This week, two critical security flaws were found in PHP, the programming language behind a large share of the world’s websites, including most WordPress sites. Together they’ve been nicknamed “PHP2Shell”, and security teams around the world have been scrambling to patch them. If you run a business website, it’s worth five minutes of your time to understand what’s happened and whether it affects you.
What Actually Happened
The two vulnerabilities (CVE-2026-109618 and CVE-2026-109619) allow an attacker to run their own code on a web server that’s running PHP, without needing to log in. In practical terms, that can mean access to the files and database behind a website: customer details, contact form submissions, admin accounts, and anything else stored there.
Details of the flaws leaked online a day before the official fix was due, so attackers had a head start. Security firms reported attack attempts on 21 October, before PHP’s emergency patch was even released, and both flaws are rated 9.2 out of 10 for severity. The UK’s National Cyber Security Centre and the US National Security Agency have both issued warnings urging website owners to update.
There is some reassuring news. Researchers have since said that a successful attack needs specific conditions on the target server, so widespread mass exploitation now looks less likely than first feared. That said, “less likely” isn’t the same as “safe”, and unpatched servers remain a real target.
Which Websites Are at Risk?
The flaws affect PHP versions going back as far as PHP 5.4, which covers more than a decade of websites. If your site runs on any of the following, it’s very likely built on PHP:
- WordPress, including WooCommerce shops
- Joomla or Drupal
- Most traditional shared hosting packages using cPanel
- Many older custom-built sites and plugins
Website builders like Wix and Squarespace manage their own servers, so it’s their responsibility to patch, and you don’t need to do anything yourself.
What to Do If Your Site Uses PHP
If you’re not sure what your site runs on, ask whoever built it or whoever hosts it. If it does use PHP, the steps are straightforward:
- Ask your host to confirm they’ve updated PHP. The fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Older, unsupported versions of PHP won’t receive a fix at all, which is a strong sign the site needs moving to a supported version.
- Check for anything unusual. New admin users you didn’t create, unfamiliar files, or your site suddenly redirecting elsewhere are all warning signs.
- Make sure you have a recent backup stored somewhere other than the website’s own server.
- Change your admin passwords once you know the server has been patched.
Most reputable hosts will have patched already, but it’s worth getting that confirmation in writing rather than assuming.
Why JBH Media Websites Aren’t Affected
Every website I build is hand-coded with Astro and hosted on Cloudflare. There’s no PHP anywhere in the setup, so PHP2Shell simply has nothing to attack. There’s no WordPress install to keep patched, no plugins quietly going out of date, and no database sitting behind the site waiting to be exposed.
This isn’t luck. It’s a deliberate choice. Most small business websites don’t need a server running code every time someone visits a page. Building them as fast, pre-built pages served from Cloudflare’s global network removes a whole category of risk, including this week’s, along with most of the routine security maintenance that comes with a typical WordPress site.
No website is ever immune to every possible threat, and good habits like strong passwords and keeping your domain account secure still matter. But a smaller attack surface means far fewer things that can go wrong, and far fewer urgent weeks like this one.
Worried About Your Own Site?
If you’re not sure what your current website runs on, or whether it’s been patched, I’m happy to take a quick look and tell you plainly what I find. And if this week has made you think it’s time for something simpler and more secure, get in touch and we can talk it through.
