A serious PHP vulnerability is in the news this week, and if your business has a WordPress website, there’s a good chance you need to do something about it. Here’s what’s happened, what it means for you, and exactly what to do next, in plain English.
What is PHP, and why should you care?
PHP is the behind-the-scenes programming language that powers a huge share of the world’s websites, including every WordPress site. You never see it, but if your website is built on WordPress, it runs on PHP.
What’s happened
On 21 October 2026, the people who maintain PHP released emergency fixes for two critical security flaws, nicknamed PHP2Shell. Both scored 9.2 out of 10 on the standard scale used to rate how dangerous a flaw is. That’s about as serious as it gets.
In simple terms, these flaws can let an attacker run their own code on the server that hosts your website. Details leaked before the fix was ready, and Cloudflare, one of the biggest web security companies in the world, has reported that attackers have already started trying to exploit them.
It’s serious enough that the UK’s National Cyber Security Centre advises that if you can’t update PHP, or put the temporary protections in place, you should consider taking the system offline until you can. Some well-known websites across the UK did exactly that as a precaution.
Is my WordPress website affected by the PHP vulnerability?
The flaws affect almost every version of PHP in use today, going back years. So unless your website has been updated in the 24 hours, the safe assumption is yes.
The versions that fix it are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If your site is running anything below those, it’s exposed.
Note: Logging into your WP Admin portal and updating plugins/themes will not fix this. PHP updates occur at the server level and updates are managed seperately.
There’s also a catch. If your site runs PHP 8.1 or older, there’s no fix for your version at all. Those versions are no longer supported, so the only real answer is to upgrade.
What could actually happen?
This isn’t just a technical problem for someone else. If your site is compromised, it could be quietly used to attack other people’s websites and systems. It could send your customers to a scam site instead of yours. And it could expose the information people have trusted you with through your forms.
Any of those can damage the trust you’ve worked hard to build, and the business owner is often the last to find out.
What should you do right now?
The good news is that this is fixable, and for most people it’s quick.
If you can log in to WordPress, go to your dashboard, then Tools, then Site Health. Click the Info tab, and look at the PHP version. If it shows one of the fixed versions above, or newer, you’re in good shape. If it’s lower, contact your hosting provider today and ask them to update it. Many hosts are already rolling the fix out, but don’t assume. Check.
If you can’t log in, or you’re not sure, contact whoever built or looks after your website, or your hosting company, and ask them one simple question: is my site running a patched version of PHP for the PHP2Shell vulnerability? A good developer or host will be able to answer straight away and confirm it in writing.
If you can’t get a clear answer quickly and the site isn’t patched, take the NCSC’s advice seriously. A website that’s offline for a day does far less damage than one that’s been hijacked.
Not sure where to turn?
If you don’t know who looks after your website, or you’re not getting a straight answer, get in contact and we can help.
We’ll check what your site is running, tell you whether you’re at risk (no cost), and help get it fixed.
You don’t need to understand PHP to keep your website safe. You just need to make sure someone has checked.