What happened, in plain English
Security researchers at Wiz found two flaws in PHP, recorded as CVE-2026-109618 and CVE-2026-109619, and nicknamed PHP2Shell. Both are rated 9.2 out of 10. They can let a stranger run their own code on the server your website sits on, without needing a password. That means they could add spam pages to your site, send your visitors somewhere else, or use your hosting to attack other people.
The PHP team released fixes the same day. Government sites in the Netherlands, Finland and Canada were taken offline as a precaution while they updated, and the UK's National Cyber Security Centre told organisations to update straight away. Those sites going dark does not mean they were hacked. It just means they chose to switch off rather than take the risk.
Is my website affected?
It depends on what your website is built with. Here is the quick version:
| Your website is | Risk | What to do |
|---|---|---|
| WordPress (yoursite.co.uk/wp-admin shows a login page) | Yes, until PHP is updated | Email your host today (template below) |
| Built by a local designer years ago, on hosting with cPanel or Plesk | Very likely | Email your host or designer today |
| Wix, Squarespace, GoDaddy Website Builder, Google Sites | Not yours to fix | The platform runs the servers and handles it. Nothing for you to update |
| A Tradewebsite.uk site | No | Nothing. It is plain pages with no PHP on the server (more on that below) |
| Not sure | Could be | Email me your web address and I will tell you |
What fixes it
Only an updated version of PHP on the server. Updating WordPress, your theme or your plugins does nothing for this one, because the flaw sits underneath all of them. The fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, or anything newer.
The catch is old sites. Plenty of trade websites built five or ten years ago still run on PHP 7, and those old versions are not getting proper fixes. If yours is one of them, your host will need to move it to a newer PHP version, and an old theme or plugin may need updating first so the site does not break when they do.
Firewall services like Cloudflare have added rules that block known attacks, which helps, but even they say it is a stopgap and not a replacement for the update.
The email to send your host today
Copy this, put in your web address, and send it to your hosting company or whoever built your site:
Hi, I have seen the news about the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619). Can you tell me which PHP version my website [your web address] is running, and whether it has been updated to a fixed version (8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer)? If not, when will it be? Thanks.
Ask for the actual version number in the reply. "We are on it" is not an answer you can check. A number is.
If your hosting has a cPanel login, you can often see it yourself under MultiPHP Manager or Select PHP Version. If a fixed version is listed there, switching is usually one click, but take a backup first in case an old plugin complains.
What if nobody replies?
This is common with trade websites. The designer who built it has moved on, or the hosting is in a name you do not recognise. If you cannot get an answer within a day or two:
- Find out who hosts it. Check your bank statements for a yearly charge from a hosting company. That is who to contact.
- Ask them to suspend the site until it is fixed. A few days offline is far better than a hacked site with a "This site may be hacked" warning next to it in Google, which can take weeks to clear.
- Consider whether you still need it. If it is an old site nobody updates and it is not bringing in work, switching it off and replacing it may be cheaper than nursing it along.
How to check nobody got in first
Once PHP is updated, have a two minute look:
- In WordPress, open Users and check every admin is someone you know.
- Look for pages or links you never added, especially about casinos, pills or crypto.
- Search Google for your business, click your own result on your phone using mobile data, and make sure it lands on your site. Some hacks only redirect visitors who come from Google.
- Check your email for any warning from your host about malware.
If anything looks wrong, tell your host straight away and change your hosting and WordPress passwords after PHP has been updated.
Why Tradewebsite.uk sites are not affected
Every Tradewebsite.uk site is a set of plain, ready-made pages served from Cloudflare. There is no PHP, no database and no login page on the server, so a flaw like this has nothing to attack. There are also no plugins to update and no hosting control panel for you to look after. That is not me being clever, it is just what you get when a site is built simply. A one page trade website does not need the machinery WordPress carries, and every piece you leave out is one less thing that can go wrong in a week like this.
To be fair to WordPress, it is fine if someone keeps it updated. The trouble is that most trade websites are set up once and then left alone for years, which is exactly when a flaw like PHP2Shell bites. If that sounds like yours, it is worth reading why a slow website loses you trade jobs too, because old WordPress sites usually have both problems.
Free check: send me your web address
If you are not sure what your website runs on or whether you need to do anything, email me at [email protected] with your web address and "PHP check" in the subject. I will have a look and reply in plain English: whether it is WordPress or PHP, whether you need to act, and exactly what to ask your host. It is free and you are under no obligation. Most people will just need to send their host the email above, and I will tell you if that is the case.
If you decide your old site is more trouble than it is worth, you can build a replacement free in about 2 minutes, use it free for 1 month, and keep it for £299 once with hosting included. No monthly fee and nothing to patch.
Frequently asked questions
Will updating WordPress fix PHP2Shell?
No. The flaws are in PHP, the software on the server that runs WordPress, not in WordPress itself. Updating WordPress, your theme or your plugins does not fix it. Your host needs to update PHP to 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer, or you can switch to a fixed version yourself in your hosting control panel if one is offered.
Is my Wix or Squarespace trade website at risk?
On hosted builders like Wix, Squarespace and GoDaddy Website Builder, the company runs the servers and handles security, so there is nothing for you to update. If you are worried, check the platform's status page or help centre for a statement.
Has anyone been hacked through PHP2Shell yet?
At the time of writing, 22 October 2026, some security firms report attack attempts, while the US cyber agency CISA said it had not seen the flaws used in real attacks when it published its notice. The details are now public and the fix is available, so it is safest to assume unpatched sites will be targeted.
How do I find out what PHP version my website uses?
Ask your hosting company, or log in to your hosting control panel. In cPanel, look for MultiPHP Manager or Select PHP Version. If you have no idea who hosts your site, look for a yearly charge from a hosting company on your bank statements, or email [email protected] with your web address and I will tell you what I can see from the outside.
Are Tradewebsite.uk sites affected by PHP2Shell?
No. Tradewebsite.uk sites are plain pages served from Cloudflare with no PHP, no database and no login page on the server, so there is nothing for this flaw to attack and nothing for you to update.
Not sure if your site is affected?
Email me your web address with "PHP check" in the subject. I will tell you in plain English whether you need to do anything and what to ask your host. Free, no obligation.
← Back to the blog · Related: is a free website really free?, one-off website or pay monthly