PHP Vulnerability: Is My Website Affected?

You may have seen the news this week about a flaw in something called PHP. PHP is the software behind most business websites, including every WordPress site. A fix came out on 21 October 2026.

This guide shows you how to check your site in a few minutes. It tells you what to ask your host, and what to do if your site is too old to update.

The short version.

• If your site runs on WordPress, it runs on PHP. So do most sites built by an agency or a friend a few years ago.
• The safe versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or anything newer. Ask your host which one you are on.
• PHP 8.1 and older get no fix from the PHP team. Around one in three PHP sites run on those versions.
• If your site is stuck on an old version, you have a choice to make. We cover it below.

What happened.

In August, researchers at a security firm called Wiz found two bugs in PHP. They used AI tools to help find them. The bugs had sat in PHP for more than ten years without anyone noticing.

On 21 October, the PHP team released fixed versions. The two flaws are rated 9.2 out of 10 for severity. Together they are known as PHP2Shell.

This is why they matter. An attacker can send a specially made request to a website. If the server runs an unpatched PHP, they can run their own code on it. They do not need a password. They can also read the server's memory, which may hold login details from other people's visits.

The flaw is in PHP itself, not in your site's code. A site built with care is still exposed. The researchers showed it working on WordPress, Drupal and Joomla.

In the UK, the National Cyber Security Centre put out an alert the same day. It told organisations to update at once. If they could not, it said to consider taking sites offline until they could. Council websites in Edinburgh, Oxford, Bristol, Lambeth and Barnet went down or showed errors. So did the Met Police site.

Attackers did not wait. Cloudflare saw people trying the flaw before the fix was out. By the afternoon of 21 October, security firms were reporting live attempts on both bugs. No break-ins had been confirmed when we checked. That can change, so treat this as urgent rather than a reason to panic.

Does your website use PHP?

Probably. W3Techs puts PHP behind about 69% of the websites it can measure. This is how to tell:

• WordPress. Yes, always. WordPress is written in PHP.
• Joomla, Drupal, Magento, OpenCart or PrestaShop. Yes.
• Wix, Squarespace or Shopify. These companies look after their own servers. There is nothing for you to patch.
• A site a developer built for you. Look at the web addresses. If pages end in .php, it runs PHP. If you are not sure, ask whoever hosts it. If in doubt, assume yes.

How to find your PHP version.

You do not need to be technical for this. Pick whichever way is easiest.

You have WordPress. Log in. Go to Tools, then Site Health. Click the Info tab and open Server. The PHP version is listed there.

You have a hosting control panel. In cPanel, look for Select PHP Version or MultiPHP Manager. In Plesk, open your site and look for PHP Settings. The version is shown at the top.

None of that rings a bell. Email your host. You can copy this:

Hi. I have read about the PHP security flaw fixed on 21 October. Which PHP version is my site [your web address] running? Is it 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or newer? If not, when will it be updated? Please also confirm the server has been checked for signs of a break-in. Thanks.

A good answer.

8.5.12, 8.4.27, 8.3.36 or 8.2.35, or any number higher than those. You are patched. Two things are still worth doing, and they are in the next section.

A bad answer.

Any version starting 8.1, 8.0, 7 or 5. The PHP team no longer updates these. Some hosts patch old versions themselves and keep the old number. If your host says they have done that, ask them to confirm in writing that CVE-2026-109618 and CVE-2026-109619 are fixed. Those are the official names for the two bugs.

Your site is on a supported version.

Many hosts update PHP for you. Some wait for you to ask. If yours has not updated yet, ask for a date.

Then do two things:

1. Take a backup, and check you can restore it. If the site ran unpatched for days while attackers probed it, a clean copy is your safety net.
2. Watch for scam emails that ride on the news. Expect fake "urgent PHP update" emails. Your host will never ask for your password by email.

Your site is on PHP 8.1 or older.

This is the group the news coverage skips, and it is a big one. W3Techs shows 26.9% of PHP sites on PHP 7, and 7.7% still on PHP 5. That is roughly one in three.

Sites get stuck for a boring reason. Moving from PHP 7 to PHP 8 breaks old plugins and custom code. Someone has to test and fix each one. Often the person who built the site has moved on, so nobody presses the button. Years pass.

The PHP team put it plainly. PHP 8.1 and older "no longer receive updates from the PHP project". They say to ask your vendor whether they have patched it, or upgrade to a supported version.

In plain English, you have three routes.

Ask your host if they have patched your old version. Some have. Linux vendors sometimes patch old versions for their customers. If so, you are safe from this flaw. You are also living on borrowed time, because the next flaw may not get that treatment.

Upgrade PHP and fix what breaks. A developer updates the server, then tests every plugin and every bit of custom code. On a small site this can be quick. On an old site with a pile of plugins, it turns into a long chase. At the end you have the same site, only patched.

Start again. If the site is also slow or dated, this is the moment to fix all of it at once. More on that below.

If nobody can patch it and it must stay online, the NCSC says to check it for a break-in. If you are not confident doing that, get help. Do not leave it.

Fix it, or start again?

This is how we would weigh it up.

If your site is on a supported version and you like it, patch it and move on.

If your site is stuck on old PHP but still brings in work, an upgrade is worth paying for. Get a fixed price before anyone starts.

If it is stuck on old PHP and the phone is not ringing, the flaw has decided for you. Rebuild. You fix the security problem and the enquiry problem in one go.

That second job is what we do. We take dated, slow websites and turn them into fast, modern ones that bring in enquiries. The sites we build now run without PHP, so this flaw does not touch them. You can still edit your own pages and blog. If you would rather keep WordPress, we can do that too, and plan how to keep it up to date.

Midland Oil Group came to us with a site that took more than 8 seconds to load. The rebuilt site loads in 1.2 seconds, and enquiries tripled in the first month.

Talk to us about your site. Send your web address and what your host told you. We will say plainly whether a fix or a rebuild makes sense. The first conversation is free. One of us will get back to you the same day, or the next working day at the latest.

Common questions.

How will I know if my website has PHP?

Ask whoever hosts it. That is the only sure way. If you want a quick guess first, WordPress always uses PHP, and pages ending in .php always use PHP. Wix, Squarespace and Shopify sites do not need you to do anything.

I use WordPress. Am I affected?

Yes, unless your host has already moved you to a fixed version. WordPress itself is fine. The flaw is in the PHP underneath it. Check your version in Tools, then Site Health, then Info, then Server. If you cannot log in, send your host the email above.

Is PHP 7 safe?

No. PHP 7 stopped getting security fixes in November 2022. This flaw affects it, and there is no fixed release to install. If your site is on PHP 7, it needs an upgrade or a rebuild. The same goes for PHP 8.0 and 8.1.

What is PHP2Shell?

It is the name the researchers gave to the two bugs together. Their official names are CVE-2026-109618 and CVE-2026-109619. If a host or a developer uses any of those names, they mean this flaw.

The person who built my site has gone. What now?

You are not alone, and this is the most common reason sites stay on old versions. Start with your host, because they can tell you the PHP version without the developer. If the host cannot update it, send us the web address. We will tell you what you have and what your options are.

Are my customers at risk when they visit my site?

Visiting a site does not harm their phone or laptop. The risk is the other way round. If an attacker gets into your server, they can take what is stored there. That means names, emails and addresses from your contact forms or orders.

How would I know if my site has already been hacked?

You often would not, which is why your host should check the server. Warning signs an owner can spot:

• Pages or links you did not add.
• New admin users you do not recognise.
• The site going down or showing errors this week.
• A "this site may be hacked" line under your site in Google.

If you see any of these, tell your host today.

Can I just switch the site off for now?

Yes. The NCSC gave the same advice to organisations that could not update in time. Ask your host to show a holding page with your phone number and email. A few days with a holding page is better than a break-in.

Do I need to tell anyone?

If a break-in exposed customer data, you may have to tell the ICO. UK law gives you 72 hours where there is a risk to people. The ICO's report a breach page explains when and how. Tell your insurer early too, if you have cyber cover.

Will this hurt my Google ranking?

A patched site is not affected. A hacked site can be. Google can mark hacked pages in its results, and it may drop them until the site is cleaned up. One more reason to check today rather than next month.

Should I move off WordPress?

Not because of this on its own. A WordPress site on supported PHP, with a host who updates it, is in the same boat as any other. The sites in trouble are the ones nobody looks after. If yours is one of those, and it is also slow or dated, a rebuild makes sense. If it works well, keep it and keep it updated.

How do I stop this happening again?

Four habits cover most of it:

• Know who updates PHP on your site: your host, your developer or you. If the answer is "nobody", that is the problem to fix first.
• Pick hosting that updates PHP for you and tells you when it does. Many managed hosts do this.
• Keep PHP on a supported version. PHP 8.2 stops getting fixes on 31 December 2026. If you are on 8.2 today, you will need to move again before the year is out.
• Remove plugins and themes you no longer use. Each one is something else to keep updated.

Or choose a site that does not run PHP at all. The sites we build now work that way, and you still edit your own pages and blog.

What we checked, and when.

The facts in this guide were checked on 23 October 2026 against:

• PHP's security advisory, 21 October 2026
• The NCSC alert, Critical security issue affecting PHP, 21 October 2026
• Wiz Research's write-up of how the flaws were found
• W3Techs usage figures for PHP, 23 October 2026
• Reports of UK council and police sites going offline, 21 October 2026
• The ICO's guidance on reporting a breach

We will update this page if the advice changes.