On the afternoon of Wednesday 21 October, the PHP project released fixes for two serious security flaws, which the security world has nicknamed PHP2Shell. On the servers that run the websites I host, those fixes were installed by half past six that evening.
I know that a story like this can be unsettling when it appears in the news or arrives in your inbox, so I would like to explain what happened, what was done about it and how quickly, and what to ask if your website is hosted elsewhere.
What PHP2Shell is.
PHP is the programming language in which WordPress and WooCommerce are written, along with a great many other websites. Every time someone opens a page on your site, PHP is the part at work on the server, putting that page together, so it sits beneath everything else, including WordPress itself and every plugin you have installed.
The two flaws (their official references are CVE-2026-109618 and CVE-2026-109619) were in PHP itself, and that is what made them serious. A website could have WordPress and every plugin entirely up to date and still be exposed, because the problem lay in the layer beneath. Both were rated 9.2 out of 10 for severity, and in the worst case they could allow someone to run their own code on a web server without needing a password, which is about as serious as such flaws become. The United States government's cyber security agency, CISA, told organisations to install the fixes immediately, and to take their sites offline if they could not.
What happened on the hosting I provide.
The websites I host live on servers run by the hosting company I use, who posted updates throughout the afternoon, so there is a clear record of what was done and when. At 3.24pm, shortly after the fixes were published, they confirmed that they were aware of the flaws and had already added extra protection across their platform. By 6.30pm the fixed versions of PHP were installed across the whole of their hosting platform.
The new official releases cover only PHP 8.2 and newer, so they also applied the same fixes to the older versions of PHP they still offer, which means it did not matter which version your website happens to run on.
Why your control panel says 8.3, not 8.3.36.
One client, who had read about the flaws and very sensibly went to check, asked me a good question the same day. Their hosting control panel let them choose PHP 8.3, but the fixed release is 8.3.36, and the panel only ever showed the main version number. That is entirely normal. The setting chooses which version of PHP your website uses, and the hosting company keeps each version up to date with the latest fixes behind the scenes, so the point releases never appear in that list. When I checked their website from the outside, it was already reporting PHP 8.3.36.
If your website is hosted elsewhere.
The fix for PHP2Shell has to come from whoever runs the server, so if your website is hosted elsewhere, it is worth asking your hosting company whether they have installed the fixed release for the version of PHP your site runs, or applied the fixes to an older version. These are the fixed releases:
| If your site runs | The fixed release |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
If your site still runs on PHP 8.1 or older, those versions no longer receive new official releases, so you are relying on your host to have applied the fixes themselves, and it is a good moment to move up to a newer version in any case.
It is also wise to steer clear of any plugin that claims to protect you from PHP2Shell. The flaws sit beneath WordPress, so nothing installed inside WordPress can fix them, and the security company Patchstack has warned against relying on unofficial fixes and copied snippets.
What it means if I host your website.
I have looked after websites since 2001, and the best security news is the kind that has already been dealt with by the time you hear about it. That is really the point of managed hosting: the servers are patched, your website keeps running, and you carry on with your day without needing to know what a CVE is.
If your website is hosted elsewhere and you are not sure where you stand, write to me and I will tell you exactly what to ask.