The PHP2Shell security hole and what to do about it this week

If your website runs on WordPress or any other PHP software, ask your host today whether they've installed the PHP update from October 21, 2026.

PHP is the programming language underneath WordPress and a lot of other website software. On October 21, the people who make PHP fixed two serious security holes in it. Researchers are calling the pair "PHP2Shell."

What the holes let attackers do

Both holes let a stranger on the internet run their own code on your web server. They don't need a password or an account. Once someone can run code on your server, they can plant spam on your pages or steal what's stored there.

PHP rated both holes 9.2 out of 10 for severity. They reach back to PHP 5.4, so almost every PHP site is affected. It doesn't matter which plugins you use, because the problem sits in PHP itself.

Are people using it yet?

Attackers are trying. The details leaked online on October 20, a day before the fix came out. watchTowr, a security firm that runs fake servers to catch attackers, says it saw exploitation starting October 21.

Rapid7 found that the public attack code is picky for now. Each version only works on one specific mix of server setup and PHP version. They call this a window to patch. I'd treat it as a few days at most.

What to do, based on how your site is hosted

Managed WordPress hosting (Kinsta, WP Engine, Pressable, Flywheel, and similar). Your host updates PHP for you. Check their status page or your email for a notice. Several of them have already posted updates, and Codeable keeps a list. If you hear nothing by the end of the day, email support.

Shared hosting (GoDaddy, Bluehost, and the like). The host patches the server for everyone on it, but some are quiet about it. Send support a short message: "Have you applied the October 21 PHP security update to my server?" Get a yes in writing.

Your own server or VPS. Nobody is coming to fix this for you. Whoever manages the server needs to install the new PHP packages and restart PHP today. The fixed versions are 8.2.35, 8.3.36, 8.4.27, and 8.5.12.

If your site runs an old version of PHP

You can see your version in WordPress under Tools, then Site Health, then the Info tab, in the Server section. Most hosting dashboards show it too.

If it says 8.1 or lower, you have a bigger problem. Those versions are out of support. PHP put out only bare-bones fixes for 7.4 through 8.1, and nothing for 7.3 or older. The only real answer is moving to PHP 8.2 or newer. Have someone test your site on a copy first, since old plugins sometimes break on newer PHP.

One catch: a version number alone can fool you. Some hosts patch PHP without changing the number you see. That's why asking your host directly is the most reliable check.

What about sites that don't use PHP?

Builders like Squarespace and Wix run their own servers, and you can't update them yourself anyway. If you're on one, keep an eye out for any notice from them, but there's nothing for you to install.

The sites we build at SiteLaunch don't run on PHP, so this one doesn't touch our clients. I wrote more about where each kind of website is weakest if you want to know what to watch for on yours.

Want a second set of eyes?

If you're not sure how your site is hosted, or your host isn't answering, send me a message. I can help you figure out what your site is built on and who hosts it, so you know which advice above fits you. If your host is slow to answer, I can help you word the request.

This post covers the facts as of October 22, 2026. Things are moving fast, so check your host's latest notice too.