The PHP2Shell Problem: Why Our Clients Don't Have to Worry

If you've seen the news this past week, you may have heard about a serious security problem with PHP, the programming language behind roughly 70% of the world's websites. Governments and big companies have been scrambling to patch their sites, and some agencies even told organizations to take sites offline until they were fixed. It's natural to wonder whether your own website is at risk.

The short answer for our clients: you don't have to worry. Here's what happened, and why your website is protected.

What Is the PHP2Shell Problem?

On October 21, 2026, the PHP project released emergency updates for two critical vulnerabilities, known together as "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619). Both could let an attacker run their own code on a web server without logging in, which can mean taking over the website completely.

Security researchers called these flaws some of the most severe ever found in PHP. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged everyone running PHP to patch immediately, and reports of attackers exploiting the flaws in the wild followed within days. Sites running older, unsupported versions of PHP (8.1 and earlier) are in the toughest spot, because those versions don't get official fixes at all.

What About WordPress Sites?

We also keep our clients' WordPress sites backed up and maintained, so we're in a good position to respond quickly if anything else comes up.

One Thing Worth Checking

Some websites use outside tools, such as booking calendars, job boards, review widgets or custom forms, that run on someone else's servers. Those services may use PHP even when your website platform doesn't. If you rely on an outside tool that we didn't set up, it's worth asking that provider whether they've applied the PHP security updates. If you're not sure what's connected to your site, just ask us and we'll take a look.

The Bottom Line