Is my website affected by the PHP vulnerability?

The short answer

If your website runs on WordPress, or anything else built on PHP, it is affected until your host updates PHP. That is a lot of small business websites. This is serious but fixable: updating PHP is a routine job for a host. If your site is on Squarespace, Wix or Shopify, you do not run the servers yourself. And any site we have built that is live today does not run on PHP, so this flaw does not apply to it.

What happened, in plain English

PHP is the software that runs underneath many small business websites, including every WordPress site. On October 21, 2026, the people who make PHP released an urgent fix for two serious security holes. News outlets are calling them “PHP2Shell” (their official numbers are CVE-2026-109618 and CVE-2026-109619). They can let someone take over a website from the internet without needing a password. According to Check Point, details leaked online before the fix was ready.

PHP's own advisory says: “All PHP users are strongly encouraged to update immediately.” The FBI's Cyber Division posted the same day, telling site owners to update, to take a site offline if it cannot be updated right away, and to report any break-in.

Who is affected

Any website that runs PHP to serve its pages, until PHP is updated. In practice that means WordPress sites (the most common kind by far), Joomla, Drupal and Magento sites, and many sites on budget shared hosting. It does not matter whether your site takes payments or just shows your phone number: PHP's warning covers every installation that serves web pages.

Who is not affected

Sites on hosted builders like Squarespace, Wix and Shopify are not run by you. Those companies manage their own servers; we have not seen a statement from them about this flaw, so watch their announcements or ask their support. Sites that do not use PHP at all are not affected either. Every site we make is a simple set of finished pages with no WordPress and no PHP running behind it; we checked every one of our clients' live sites on October 20, 2026.

What to do today

1. Find out what your site runs onIf your website address followed by /wp-admin shows a login page, your site is WordPress, and WordPress runs on PHP. Joomla, Drupal and Magento sites run on PHP too. If you are not sure, ask whoever built it or check your hosting account.
2. Ask your host or web person one question today“Is our PHP updated to 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer?” Those are the fixed versions. Your host's control panel often shows your PHP version; if you cannot find it, just send them this question. If you do not know who your host is, look up who you pay for hosting and call their support.
3. If you are on PHP 8.1 or older, ask what happens nextPHP no longer fixes 8.1 or older. Some hosts patch old versions themselves, so ask yours for a clear yes or no. If they do not, the site needs moving to a supported version.
4. If nobody looks after your site, take it offline for nowThe FBI's advice is to take a site offline if it cannot be updated right away. Call your host first: many can update quickly, and taking the site down is the fallback, not the first move.

What not to do

1. Don't assume a WordPress update fixes itThe flaws are in PHP itself, underneath WordPress. Updating WordPress or your plugins is good practice, but it does not fix this. Only the PHP update does.
2. Don't click “free checker” tools or exploit links from social mediaPlenty of links go around after news like this. Some are real, some are not. Your host can tell you your PHP version without any outside tool.
3. Don't hand your login to a stranger who emails about itScammers follow the news. If someone you have never worked with offers to fix it, do not send passwords. Go through the host or web person you already know.
4. Don't panic and delete your siteUpdating PHP is a routine job for a host. Your pages and your Google listing do not need to go anywhere, though ask your host to check the site still works after the update.

Why we don't build on WordPress

Mike's Plumbing in Tacoma came to us after his old WordPress site was hacked through a hidden fake plugin, and Google started warning visitors away from it. We rebuilt it without WordPress, and the warning came off the day it went live (his story). Fewer moving parts means fewer ways in, and far less to patch at short notice.

Common questions

Sources

Read on October 21, 2026. PHP security advisory, php.net news archive (fixed versions, the update advice, PHP 8.1 and older no longer fixed). FBI Cyber Division warning, October 21, 2026. Not sure where your site stands? Our free website check will tell you what it runs on.