Updated October 22, 2026. This story is still developing, and I'll revise this post if the guidance changes.
Two critical security flaws were just found in PHP, the programming language that runs roughly 70% of the websites on the internet. The NSA issued a rare public warning. Authorities in Belgium, the Netherlands, Finland and the Czech Republic shut down websites to apply the fix. If your website runs on WordPress, you need to read this today.
The flaws are called PHP2Shell, and the short version is this: on an unpatched server, an attacker doesn't need a login to run their own code on it.
This is the plain-English guide for business owners: what happened, how to find out if you're affected, what to do right now, and why the websites we build at Ridgeway Web aren't.
What Happened
Here's the timeline:
- August 24: Security researchers at Wiz, working with Calif and OpenAI, reported the flaws to the PHP security team. AI models helped find them and turn them into working attacks.
- October 20: A user on the Hacker News forum posted the flaws' identifiers before patches were ready. The post has since been deleted.
- October 21: PHP released emergency security updates and published the details.
Amazon's threat intelligence team has also published findings on PHP2Shell exploitation activity it observed before the public disclosure. The PHP Foundation said it had not identified any functional exploits at the time of release, but it also reported that a proof-of-concept demo video was published by mistake and copies circulated, which helped speed up work on proof-of-concept attacks. That's why "I'll get to it next week" is the wrong plan.
What PHP2Shell Actually Is
PHP2Shell is a pair of vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 for severity (CVSS v4.0). Researchers say that on an unpatched server they can let an attacker:
- Run code remotely, without logging in, which can mean taking control of the server, stealing data or defacing your site
- Read data out of the server's memory, which can include passwords, authentication tokens and API keys
The key detail: these flaws are in PHP itself, not in WordPress or any plugin. Wiz demonstrated working attacks against stock installs of WordPress, Drupal and Joomla (their latest official container images), and noted that even a bare-bones "Hello World" page on an affected PHP version can be vulnerable. Nearly every PHP version released in the last decade is affected, going back to 5.4.
The flaws sat in PHP for more than a decade. What changed is that AI made it practical to chain them into a working exploit. Complexity used to protect software from attackers. It protects a lot less now, and that's the real story behind this headline.
Why This One Is Different for Business Owners
Most website security advice is "update your plugins and use strong passwords." That advice doesn't solve this.
You can do everything right, with a fully updated WordPress, a hardened login and a great security plugin, and still be exposed, because the problem sits in the server software underneath your site. Updating your plugins, theme or WordPress itself does not fix it. The PHP update does, and in most cases that update has to be applied by your hosting provider.
Is My Website Affected?
Your site is potentially affected if it runs on PHP. That includes:
- WordPress (including WooCommerce stores)
- Drupal and Joomla
- Any custom-built PHP site
Here's how to find out:
1. Find out whether your site uses PHP
Free tools like BuiltWith and Wappalyzer can show what platform a site runs on. They're a good first look, but not proof either way, because sites can hide the signals they rely on. If you log in to WordPress, you can also check Tools → Site Health → Info → Server to see your PHP version.
2. Ask your host directly
Send your hosting provider this: "Has my account been updated to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or newer)? If not, when will it be?" Get the answer in writing.
3. Check for older versions
The emergency patch covered PHP 8.2 through 8.5. If your site runs on something older, ask your host about upgrading, because an old version isn't a safe place to wait this out.
What to Do Right Now
- Call your host today. Don't wait for an email notice.
- Don't stop at plugin updates. They won't close this hole.
- Know that temporary protections aren't a cure. Some security and CDN providers rolled out firewall rules for customers who can't patch immediately, but the PHP maintainers say updating is the only complete fix.
- Back up before upgrading PHP. Older plugins and themes can break on newer PHP versions, so take a backup first and test your site afterward.
- Consider rotating secrets. Because one of the flaws can expose server memory, it's a reasonable precaution to change passwords and API keys stored on the server once you're patched. Ask your developer or host to help.
Why Ridgeway Web Sites Aren't Affected
If you're a Ridgeway Web client, there is nothing for you to do. Your website is not affected.
The sites we build are hand-coded and static. Every page is built ahead of time and served as plain files. There's no PHP running on the server, no database to break into and no admin login for a bot to hammer. PHP2Shell is a flaw in PHP, and a site that doesn't run PHP gives it nothing to attack.
That's the practical reason we don't build with WordPress or page builders:
- Fewer moving parts. A typical WordPress site is PHP, plus a database, plus a theme, plus a stack of plugins. Each piece is a door that has to stay locked, and every update is a job someone has to do on time.
- Layers you can't see or control. Page builders add heavy code between you and your own website, which is hard to audit and impossible to fix yourself.
- Speed and rankings. Lean, hand-coded pages load faster, and faster sites tend to rank better. I wrote more about this in Why Hand-Coded Websites Beat Page Builders Every Time.
To be fair, WordPress isn't "bad," and a well-maintained WordPress site can be run safely. But maintenance never ends, and this week showed what happens when a critical fix lands on your host's desk instead of yours. A static site isn't invincible, because no website is. It simply has a far smaller attack surface, and this particular flaw has nothing to grab.
Quick Questions
Should I take my website offline?
The NSA advised that sites that can't be updated right away should be taken offline. For most small businesses, the practical answer is a same-day call to your host. If they can't give you a straight answer, taking the site down until they do is worth considering.
Is WordPress unsafe now?
Not inherently. But WordPress depends on PHP, so a flaw in PHP reaches every WordPress site on an unpatched server. Patched and maintained, it's fine. Unpatched, it's exposed.
The Bottom Line
PHP2Shell is a reminder that the technology under your website matters as much as the website itself. The more moving parts a site has, the more there is to patch, and the faster attackers can now find and use the weak points.
If you're not sure what your website runs on, or whether this applies to you, get in touch and I'll look at your site and tell you straight. If you'd rather have a site with no PHP to patch in the first place, that's exactly what we build at Ridgeway Web in Birmingham, AL.
Get a free quote or call (334) 750-3608.
Sources
- PHP2Shell: AI uncovers critical RCE vulnerabilities (Wiz Research)
- World leaders warn of security flaws found in PHP (Al Jazeera)
- Critical PHP Vulnerabilities Leaked Ahead of Scheduled Security Patches (Infosecurity Magazine)
- PHP warns admins of two critical flaws (BleepingComputer)
- PHP2Shell (Wikipedia)
