70% of Websites Run on PHP. Is Yours Safe? What Business Owners Should Do About PHP2Shell

On 21 October 2026, the people who maintain PHP released an emergency update for two critical security holes.

PHP is the software behind about 70% of the world's websites, including every WordPress site. The holes let an attacker take over a website's server with a single request, without logging in. Attacks started within hours, and some governments took their own websites offline while they fixed them.

The press calls it PHP2Shell. If you own a business website, here's what it means for you.

The short answer:

If your website runs on WordPress, WooCommerce or other PHP software, check this week that your server has been updated.
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If your site runs PHP 8.1 or older, a normal update isn't available.
If your site can't be updated right away, the FBI's advice is to take it offline until it can be.
If your site is on Shopify, Squarespace, Wix or Webflow, the platform runs the servers. There's nothing for you to update.

What Happened

On 20 October, the PHP project warned that an emergency security release was coming. On 21 October, it shipped the fixes. Both holes are rated 9.2 out of 10 for severity.

PHP's own announcement was unusually direct: "All PHP users are strongly encouraged to update immediately." It added that there's no setting that fully protects you: "updating is the only safe choice."

Attackers didn't wait:

Amazon's security team recorded an attack attempt on 17 October, four days before the public announcement.
The security firm watchTowr has seen attacks since 21 October.
Cloudflare's CEO reported "millions" of attack attempts within hours of the announcement.

Governments reacted fast. The FBI recommended taking websites offline if they couldn't be updated immediately. The EU's cybersecurity agency, ENISA, told organizations to act immediately. Some government services in the UK, Finland and Japan went partly offline as a precaution.

Why AI Is Part of This Story

OpenAI says a group of researchers and security companies it led had been working on these PHP vulnerabilities for two months, with help from AI. Researchers at the security firm Wiz say frontier AI models made it far easier to turn a long-standing flaw into a working attack.

That's the part business owners should take from this. Security holes are being found faster, and turned into attacks faster, than most businesses update their websites. The gap between "a fix exists" and "attackers are using the hole" is now measured in hours.

Is My Website Affected?

It depends on what your website runs on:

Your website runs on	Affected?	What to do
WordPress, WooCommerce, Drupal, Joomla, Magento, Laravel or other PHP software	Yes, until the server's PHP is updated	Check the PHP version this week (steps below).
Managed WordPress hosting	Your host should already have updated it	Ask them to confirm it in writing.
Your own server or a VPS	Yes, unless someone updates it	Your developer needs to update PHP and restart it.
Shopify, Squarespace, Wix, Webflow	The platform runs the servers	Nothing to update. Keep your logins secure.
A custom app in Node.js, Python or Ruby, or a static site	Not by these two holes	Ask your developer about the other security updates released this month.

If you don't know what your website runs on, that's worth finding out this week too. Your developer or hosting company can tell you in one message.

The Website You Forgot About

The biggest risk often isn't your main website. It's the one nobody is watching:

An old version of your site that was never switched off.
A staging or test copy your agency set up years ago.
A landing page or blog on a subdomain.
A hosting control panel or admin tool that runs on PHP.

Security researchers expect a long tail of attacks on exactly these: installations that are online, forgotten, and never updated. If it belongs to your business and it's on the internet, it needs the same check.

What to Do This Week

Ask your hosting company or developer one question, in writing: "Which PHP version runs our website, has it been updated to the fixed version, and were the PHP processes restarted?" The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or newer. Some hosts use patched packages with different version numbers, so ask them to confirm the fix is in.
List every website and copy your business owns, including old sites, test copies and subdomains, and ask the same question for each one.
If your site runs PHP 8.1 or older, the PHP project no longer releases updates for it. Some hosting vendors provide patches, so ask yours. For PHP 7.3 or older, no fix exists at all: the site needs upgrading, or taking offline. Also note that PHP 8.2 stops receiving security fixes on 31 December 2026.
If it can't be updated now, take it offline or replace it with a simple holding page until it can. That's the FBI's advice, and the UK's National Cyber Security Centre says the same. A web application firewall helps in the meantime: Cloudflare says its protection rules for this attack are on for all customers, including the free plan. But a firewall isn't a fix. Updating is.
Update WordPress, your plugins and your theme, and delete the plugins you don't use.
Turn on two-step login for your website, hosting, domain and email accounts, and remove old admin accounts: past employees, past agencies, past freelancers.
Check your backups. A recent backup should exist, be stored somewhere other than the website's server, and be possible to restore. A backup nobody has tested is a hope, not a backup.

Signs Your Website May Already Be Hacked

Attacks started before most websites were updated, so it's worth checking for these:

Admin users you didn't create.
Visitors being sent to strange websites.
Spam pages showing up in Google under your website's name.
Files that changed when nobody worked on the site.
A warning or suspension notice from your hosting company.
A site that suddenly became slow.

If you see any of these, updating PHP isn't enough. The site needs to be cleaned, the way in closed, and the passwords changed.

My Take

In my article Software Security V2, I wrote that AI is changing how fast security holes are found and used. PHP2Shell is what that looks like for ordinary businesses.

The websites that get hurt in moments like this are rarely the most complex ones. They're the ones nobody is watching: an old WordPress site, a forgotten test copy, a server nobody has updated in years. If you don't know who keeps your website updated, that's the first thing to fix.

For what it's worth, abz.global itself doesn't run PHP. It's a static site served through Cloudflare, so these two holes had nothing to attack. That's one of the reasons we build some websites that way.

How We Can Help

If you're not sure whether your website is affected, or you know it is and need help, here's what we do. All of it is on our pricing page.

Hacked site or app recovery, from $2,500: urgent cleanup, closing the hole, and getting you back online.
Launch security check, from $2,500: sign-in, database rules, secrets, security headers, backups, and a web firewall with attack protection.
Security review and hardening, $5,000 – $20,000: the common holes in your website or app found, fixed and checked again.
Security care, from $2,000 a month: monthly updates, monitoring, alerts and scans, with small fixes included.

Tell us your website's address and what it runs on, and we'll tell you where you stand.

Frequently Asked Questions

What is PHP2Shell?

PHP2Shell is the name the press gave to two critical security holes in PHP, fixed on 21 October 2026. They let an attacker run their own code on a website's server with a single request, without logging in.

Is WordPress affected?

WordPress runs on PHP, so a WordPress site is exposed until the server's PHP is updated to a fixed version. Updating WordPress itself doesn't fix it. PHP on the server has to be updated.

My website is on Shopify or Squarespace. Do I need to do anything?

Not for these two holes. The platform runs and updates its own servers. It's still a good week to turn on two-step login and remove old staff accounts.

Which PHP version is safe?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or newer. Some hosts use patched packages with different numbers, so ask them to confirm the fix is in. PHP 8.1 and older don't get official updates anymore.

Can a firewall protect my site instead of updating?

A web application firewall can block many attack attempts while you update, and Cloudflare has rules for this attack on every plan. But PHP's own advice is that updating is the only safe choice.

How do I know if my website was already hacked?

Look for admin users you didn't create, strange redirects, spam pages in Google under your site's name, files changed by nobody, warnings from your host, or a sudden slowdown. If you see any of them, the site needs a proper cleanup, not just an update.