PHP2Shell: what this week’s PHP security alert means for your website
If you’ve seen the news this week about governments and councils taking their websites offline, you might be wondering whether your own website is at risk. The short answer: if your site runs on PHP, it was, and you need to check it has been updated.
Don’t panic. This post explains what happened in plain English, how to check your site in a couple of minutes, and what to ask whoever looks after it.
What happened?
On 21 October 2026, PHP released emergency security updates for two critical flaws, nicknamed “PHP2Shell”. They were found by security firm Wiz using AI tools, and Wiz called them the most severe vulnerabilities AI has discovered so far.
PHP is the programming language that runs behind around 70% of websites, including every WordPress site. Because the flaws are in PHP itself, a website didn’t need to have anything wrong with it to be exposed. Simply running on an affected version was enough.
The flaws can let an attacker:
Attacks started before the fix was even released. That’s why the Finnish government, the Dutch cyber security agency, Edinburgh council and parts of the BBC took websites offline while they updated.
Why it matters for small businesses
It’s easy to assume hackers only go after big organisations. In reality, most attacks are automated. Bots scan the internet for any site running a vulnerable version and attack whatever they find, whether it’s a government department or a local plumber.
If your site is compromised, you could be facing:
The sites most at risk are the ones nobody is actively looking after. A site built a few years ago and never updated could be running a version of PHP so old that this week’s fixes don’t even cover it. The emergency patches only go back as far as PHP 7.4.
How to check your WordPress site
If you can log in to your WordPress dashboard, you can check this yourself in about two minutes.
- Log in to WordPress and go to Tools > Site Health.
- Click the Info tab at the top.
- Open the Server section and look for PHP version.
- Then open the WordPress section and look at Version. It will also tell you the latest version available.
What you’re looking for:
Tip: be careful not to mix up the two numbers. WordPress and PHP are different things with their own version numbers, so make sure you’re reading the PHP version in the Server section.
Questions to ask whoever looks after your website
You don’t need to understand the technical side. You just need to know someone is taking responsibility for it. Ask your developer or hosting company:
- Has this week’s PHP security update been applied to my website?
- Which version of PHP is my site running, and is it 8.3 or newer?
- Has anyone checked my site for signs it was accessed before the fix?
- When was my site last backed up, and could you restore it if something went wrong?
- Do I have full admin access to my own website and hosting?
If you’re not sure who to ask, or you don’t get a clear answer, that’s worth sorting out now rather than after something goes wrong.
If we host your website
If your website is hosted by Bright Website Design, you’re covered. Our hosting provider, 20i, had the fix rolled out across its servers by 9pm on 21 October, the same day it was released.
We’ve been building new websites on PHP 8.3 for well over a year, and earlier this year we moved our older sites over too, to get ahead of PHP 8.2 being retired in December. That meant none of our clients were left on an outdated version when this news broke.
We’re also checking client sites for any signs of unusual activity, so there’s nothing you need to do. If you have any questions, just get in touch.
Not sure if your website is affected?
If someone else looks after your website, or you’re honestly not sure who does, we’re happy to take a look. We’ll check which version of PHP and WordPress your site is running and tell you, in plain English, whether there’s anything you need to do. No hard sell, just straight answers.
Get in touch with Bright Website Design
Sources
By Bec Lee
Bright Website Design
Bec is the founder of Bright Website Design, a Wilmslow-based website design agency specialising in building beautiful, high-performing WordPress websites for small & medium businesses.
With a reputation for being straightforward, technically sharp, and genuinely invested in her clients’ success, Bec has built websites for businesses of all shapes and sizes, from local Cheshire traders to companies operating across Europe.
