A critical PHP flaw is being exploited right now.

On 21 October 2026 the PHP project released an emergency security update and urged every PHP user to update immediately. Two critical flaws, nicknamed PHP2Shell, were already being exploited before the fix was public. If your website runs on PHP — and most business websites do — this one is worth acting on quickly.

Here’s what it is, who it affects, and what to do.

What PHP2Shell actually is

PHP is the programming language that runs a huge slice of the web, including WordPress, Drupal, Joomla, Magento and countless custom-built sites. These two flaws are in PHP itself:

• CVE-2026-109618 and CVE-2026-109619

Both allow what’s called unauthenticated remote code execution. In plain terms: an attacker can run their own commands on the web server without needing a password or any access. That’s about as serious as web vulnerabilities get, which is why the PHP project’s advisory tells everyone to update straight away. The highest risk is to the common Apache “mod_php” setup, where an attack can land before any of your own site’s code even runs.

Updating WordPress will not fix this

This is the part that catches people out. The flaw is in PHP, not in WordPress, your theme or your plugins. Updating WordPress is still good practice — but it does nothing for this issue. The thing that needs updating is PHP itself, and that’s controlled by whoever runs the web server.

Does it affect you?

If your website, online shop, booking system, intranet or client portal runs on PHP, assume it’s affected until someone confirms otherwise. If you’re not sure whether it does, the safe assumption for a typical WordPress or CMS-based business site is yes.

One honest word of warning: you can’t reliably check this from the outside. Most servers don’t reveal which PHP version they’re running, and even when they do, hosting companies often apply the fix without changing the version number. There’s no safe way for an outside tool to prove a site is vulnerable without attacking it — so the dependable check is on the server, or a straight question to whoever hosts it.

What to do

1. Work out who runs your website’s server. For most small businesses that’s a hosting company (for example a managed WordPress host) rather than something on your own premises. Your web developer or your hosting invoices will tell you.
2. Ask them to confirm PHP is on a fixed version — 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or their Linux distribution’s patched build. A good host will already have done this; asking the question is reasonable and takes them a moment.
3. If you run your own servers, update PHP now and restart the service (PHP-FPM, Apache or whichever you use) so every worker picks up the fix. Check the command-line version too.
4. If you genuinely can’t update today, the PHP advisory lists temporary measures that reduce the risk. They don’t make a server safe, so treat them as a stopgap and update as soon as you can.
5. Check anything else that runs PHP, not just your main website. Shops, portals and internal tools often sit on separate servers that need patching individually.

If Reformed IT manages your IT

If we look after your servers, this is already in hand — keeping systems patched against exactly this kind of flaw is part of what we do. Where your website is hosted with a third party, we’ll help you confirm they’ve patched it. If you’re not certain who runs yours, just ask and we’ll find out with you.

The wider point this one makes: staying safe isn’t about reacting to each new headline. It’s about having someone keep your systems up to date so that when a flaw like this lands, the answer is already “done” rather than “let’s find out.”