On Wednesday 21 October 2026, the PHP project released urgent fixes for two critical security flaws in PHP, the programming language behind a large share of the world's websites, including WordPress and Drupal. By the next morning, government agencies, airlines, banks and news sites around the world had taken pages offline while they patched.
If you run a small business website, there's a good chance it runs on PHP too. Here's what happened, in plain English, and what to do about it.
What happened
Security researchers found two flaws in the core of PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell. Both are rated 9.2 out of 10 for severity. According to SiteGround's security update, both can allow unauthenticated remote code execution: an attacker can run their own code on a web server without needing a password.
Palo Alto Networks' Unit 42 explains that both bugs come from the way PHP handles memory when it runs into fatal errors, such as running out of memory. Under the right conditions, an attacker can make the server read or jump to memory it shouldn't, and take control from there.
The flaws were found in late August by teams including OpenAI and the security firm Wiz, with heavy use of AI tools. Reporting by ABC7 quotes Wiz describing it as an "AI inflection point": the bugs had existed for years, but AI made them practical to find and exploit.
Who was affected
PHP is everywhere. The same ABC7 report notes that PHP powers about 70% of websites. When the fixes were published:
- several government websites in France, Denmark, Finland and the Netherlands were taken offline while they were patched
- Japanese airline ANA, railway operator JR West and bank MUFG suspended some web services
- Wikimedia took some systems down as a precaution
- Unit 42 reported more than 22.6 million internet-facing instances that were potentially vulnerable
The US cybersecurity agency CISA issued an alert the same day urging immediate patching.
Is it being exploited?
Yes. Unit 42 reported proof-of-concept code circulating, and described attackers using AI agents after breaking into a European government system. Within two hours of getting in, the attackers had collected password hashes and were trying to take over the wider network.
That speed is the real lesson. The gap between a flaw being announced and attackers using it is now measured in hours, not weeks.
What to check today
If your website runs on WordPress, Drupal, Joomla or any other PHP platform, work through this list or ask whoever manages your site:
- Confirm your PHP version. The patched versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything older on those branches needs updating.
- Ask your host what they've done. Many managed hosts acted quickly. SiteGround, for example, says it deployed server-level protections on 20 October and applied the official fixes across its servers on 21 October, so its customers didn't need to do anything.
- Check for unsupported PHP versions. Sites still running old PHP releases, such as PHP 7.x, rely entirely on their host's protections.
- Update everything else while you're there. WordPress core, themes and plugins are the other common way in.
- Change passwords for your hosting, website admin and email if you have any doubt, and turn on two-factor authentication.
- Look for warning signs: new admin users you don't recognise, unexpected redirects, spam pages appearing in Google, or a sudden drop in traffic.
If you're not sure who looks after your site, that's worth fixing on its own.
Why we stopped building on PHP
We moved every new EZM website to a static build. A static site is a set of ready-made HTML, CSS and JavaScript files. There's no PHP and no database running on the server for each visit, so a flaw like PHP2Shell has nothing to attack on the site itself.
| Typical WordPress site | Static site | |
|---|---|---|
| Runs PHP on every visit | Yes | No |
| Plugins to update | Often 10 to 30 | None |
| Database to protect | Yes | No |
| Speed | Depends on hosting and plugins | Very fast, served from a global network |
| Ongoing patching | Constant | Minimal |
Forms still work. We send enquiries through a small, isolated Cloudflare function with spam protection, which emails you and doesn't store anything.
Static isn't right for every website. Large online shops and membership sites often need a server. But for most service businesses, like brokers, accountants, lawyers, agents and tradies, a static site does everything they need with far less risk. We explain the trade-offs in static websites vs WordPress.
The bottom line
PHP2Shell was fixed quickly, and most well-run hosts protected their customers within a day. The bigger change is how fast attacks now move. If your website depends on software that needs constant patching, someone needs to be watching it.
If you'd like us to check your site, we offer a free website health check that covers outdated software, HTTPS and the basics that keep you safe.
This article is general information only and isn't legal, financial or technical advice for your situation. Questions? Talk to us.