PHP2Shell: is your website affected, and what should you do?

On 21 October 2026 the team behind PHP released an urgent fix for two serious security flaws, nicknamed "PHP2Shell". If your website runs on WordPress, or a developer built it on a standard web hosting package, it's probably affected.

PHP is the programming language behind most of the world's websites, including every WordPress site and Wikipedia. It runs on the server that hosts your website and builds each page when someone visits.

The two flaws are in PHP itself. They let an attacker run their own commands on the server hosting your website, without needing a password. In plain terms, someone could take over the site, plant harmful code on it or steal information stored on it.

Details leaked online the day before the fix came out, and attackers moved fast. Cloudflare's chief executive said attempts to exploit the flaws ran into the millions within hours of the announcement, and researchers expect more now the technical details are public.

Organisations have taken websites offline while they check, including Wikimedia (briefly taking parts of Wikipedia with it), the Finnish government and several Scottish councils and health boards. The UK's National Cyber Security Centre (NCSC) has told organisations to update straight away, and to consider taking sites offline if they can't.

Experts quoted by the BBC warn that poorly maintained websites, especially those run by smaller organisations with limited security resources, face the greatest risk. A site built a few years ago, on a hosting package nobody has reviewed since, is exactly what attackers scan for. If nobody is responsible for your website any more, treat this as urgent.

On a managed hosting plan: most hosts are patching their servers for you, but don't assume: check with your host.

On your own server or a VPS: the update is your job, or your developer's. Back up the site, update PHP to a fixed version, then restart PHP and the web server so the fix takes effect.

On PHP 8.1 or older: these versions no longer get official updates. Some hosts have applied an unofficial fix, so ask yours. The US security agency CISA says anything that can't be patched should go offline until it can be. Either way, plan a move to PHP 8.3 or newer soon (8.2 support ends on 31 December 2026). Old plugins sometimes break on a newer PHP, so test on a copy of the site first.

Don't rely on WordPress or plugin updates. They're good practice, but only updating PHP on the server fixes this. Security plugins and website firewalls can block some attacks in the meantime, but they aren't a fix.

Check your backup. Make sure you have a recent copy of your website stored somewhere other than the server itself.

Look for signs of a break-in. If your site went unpatched for a few days after 21 October, watch for admin users you don't recognise, pages redirecting to strange websites, a browser warning when you visit, or a message from your host about unusual activity. The NCSC also advises checking for backdoors an attacker may have left behind. As a precaution, change your website admin passwords and any keys stored on the site, such as payment or email connections.

Watch out for scam emails. Scammers use big news stories like this one. Be wary of any email asking you to log in to "fix" your website, and go to your host's site directly instead of clicking the link.

The flaws had gone unnoticed in PHP for more than ten years. Researchers at the security firms Wiz and Calif found them using AI tools, including models from Google and OpenAI, that can read code and spot weaknesses far faster than people can. As one researcher told the BBC, "what changed was our ability to find them".

That works both ways. OpenAI, whose technology was used in the research, has warned that the same tools can help attackers build working attacks quickly. Expect more flaws like this to come to light, and to be exploited faster.

For businesses planning how to use AI, this is part of the picture. The same technology that saves your team time is speeding up attackers too, so the basics need to be in place: a patched website, a recent backup and someone responsible for keeping both up to date.

If you're not sure how your site is hosted, can't find the PHP version, or your host hasn't given you a straight answer, call SpiderGroup on 0117 933 0570 or contact us online. We'll check your website and tell you whether you need to do anything.