, and if you log into your hosting account, the control panel usually shows which PHP version your site runs. ### My site is old and nobody looks after it This is the situation that worries me most, because older sites are the most exposed. According to WordPress.org's own statistics, about a third of WordPress sites run a PHP version the PHP project no longer supports, and more than one in six are still on PHP 7.4. The official fixes only cover PHP 8.2, 8.3, 8.4 and 8.5. For 7.4, 8.0 and 8.1 there are only code fixes that hosting companies have to build in themselves, so on an older version you're relying on your host to have done that. Some have, and some haven't said. If nobody has touched your site in a few years, don't assume someone else is handling it. Contact your host today. ### I don't know who hosts my site Your host is the company you pay every year to keep the website online, which is usually a separate bill from your domain name. Look through your emails and invoices for a hosting renewal, because that's who you need to contact. If you genuinely can't find it, the company that manages your domain name can usually point you in the right direction. ### I have an online shop with customer details Then this is the question that matters most. The NSA says a successful attacker could steal sensitive data, disrupt services or move deeper into a network, and for your customers that means account details, order history and saved addresses. If your shop sends customers to a bank or payment company's page to enter their card, the card numbers usually aren't stored on your site, but names, addresses, phone numbers and order histories often are. Online shops on PHP should be first in the queue to get confirmation from their host. ### My site is on Wix, Shopify or Squarespace Squarespace and Wix don't run their customers' sites on PHP, so there's nothing for you to update. Shopify hasn't made a public statement, but its own platform and storefronts aren't built on PHP, so the shop itself isn't the worry. What to watch is anything bolted on the side. If your shop is on Shopify but you also have a WordPress blog on its own hosting, or a custom add-on, the shop is fine but anything alongside it that's hosted separately might not be. ## What happened this week? On Tuesday, details of two serious security flaws in PHP leaked online before they were meant to be made public, and the PHP Foundation pushed the fixes out a day early, on Wednesday 21 October. The flaws let an attacker run their own code on the server a website lives on without logging in, which in plain words means a stranger could take control of the computer your website sits on without needing any password. They're rated 9.2 out of 10 for severity, and the name everyone is using for them is PHP2Shell. It's being treated as one of the biggest website security stories in years. The US National Security Agency told organisations to either install the fixes immediately or take their servers offline, and in the Netherlands government services including DigiD and the parliament's website went offline while they dealt with it. ## How big is this? - **7 in 10** websites whose technology can be identified run on PHP (W3Techs, August 2026) - **2.24M** servers running PHP on the open internet, counted by researchers this week (CybelAngel, October 2026) - **41%** of all websites run on WordPress, which needs PHP (W3Techs, August 2026) Many of those servers each carry lots of websites, so the number of sites affected runs into the millions. ## Is my website in danger right now? If your website runs on PHP and the company that hosts it hasn't installed the fix yet, then yes, it's exposed. If it doesn't run on PHP, this flaw doesn't touch it. The good news is that this is fixable, and for most businesses the fix is something your hosting company does for you, often without you clicking anything at all. Your job today is simply to find out which of those two situations you're in. ## What exactly should I ask my host or developer today? Copy these and send them exactly as they are, and ask for the answers in writing. 1. Which version of PHP does my website run on? 2. Has the fix for PHP2Shell (CVE-2026-109618 and CVE-2026-109619) been installed on the server my site uses, and on what date? 3. If my site runs on PHP 8.1 or older, has a fix been applied to that version too? 4. Have you seen any sign of an attack on my site in the last few days? 5. Do you keep backups of my site, and how far back do they go? Copy them all A clear reply with dates is what you're looking for. A vague "we're looking into it" is a reason to follow up again tomorrow. ## Will updating break my site? It can, and that's the honest reason so many websites sit on old versions for years. If your host simply installs the fix on the version you already run, nothing on your site changes. If your site is on a version so old that the only real fix is moving it to a newer PHP, older themes and plugins sometimes stop working properly after the move. That's not a reason to avoid it, but it is a reason to make sure there's a fresh backup before anything changes, and to have someone check the site afterwards. ## Has my site already been hacked? Attacks have started: security firms recorded attempts on both flaws on the day the fixes came out. At the same time, nobody has yet published a reliable count of websites actually broken into, so there's no reason to panic, but there's every reason to look. Tick off each one once you've checked it. **0** of 6 checked on your site 1. ### Visitors get sent to strange websites If customers tell you your site took them somewhere odd, or a link you didn't add sends them away, take it seriously. 2. ### Pages or links appear that you never created Search Google for site: followed by your address, for example site:yourbusiness.bg, and look for pages you don't recognise, often in another language. 3. ### New admin users you don't recognise Look at the list of users in your site's admin area. Anyone you can't name shouldn't be there. 4. ### Google warns that your site may be hacked It shows under your site's name in the search results, or as a red warning page in Chrome. 5. ### An email from your host saying your site is suspended Hosts often switch off a site they think has been broken into. Check your spam folder too. 6. ### Your site suddenly becomes very slow On its own it can mean many things, but alongside any of the signs above it's a warning. If you see any of these, tell your host straight away, and don't log into your site from the computer you use for online banking until it's sorted. ## Should I take my site offline? For most businesses, no, as long as your host confirms in writing that the fix is installed. If you can't get that confirmation, your site runs on an old version of PHP and it holds customer information, then putting it into maintenance mode for a day or two while you sort it out is a sensible, cautious step. It's the same thinking behind those government websites going offline: better a short pause than a break-in. ## Free tools to check your site - ### PHP2Shell check by Aikido A free check from a Belgian security company. No signup. In English. How to use this Type your full website address into the box and tick the box that says you own the website or have permission to test it. **Leave the second box, the one about crash probes, unticked**, because that deeper test can briefly knock your site over. Then press "Check my website" and wait a minute or two. If the result shows a problem, send the questions above to your host straight away. If it comes back clean, that's a good sign, but it isn't proof your site is safe, so still ask your host to confirm the fix in writing. [Open the check](https://php2shell.aikido.io/) - ### Which hosts have installed the fix A running list of what hosting companies have said. In English. How to use this Look for your hosting company's name in the table. Next to each one it says whether the fix is in and when. It covers big international hosts like GoDaddy, Hostinger and OVHcloud, but not the Bulgarian ones. At the time of writing we couldn't find a public statement from the big Bulgarian hosts, so if your site is with one of them, ask them directly with the questions above. [Open the list](https://www.activeset.co/blog/php2shell-host-status) - ### BuiltWith Shows what any website is built on. Free. In English. How to use this Type your website address into the search box and press the button. After a few seconds you'll see a list of everything the site uses. If WordPress, Joomla, Drupal, OpenCart or PHP is on the list, your site runs on PHP. [Open BuiltWith](https://builtwith.com/) - ### Wappalyzer The same idea, and it can sit in your browser. Free. In English. How to use this Look up your address on their site, or add it to Chrome or Firefox and it shows what any website you open is built on, with one click on its icon. [Open Wappalyzer](https://www.wappalyzer.com/) - ### PHP's own announcement The source itself, for anyone who wants it. Technical, in English. How to use this It's written for programmers. If you're not one, the questions for your host above will do far more for you. [Open the announcement](https://www.php.net/archive/2026.php#2026-10-21-5) ## Want to know more? ### What is PHP, in plain words? PHP is the software that builds a webpage at the moment someone visits it. When you open a page on a PHP website, the server runs PHP, pulls the words and pictures out of a database, puts the page together and sends it to you, and it does that fresh for every visitor. It's been around since the 1990s and runs an enormous part of the internet, because it's free, it's everywhere, and every cheap hosting plan supports it. That popularity is exactly why a flaw in PHP is such a big deal. ### Why is everyone calling PHP2Shell so serious? Three reasons. First, it's in PHP itself, so it affects every website running on it rather than one plugin or one system. Second, an attacker doesn't need a password. Third, these flaws were hiding in PHP for over a decade, and the researchers at Wiz who found them say the newest AI models made it far easier to turn them into working attacks. That last point is the one I'd pay attention to as a business owner, because it means the time between a flaw being found and attackers using it is getting much shorter. A website that nobody checks on is a bigger risk in 2026 than it was even two years ago. ### Why do WordPress sites keep coming up in security stories? Mostly because there are so many of them. W3Techs puts WordPress on about four in ten of all websites, so anything that affects WordPress affects a huge slice of the internet at once, and attackers go where the numbers are. Most WordPress security problems don't come from WordPress's own core software. The real danger is in the plugins, the themes and the server software underneath, and the biggest risk of all is a site that was built, handed over and never looked at again, with old plugins, an old theme and an old version of PHP underneath. PHP2Shell is the same story at a bigger scale. ### Is it safe to keep using WordPress? A WordPress site that's kept up to date by someone who knows what they're doing, on a good host, is a very different thing from one that hasn't been touched in years. If you're happy with your WordPress site, the answer is to make sure someone is genuinely looking after it, not to panic and rebuild tomorrow. Where I'd be more direct is with sites nobody looks after. If your website is a set-and-forget job, this week is a good reminder that a website is never really finished. It's a live part of your business, and it needs someone keeping an eye on it all the time. We've written more about [what businesses learn later with WordPress](https://wonderworksdesign.net/worth-knowing/thinking-of-a-wordpress-website-what-businesses-learn-later). ### How are websites built without PHP different? There's another way to build a website, and it's how we build ours and our clients'. Instead of putting each page together fresh on the server every time someone visits, the pages are built in advance as finished files and served from a fast global network. Nothing runs on a server when a visitor arrives, so a flaw like PHP2Shell has nothing to attack. It doesn't make a site invulnerable, because logins, hosting accounts and the companies behind them all still need looking after, but it removes a whole category of risk, and sites built this way tend to load faster too, which both visitors and Google like. [How we build websites](https://wonderworksdesign.net/services/web-design). ## Sources - [PHP security announcement, 21 October 2026](https://www.php.net/archive/2026.php#2026-10-21-5) - [Wiz Research: PHP2Shell](https://www.wiz.io/blog/php2shell-php-rce) - [Help Net Security: PHP2Shell patched, 21 October 2026](https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/) - [SecurityWeek: patches land as first exploitation attempts hit sensors](https://www.securityweek.com/php2shell-patches-land-as-first-exploitation-attempts-hit-sensors/) - [The Hacker News: emergency patches, with the Dutch government sites taken offline](https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html) - [CNBC: why governments pulled websites offline, and the NSA's warning](https://www.cnbc.com/2026/10/22/php2shell-vulnerability-what-is-it-and-is-your-data-at-risk.html) - [NBC News: critical vulnerabilities in PHP spark rush to update](https://www.nbcnews.com/tech/security/critical-vulnerabilities-php-update-systems-rcna604751) - [CybelAngel: 2.24 million internet-facing PHP hosts, and the WordPress.org PHP figures](https://cybelangel.com/blog/critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619/) - [The Repository: hosts across the WordPress world race to patch](https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers) - [Recorded Future: what is known about exploitation](https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation) - [W3Techs: PHP usage](https://w3techs.com/technologies/details/pl-php) and [WordPress usage](https://w3techs.com/technologies/details/cm-wordpress) - [BreezyScroll, reporting The Verge on Squarespace and Wix](https://www.breezyscroll.com/technology-news/php2shell-php-flaw-explained-who-fixes-it) - [Avada: Shopify and PHP2Shell](https://avada.io/blog/php2shell-php-vulnerability/) [Back to: Worth Knowing](https://wonderworksdesign.net/worth-knowing)