PHP Vulnerability (PHP2Shell): What We Did to Protect Your WordPress Site
TL;DR: On October 21, 2026, PHP, the language WordPress runs on, released emergency fixes for two critical security flaws. Hosting companies around the world have been racing to patch. Your WP Guy checked every site in our care and moved each one to a secure, patched version of PHP. A few older sites may behave differently after the update. If you notice anything off, let us know and we will take it from there.
Quick answer: The PHP vulnerability is a pair of critical flaws that could let an attacker run commands on a web server without ever logging in. We checked every site we care for and updated it to a secure version of PHP. If an older plugin or theme acts up after the update, tell us and we will dig in.
What’s in This Post
Your customers need your attention. You need your website to work. So the last thing you want in your news feed is a headline about a critical PHP vulnerability hitting hosting companies everywhere.
Take a breath. Here is what happened, in plain English, and what we already did about it.
The PHP Vulnerability in Plain English
PHP is the programming language WordPress is built on. Think of it as the engine under the hood of your storefront. Every time a visitor loads a page on your site, PHP is doing the work behind the scenes.
On October 21, 2026, the PHP team released emergency fixes for two serious flaws in PHP itself. Security researchers call the pair PHP2Shell. Both are rated 9.2 out of 10 for severity, which is about as loud as an alarm gets.
Here is the risk. An attacker with no login and no invitation could trick a vulnerable server into running commands of their choosing. Experts call that remote code execution. Picture a stranger walking up to the back door of your shop and finding it unlocked.
Notice what this is not. It is not a WordPress bug. It is not caused by a plugin you installed or a password you picked. This PHP vulnerability lives in PHP, so it affected websites of every kind that were running an unpatched version.
Why Hosting Companies Around the World Scrambled
Security researchers found the flaws and reported them to the PHP team privately, so a fix could be built quietly. Then word of them leaked online on October 20, two days before the planned release, and PHP moved its fix up a day.
Security firms reported early attack attempts before the patch arrived. Once PHP shipped the fix on October 21, hosting companies had to build, test, and roll out new PHP packages across enormous numbers of servers. That is a race, and everyone ran it on the same day.
One detail worth knowing: PHP released fixed versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and older no longer get regular updates from PHP. The PHP team posted bare-bones patches for 7.4, 8.0, and 8.1, but those versions get no other security fixes. That matters in a minute.
What Your WP Guy Did About It
Short version: we handled it. We checked every site in our care, 105+ active client sites, and updated each one to a secure, patched version of PHP. You did not have to log in, open a ticket, or chase down your host.
That is the job. You grow your business. We handle this website stuff.
We moved quickly for a simple reason. The longer a site sits on a vulnerable version, the longer that back door stays unlocked. A patched PHP is the real fix. Firewalls and other stopgaps can slow an attacker down, but they do not close the door.
Why Some Older Sites May Act Up
Here is the honest part. Newer versions of PHP are stricter than older ones. Most sites move over without a hiccup. A few older sites, especially ones running outdated plugins, aging themes, or custom code written years ago, may not love the move.
Updating was still the right call. A site left on an unpatched version of PHP is a much bigger problem than a plugin that needs a tune up. And since PHP 8.1 and older no longer get regular security fixes, staying put was never a safe option.
Here is what an issue can look like:
- A white screen or an error message where a page should be
- A form, slider, popup, or other feature that stopped working
- A layout that looks off, or a page that loads slower than usual
- A warning message in your WordPress admin area
If you can describe it, great. If all you can say is “it looks weird,” that is plenty.
What To Do If You See Something Off
Tell us. That is the whole step.
Call 678-995-5169 or use the button below. Share the page, what you expected, and what you saw instead. A screenshot helps, but you do not need one. We will take it from there.
No need to troubleshoot it yourself, and no need to feel awkward about it. Believe it or not, we’ve heard it all.
If Your Site Is Not With Us Yet
Maybe you are reading this and wondering about your own site. Fair question. Here is where to start.
Ask your host which version of PHP your site runs and whether it has been patched for this PHP vulnerability. Keep in mind that updating WordPress, your theme, or your plugins does not update PHP. That lives at the server level, so it comes from your host. You can see the fixed releases on the official PHP downloads page.
If your site runs PHP 8.1 or older, it is past the end of its life and no longer gets regular fixes from PHP, so an upgrade is the move. PHP 8.2 reaches the end of its life on December 31, 2026, so plan for that one too. Want a quick read on where your site stands? Our free Uh Oh Score is a 30 second WordPress risk scan, and a good place to start.
Not Sure Your Site Is Covered? Let’s Find Out.
Whether you are a client with a question or a site owner with a worry, a real WordPress expert is one call away.
Talk to a WordPress ExpertFrequently Asked Questions
What is the PHP vulnerability everyone is talking about?
It is a pair of critical flaws in PHP, the language WordPress runs on, nicknamed PHP2Shell. Both are rated 9.2 out of 10 for severity. They could let an attacker run commands on a web server without logging in. PHP released fixes on October 21, 2026.
Is my WordPress site affected?
Any website running an unpatched version of PHP was exposed, whether it uses WordPress or not. If your site is in our care, we have already checked it and moved it to a secure version. If it is hosted elsewhere, ask your host about their PHP update.
Did Your WP Guy update my site?
Yes. We checked every site in our care and updated each one to a secure, patched version of PHP. You did not have to do anything.
Why might my older site have problems after the update?
Newer versions of PHP are stricter than older ones. Outdated plugins, aging themes, or custom code written years ago may not play nicely with the newer version. Most sites move over without any trouble, but a few need a small fix.
What should I do if something looks wrong on my site?
Let us know. Call 678-995-5169 or schedule a time to talk with us. Tell us which page looks off and what you expected to see, and we will take it from there.
Does updating WordPress fix this PHP vulnerability?
No. WordPress, themes, and plugins all run on top of PHP, and updating them does not change the PHP version underneath. The fix has to be applied at the server level, which is usually handled by your host or your website care provider.
