22 October 2026 · By Chris Kirby

PHP2Shell: is your small business website affected?

If you run a website for your business, you may have seen headlines this week about something called "PHP2Shell". The UK's National Cyber Security Centre has asked organisations to act on it straight away, so it's worth five minutes of your time to understand whether it affects you.

The good news is that a fix is already available, and for most small businesses the job is a short conversation with your web host or web developer. Here's what you need to know, in plain English.

What is PHP, and what happened?

PHP is a programming language that runs on a lot of web servers. It's the engine behind WordPress, Joomla and Drupal, and behind many contact forms, booking pages and online shops. The NCSC describes it as a widely used language that runs on the web server to build pages, talk to databases and handle the behind-the-scenes logic before anything reaches your visitor's browser (NCSC).

On 21 October 2026, the PHP project released updates fixing two critical security flaws, known as CVE-2026-109618 and CVE-2026-109619 and nicknamed "PHP2Shell". Both are rated 9.2 out of 10 for severity. Under the right conditions, either one could let an attacker run their own commands on a web server, without needing a password or any login (PHP; PHP Foundation).

In simple terms, both flaws are about PHP getting its memory in a muddle when a web request goes wrong. One happens when a request hits PHP's memory limit at exactly the wrong moment. The other happens when leftover data from an earlier request gets reused by a later one (PHP; BleepingComputer).

Is anyone actually being attacked?

The picture is still developing, and the sources don't all say the same thing yet. The US cyber agency CISA said on 21 October that it had not seen the flaws being used in attacks at the time it published (CISA). BleepingComputer reported that Cloudflare's chief technology officer said the company was already seeing early attacks before the fix was released (BleepingComputer). The EU's cyber security team, CERT-EU, said early "proof of concept" attack code had begun to circulate, which makes real attacks more likely (CERT-EU).

You don't need to panic about any of that. You just need to make sure your site is running a fixed version.

Which websites are likely to be affected?

According to the PHP project, every PHP installation that serves web pages is at risk, whichever way it's set up (PHP). The NCSC goes further and says organisations using any version of PHP are affected (NCSC). For a small business, that usually means:

WordPress sites. WordPress runs on PHP, so if your website is WordPress, your server is running PHP. The same goes for Joomla and Drupal.
Shared hosting and cPanel accounts. Most traditional "web hosting" packages, including those managed through cPanel or Plesk, run PHP for you.
Websites with a PHP contact form or booking page. Even a simple site can have a small PHP script handling its contact form.
Older sites nobody has touched in a while. If your site was built some years ago and nobody looks after it now, it's more likely to be on an old version of PHP.

Websites that are usually not affected are "static" sites, where the pages are built in advance and served as plain files. Sites hosted on services such as Netlify, Vercel, GitHub Pages or Cloudflare Pages generally work this way and don't run PHP to serve their pages. Many website builders that host everything for you also don't give you a PHP server to look after, and the provider handles their own systems. If you're not sure which type you have, ask whoever built or hosts your site.

Which versions are fixed?

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (PHP). Anything older on those lines needs updating.

PHP 8.1 and older no longer get updates from the PHP project at all. Some hosts and Linux providers have their own fixed versions, but the safest answer is to move to a supported version (PHP). It's also worth knowing that PHP 8.2 stops getting security fixes after 31 December 2026, so if you're on 8.2, it's a good moment to plan the next upgrade too.

A simple checklist

Ask your web host or developer which version of PHP your site is running. Many hosting control panels show this under something like "PHP version" or "MultiPHP". If you're not sure, a short email to your host's support team is enough: "Which PHP version is my site on, and has it been updated for CVE-2026-109618 and CVE-2026-109619?"
Make sure it's moved to a fixed version. That's 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a fixed version from your host if you're on something older. Many hosts will update their servers for you, but it's worth getting it confirmed in writing.
Update WordPress, your theme and your plugins. This won't fix PHP itself, but moving to a newer PHP version can upset old plugins, and keeping everything up to date makes the change smoother. It's good practice anyway.
Check your backups exist, and that you can restore them. Before any upgrade, make sure there's a recent backup of your site and its database, and that you, or your host, know how to put it back.
If your site can't be updated quickly, talk to your host about taking it offline for now. That's what the NCSC suggests where updating, or applying the PHP project's temporary workarounds, isn't possible quickly. It also suggests checking the server for signs of a break-in in that case (NCSC).

The PHP project has published some temporary settings changes for server administrators, but it is clear that only the update fully fixes the problem (PHP).

Can Tidy Cyber tell me if I'm patched?

Partly, and we'd rather be honest about the limits. Tidy Cyber's check is passive: it looks at your website from the outside, the same way any visitor would, and doesn't try to attack or test your server.

Some websites show their PHP version in the information they send with each page. If yours does and it's older than the fixed version, our free check flags it as a high risk and tells you what to ask your host. Most websites hide this, and in that case we say nothing about PHP, because we simply can't see it. Either way, our check can't prove your site is patched: some hosts and Linux providers fix PHP without changing the version number. The only reliable answer comes from your host or developer.

Where do you stand?

PHP2Shell is a good reminder that a website isn't a "build it once and forget it" job. Someone needs to keep the software underneath it up to date, and it helps to know who that someone is before the next headline.

While you're waiting to hear back from your host, Tidy Cyber's free check gives you a tidiness score out of 100 and your top three things to fix, covering your website security, certificate, email spoofing protection and domain basics. If you want every finding with step-by-step fixes, the full report is £29, or Monitoring is £19 a month with weekly checks and a quiet alert if something new goes wrong. Run the free check on tidycyber.co.uk and find out where you stand in a couple of minutes.