On Wednesday, October 21, the team behind PHP released emergency fixes for two critical security flaws. PHP is the programming language that runs most of the web, including every WordPress site. The FBI’s Cyber Division, cybersecurity agencies in several other countries, and every major security company put out the same warning within hours: patch and hunt immediately.
That phrase is security shorthand, and it’s good advice once you translate it. Patch means install the update so nobody new can get in. Hunt means check whether somebody already got in before you closed the door. Here’s what happened, how to tell if your website is affected, and what we did on our own servers the same day.
What the flaws are
The two bugs are tracked as CVE-2026-109618 and CVE-2026-109619, and researchers have nicknamed the pair “php2shell.” Both are rated 9.2 out of 10 for severity. In plain terms, an attacker can send a specially built request to a website and get the web server to run their own code. They don’t need a password, and on some server setups the attack works before the website’s own software even starts.
Once an attacker can run code on your web server, they can change your pages, plant fake login forms, send spam from your domain, or steal anything the website stores, such as contact-form submissions and customer accounts.
Three things make this one urgent:
- It’s everywhere. PHP runs about 69% of websites whose server technology is known. The researchers confirmed working attacks against WordPress, Drupal, Joomla and Magento.
- Attacks have already started. Cloudflare reported early attacks on the day of release, and other security firms reported attempts against both flaws.
- The details leaked early. The flaw numbers circulated online a day before the fix was ready, so attackers had a head start.
One more detail made the news: the researchers used AI tools to find these bugs. Expect more discoveries like this, arriving faster than they used to.
Is your website affected?
If your website runs on PHP, it’s affected until it’s updated. That includes nearly every WordPress site. To check which version you have:
- WordPress: log in, go to Tools, then Site Health, then the Info tab, and open the Server section. It lists your PHP version.
- Anything else: ask whoever hosts or built your website. “What PHP version is our site on, and has it been patched for the October 21 PHP fixes?” is a fair question to send today.
Then compare it with the fixed versions:
- PHP 8.2, 8.3, 8.4 or 8.5: you need 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or newer.
- PHP 7.4 through 8.1: these versions are past end of life, so there’s no official update. The PHP team published a minimal fix that hosting companies can apply themselves. Ask your host whether they did, and plan to move to a supported version.
- Anything older than 7.4: no fix exists. The site needs to move to a supported version.
What we did on our own servers
We host our own websites, and several client sites, on hardware in our Markham office. All of them run WordPress, which means all of them were exposed. Here’s what we did on Wednesday, October 21:
- Before the fix came out, we checked every site’s PHP version and turned off a PHP setting the attack relies on. We also lowered an upload limit on one site that was set far higher than it needed to be.
- When the fix came out, we updated every WordPress site we host to PHP 8.2.35, and confirmed each one was running the patched version.
- For a site we run at an outside hosting company, we confirmed the host had applied the fix to its older PHP version that same afternoon.
That’s the “patch” half. The “hunt” half is next.
How to hunt: signs someone already got in
Patching locks the door, but it doesn’t remove anyone who walked in first. Check for these, or have your web person check:
- Admin accounts you didn’t create. In WordPress, look at Users and filter by Administrator.
- Plugins or files you don’t recognize, especially anything added on or after October 20.
- Your site sending visitors somewhere else, particularly on phones or when they arrive from a Google search.
- Warnings from Google or your browser that the site may be hacked, or a sudden drop in search traffic.
- Your contact forms or email suddenly sending spam.
If you find any of these, don’t just delete the bad account. Restore the site from a backup taken before October 20, change every password tied to it (hosting, WordPress admins, database and email), and then patch. If you don’t have a backup from before that date, call someone before making changes. That’s our cue.
If you can’t update today
Putting your site behind Cloudflare helps in the meantime. Cloudflare added blocking rules for these attacks on all plans, including the free one. Cloudflare itself calls this a stopgap, so you still need to apply the update.
Want us to check your site?
Digitech checks and updates websites and servers for small businesses across the south suburbs. We’ll tell you which PHP version you’re on, apply the fix or get your host to, and look for any signs of a break-in. Call 708-596-2990 or email mknipper@digitech815.com.
Sources: PHP security advisories (October 21, 2026); Tenable, AlmaLinux and Rapid7 analyses; FBI Cyber Division public alert.