Critical PHP security flaws: what website owners need to know

What happened

On October 21, 2026, the PHP development team released an emergency security update fixing two critical flaws that let attackers run their own code on a web server without logging in. Security researchers are calling the pair PHP2Shell, and both are rated 9.2 out of 10 for severity.

This one matters to almost every website owner. PHP is the programming language behind WordPress, WooCommerce, Drupal, Laravel, and countless custom sites. If your website runs on PHP, an unpatched server could be fully taken over.

The situation is moving fast. Details leaked before the planned release date, working attack code is already circulating publicly, and security firms have reported attacks happening in the wild since the day the fix came out.

Who is affected

Every PHP version from PHP 5 onward is vulnerable until it is updated. The fix is available only for the four versions of PHP that are still supported:

Older PHP versions have reached their end of life, so the PHP team will not release a patch for them. If your site is still running PHP 7 or PHP 8.1, it needs a full upgrade, and that may also mean updating themes and plugins so they keep working on the newer version.

What I'm doing for my clients

If KYR Websites hosts or maintains your website, I'm already on it. Here's what I'm doing:

• Checking the PHP version on every site and server I manage
• Applying the patched PHP release as soon as it is available on each host
• Updating WordPress core, themes, and plugins so everything runs smoothly on the patched version
• Planning upgrades for any site still on an older, unsupported PHP version
• Watching for any signs of suspicious activity while updates roll out

You don't need to do anything if I manage your site. I'll reach out directly if your site needs an upgrade or if anything requires your input.

What to do if you manage your own site

If you host your own website or work with another provider, take these steps today:

1. Find out your PHP version. In WordPress, go to Tools, then Site Health, then Info, and open the Server section. You can also find it in your hosting control panel.
2. Update PHP. Most hosts let you change or update PHP from the control panel. If you are not sure how, contact your host and ask whether they have applied the October 21 security release.
3. Upgrade if you are on PHP 8.1 or older. Move to PHP 8.2 or newer so you can receive the fix. Back up your site first and test it after the switch.
4. Update everything else. Bring WordPress core, your theme, and all plugins up to date. Some software makers are releasing their own related fixes.
5. Check for anything unusual. Look for unfamiliar admin users, strange new files, or unexpected changes to your site.
6. Limit access where you can. Admin areas and tools that do not need to be public should be locked down behind a firewall or password protection until you are patched.

If any of these steps feel overwhelming, that is completely normal. This is exactly what a website care partner is for.

I'm here to help

Security issues like this are a reminder that a website is never truly finished. Regular updates and monitoring keep your site safe, fast, and online.

Not sure whether your site is affected? Reach out at kylie@kyrwebsites.com and I'll check your PHP version and help you get patched quickly.

Sources

• PHP 8.5.12 release notes (php.net)
• PHP2Shell FAQ (watchTowr)
• PHP2Shell: Critical PHP vulnerabilities patched (Help Net Security)