PHP2Shell, explained for business owners

If you own a small business, you probably heard some version of this in late October: a huge security hole, websites going offline, government warnings. Then you got back to running your business, because nobody explained what any of it meant for you. This is that explanation.

What actually happened

On October 21, 2026, the PHP project disclosed two critical security flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell. PHP is the programming language behind a huge share of the web. Every WordPress site runs on it, and so do many booking systems, contact forms, and online stores.

The flaws were serious enough that government agencies, including the NSA, publicly urged every organization using PHP to apply the update immediately. The NSA's advisory went a step further: if you cannot update right away, take the affected system offline until it is fully mitigated. When a government agency tells businesses that offline is safer than unpatched, that is not routine language.

Some very large operations took that advice literally. Wikimedia services, Archive.org, and 4chan all went temporarily offline that week to patch.

One more detail worth knowing: the fix did not come together overnight. PHP's maintainers reportedly spent about two months coordinating it privately with security teams at companies including OpenAI, Cloudflare, and Wiz before the public disclosure, so patched versions were ready on day one.

What did not happen

Here is the part the scary posts leave out: as of the disclosure, widespread exploitation had not been confirmed. Nobody has shown waves of small-business sites being broken into through PHP2Shell. Social posts claiming this was part of some historic pile-up of incidents are, at best, unverified.

So the honest framing is this: the urgency is patching, not panic. A flaw this serious gets reverse-engineered quickly once the fix is public, which means the window between "patch available" and "attacks begin" is short. The businesses that get hurt by disclosures like this are almost never the ones who patched that week. They are the ones who never heard about it, or had nobody responsible for acting on it.

Does this affect your business?

Ask one question: does your website run PHP? If your site is WordPress, the answer is yes. If it was built by a local web shop more than a few years ago, the answer is very likely yes.

The good news: you almost certainly do not run PHP yourself. Your hosting company does, and the major managed hosts patched quickly. The sites where PHP2Shell lingers are the ones on old shared hosting plans, or on a server a contractor set up years ago and nobody has touched since.

What to do this week

• Find out what your website runs. If nobody at your business can answer this, that is finding number one, and it matters beyond this incident.
• Email your host one question. Something like: "Is the server my site runs on updated with the October 21, 2026 PHP security release (the PHP2Shell fix)?" A good host answers in one reply.
• If you run your own server, or a contractor does, get it updated now. The NSA's guidance applies: unpatched and online is the one combination to avoid.
• While you are in there, update WordPress core, your theme, and your plugins. The same neglect that leaves PHP outdated usually leaves those outdated too.
• Write down who is responsible for doing this next time. There will be a next time; that is just how software works.

The bigger picture

PHP2Shell is a loud example of a quiet rule: websites are not finished products, they are running systems. The language under your site, the plugins on top of it, and the server it lives on all need someone paying attention. Most small-business sites were built once and then left alone, and automated scanning tools probe the entire internet for exactly those.

We published a more technical briefing on this incident, including how to tell which PHP versions predate the fix, in our PHP2Shell security briefing. The wider October 2026 roundup, covering the WordPress and GitLab incidents from the same stretch, is in our security briefings hub.

The takeaway is simple: this was a serious flaw, handled well by the people who maintain PHP, and the fix has existed since day one. The only question that matters for your business is whether anyone applied it to your site. If you know the answer, you are ahead of most. If you do not, finding out takes one email, and it is worth sending today.