Security Alert: Critical PHP Vulnerability (PHP2Shell) – What Website Owners Need to Know
Peter A. Liefer II | Posted: October 21st, 2026Last updated: October 21, 2026
The short version: A critical PHP vulnerability, nicknamed PHP2Shell, can let an attacker take control of a website without a username or password. PHP is the software that runs WordPress and most of the websites on the internet. A fix was released on October 21, 2026, and every website running PHP should be updated now.
PrimeView clients: we’re on it
Our security team flagged this threat as soon as details became public, and we are upgrading every server and website we host and manage. That work includes:
- Installing the patched version of PHP on all of our servers
- Adding firewall protection to block attack attempts while updates roll out
- Upgrading or isolating any website running an older, unsupported version of PHP
- Scanning for any signs that a site was targeted
If your website is hosted or managed by PrimeView, you don’t need to do anything. We’ll let you know once your site has been confirmed updated.
Not hosted with PrimeView? Here’s what to do
If your website is hosted somewhere else, don’t assume it’s been taken care of. Take these steps today:
- Contact your hosting provider (the company that runs your website’s server, not your internet provider) and ask: “Has my server been updated with the October 21 PHP security fix?”
- Ask which version of PHP your site runs. If it’s PHP 8.1 or older, your site will not receive an official fix and needs to be upgraded.
- Get a current backup of your website before any changes are made.
- If you manage your own server, update PHP now. Security plugins and settings changes alone won’t fix this.
What happened: the PHP vulnerability explained
On October 20, 2026, technical details about two serious PHP flaws (tracked as CVE-2026-109618 and CVE-2026-109619, nicknamed “PHP2Shell”) leaked online before a fix was ready. The PHP project rated both 9.2 out of 10 for severity and released emergency updates the next day.
Why it matters: PHP runs underneath your website. A flaw at this level can be exploited before WordPress, your theme or your security plugin ever gets involved. That’s why updating PHP itself is the only complete fix.
Which websites are affected?
- WordPress and WooCommerce sites
- Drupal, Joomla, Magento and Laravel sites
- Most other websites built on PHP
The highest-risk sites are those on PHP 8.1 or older. Those versions have reached end of life, and the PHP project will not release a fix for them.
The versions that fix it
Share this with your hosting provider or developer:
| PHP version | Safe version |
|---|---|
| PHP 8.5 | 8.5.12 or later |
| PHP 8.4 | 8.4.27 or later |
| PHP 8.3 | 8.3.36 or later |
| PHP 8.2 | 8.2.35 or later |
| PHP 8.1 and older | No fix available. Upgrade required. |
Some hosting companies install their own patched builds with different version numbers. If yours does, ask them to confirm the October 21 fix is included.
Frequently asked questions
How do I know if my website is vulnerable?
If your site runs on PHP and your hosting provider hasn’t confirmed the October 21 update, treat it as vulnerable. Most website owners won’t be able to tell on their own, so ask your host directly.
Will my security plugin protect me?
Not completely. The flaw is in PHP itself, which runs before WordPress and its plugins. A firewall can block some attacks, but only updating PHP closes the hole.
Is this the same as my internet provider?
No. Your internet provider (like Cox or CenturyLink) connects your home or office to the internet. Your hosting provider runs the server your website lives on. The hosting provider is the one who needs to apply this fix.
Has anyone been attacked?
Security firms have reported attackers probing websites since the details leaked. Don’t wait for confirmed breaches. Update now.
What if my site is on an old version of PHP?
Sites on PHP 8.1 or older need an upgrade to a supported version. Older themes and plugins sometimes break during upgrades, so back up first and have a developer test the site.
Not sure where your website stands?
PrimeView can check your site’s PHP version and security status and tell you exactly what needs to happen next, whether or not you’re a current client.
Related: Which PHP version should your website run?
Peter is the CEO of PrimeView, the leading Arizona Web Design and Digital Marketing Firm. A veteran in the Web Development and eCommerce industry, he is focused on delivering data-driven results. Learn more about Peter and PrimeView on our Profile. You may also reach us here.
