PHP2Shell: What San Antonio Businesses Need to Do Now

Short answer: on October 21, 2026, the PHP project released emergency fixes for two critical flaws, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), that can let an attacker take over a website without logging in. If your business site runs on WordPress, WooCommerce, Laravel or another PHP platform, make sure your server runs PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or newer. If it runs PHP 8.1 or older, there is no official fix at all.

Here's what happened, how to check your site in a few minutes, and what to do if it has already been hit.

What happened

• October 20, 2026: details of the two flaws leaked publicly before a fix was out.
• October 21: the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix them.
• October 26: CISA, the U.S. Cybersecurity and Infrastructure Security Agency, added both flaws to its list of vulnerabilities that attackers are actively exploiting.

According to CISA's alert, the flaws affect all PHP installations serving web requests, including common setups such as Apache with mod_php, PHP-FPM and LiteSpeed. The PHP Foundation reported that full remote code execution was demonstrated with default settings. In plain terms: an attacker could run their own code on your server and control your website.

Why this matters for a small business website

• Most small business sites run on PHP. WordPress, WooCommerce, Joomla, Drupal and Laravel all do.
• The fix lives on the server, not in WordPress. Updating WordPress and your plugins is still important, but it does not patch PHP. Your host, or whoever manages your server, has to install the fixed PHP release.
• Nobody is watching most small business sites. If no one has logged in since launch, you usually find out about a hack when Google warns your visitors or your host suspends the account.

How to check your site in 5 minutes

1. Log in to your hosting control panel, such as cPanel, Plesk or your host's own dashboard.
2. Find the PHP version setting. It's usually called "Select PHP Version", "PHP Manager" or "PHP Settings". In WordPress you can also open Tools → Site Health → Info → Server.
3. Check the full version number, not just "8.3". You need 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a newer release in the same line.
4. If you're on PHP 8.1 or older, plan an upgrade now. The PHP project no longer updates those versions. PHP 8.2 itself reaches end of life on December 31, 2026, so if you're upgrading anyway, move to 8.3 or newer.
5. If your version isn't patched and you can't change it yourself, open a ticket with your host and ask when they will install the fixed release.

Take a full backup before you switch PHP versions, and test the site right after. If something breaks, that points to outdated plugins or code that needs fixing. It's not a reason to stay on an insecure version.

Signs your site may already be compromised

• Visitors are redirected to spam, gambling or pharmacy sites.
• You see admin users, files or pages you didn't create.
• Google Search Console reports a security issue, or Chrome shows a warning before your site loads.
• Your host emails you about malware or suspends the account.

What to do if you've been hacked

1. Take the site offline or ask your host to show a maintenance page.
2. Don't just restore last week's backup. If the site was hit after the October 20 leak, a recent backup may already contain the attacker's files. Patch PHP first, then restore from a backup you know is clean.
3. Update everything and change every password: PHP, WordPress, plugins and themes, plus hosting, admin, database and FTP logins.
4. Remove the malware and close the way in. This is what our Website Repair & Rescue service does.
5. Ask Google to re-check the site. Once it's clean, request a security review in Google Search Console so the warning comes off.

How to stay ahead of the next one

Security fixes only protect you if someone installs them. A website care plan covers platform, plugin and theme updates with a backup first, regular backups, security and uptime monitoring, and help first when something breaks. Essential Care is $69 a month. Working with a smaller budget? Reach out anyway; we work with any budget and will find an option that fits.

Whoever looks after your site, ask them one question after every PHP security release: which exact PHP version is my site running now?

Sources

• PHP security advisory and releases, php.net (October 21, 2026)
• Critical Vulnerabilities in PHP Require Immediate Patching, CISA (October 21, 2026; revised October 26, 2026)
• Today's PHP Security Release, The PHP Foundation (October 21, 2026)
• Supported PHP versions, php.net

Related: How to Save a Broken Website | Website Care Plans

---