What the PHP2Shell vulnerability means for your small business website

Last updated:

Oct 28 2026

First published:

Oct 28 2026

If your website runs on WordPress, it runs on PHP. On October 21, 2026, PHP released an emergency fix for two critical flaws that let an attacker take control of a web server without logging in. The fix is a PHP update, and updating your plugins or theme won’t cover it.

For every site on a Studio Clvr maintenance plan, that update was done within three hours of release. Nobody had to email me, and no client site went offline. If you don’t know who updates PHP on your own site, that’s the question worth answering this week.

What happened

The PHP team gave one day’s notice, then shipped patched versions (8.5.12, 8.4.27, 8.3.36, and 8.2.35) on October 21 at 10am ET (9am CT, 7am PT), which was 1am on October 22 in Sydney. Both flaws are rated 9.2 out of 10 for severity. The pair has been nicknamed PHP2Shell.

Here’s what that means for you: an attacker (likely an AI bot engineered by a malicious human) sends one crafted request to your site and ends up able to run their own code on your server. From there they can pull customer data or plant malware. The PHP project didn’t soften it: “There are no complete mitigations, updating is the only safe choice.”

Part of why this got so much airtime is how it was found. Researchers used AI tools from OpenAI and Google to confirm a flaw that had been sitting in PHP since around 2012. OpenAI called it “one of the most impactful security issues in recent memory,” and warned that the same tools that help defenders find bugs can help attackers exploit them just as fast.

How many websites this affected

Roughly seven in 10. PHP runs about 70% of the world’s websites, and W3Techs puts it closer to 75% of sites where the server language can be identified. WordPress alone accounts for about 43% of all websites.

Palo Alto Networks counted more than 22.6 million potentially vulnerable servers online. That’s servers, not unique websites, and not confirmed breaches. It’s still a very large number.

Attackers moved fast. Cloudflare CEO Matthew Prince said his network saw thousands of attempts in the 10 hours before the announcement, tens of thousands in the 45 minutes after, and millions by the end of the day. Cloudflare’s CTO, Dane Knecht, said attacks were already underway, and the company rolled out stopgap protections for some customers. Amazon Web Services said it saw what looked like exploit attempts as early as October 17, four days before anyone announced anything.

Who went offline

Some of the biggest organizations in the world chose to switch their sites off rather than risk it. In the US, the National Security Agency told organizations to patch immediately or take their systems offline until they could. In Canada, some federal government websites were taken offline as a precaution, and some UK government services were disrupted. In Australia, the national cyber security agency’s own site, cyber.gov.au, was among several government websites that went down while the fix was applied. Government sites across Europe and Japan were also pulled, along with banking, airline, and rail services from Tokyo to Helsinki.

It wasn’t only governments. Wikipedia took some of its systems down until they could be patched, the Internet Archive went briefly offline, and Nintendo pulled services while it dealt with the bugs. Microsoft CEO Satya Nadella summed up the week: “I’ve not seen anything like this in a long, long time.”

Security researcher Troy Hunt, who runs the breach-tracking site Have I Been Pwned, put the choice simply: you either “patch it very, very quickly” or take the site offline. He also warned that we should expect more data breaches in the weeks ahead as a result.

For a consultant or coach, offline means your whole website is down, and your booking page, sales page, and newsletter signup all disappear at once. Usually with no warning to the people trying to reach you.

Why this was a non-event for sites on a maintenance plan

Most WordPress security news is about plugins. A plugin has a hole, you update the plugin, and you’re done. PHP2Shell was different because the hole was in PHP itself, the software that runs underneath WordPress on your server. Updating your content or plugins does nothing here. Someone has to update PHP, or get your host to do it.

This is the gap most small business sites fall into. The owner assumes the developer handles it. The developer finished the build two years ago and assumes the host handles it. The host is fielding thousands of support tickets. Meanwhile, the site sits unpatched while attack attempts climb into the millions.

My WordPress maintenance plans (I call them Clever Care plans) include hosting. That meant there was never a question about whose job this was. Here’s how it went:

October 20: PHP’s advance notice went out. I confirmed which PHP version each site I manage was running and lined up the update.
October 21, 10am ET (9am CT, 7am PT; 1am AEDT, October 22): PHP released the patched versions.
October 21, 10:52am to 12:53pm ET (9:52am to 11:53am CT, 7:52am to 9:53am PT; 1:52am to 3:53am AEDT, October 22): The patched PHP rolled out to every Studio Clvr site. All of them were done within three hours of release.
Each site was checked. Pages loaded, contact forms sent, backups confirmed.

Following the updates, each site was manually checked by me, and audited for errors, new users or added code. All client sites were clean, no client had to do anything, and none of their sites went down.

It’s also the second time this year that this has happened. In July, a flaw called wp2shell hit WordPress core directly, with no plugin involved. Studio Clvr client sites were patched the same day.

The honest downside

A maintenance plan isn’t a force field. A patch closes the door, but it doesn’t undo anything that got through before it was applied, which is why I also scanned each site for unfamiliar files and admin accounts after the update.

Staying online during those three hours was a judgment call. The official advice was to take a site offline if you couldn’t patch right away. We could, so client sites stayed up, and the audit afterward is how I checked nothing got in during that window.

And if attackers find a flaw before anyone else does, which AWS’s October 17 sighting suggests happened here, no plan stops that. What a plan buys you is speed, plus a person whose job it is to notice.

If your host updates PHP promptly and you’re comfortable checking your own site after news like this, you may not need a maintenance plan. Plenty of people manage fine on their own.

What to do if your site isn’t on a plan

Check your PHP version. In WordPress, go to Tools, then Site Health, then the Info tab, then Server. You need 8.5.12, 8.4.27, 8.3.36, 8.2.35, or later.
If it’s lower, contact your host today. Ask when they’re updating. If they can’t give you a date, that tells you something.
If you can’t update today, take the site offline until you can. That’s the NSA’s advice too. A WordPress maintenance-mode plugin isn’t enough here, because PHP still handles every request in the background, and that’s where the flaw is. Ask your host to take the site offline, or put a static holding page in front of it with a service like Cloudflare. A day offline costs you some bookings. A breach costs a lot more.
If you’re on PHP 8.1 or older, there’s no patch at all. Fixes were only released for 8.2 through 8.5. Moving up a version can break older themes and plugins, so test on a staging copy of your website first or get help.

If you’d rather hand this to someone, my website maintenance plans start at A$150 per month (approx. US$100) and include hosting, premium theme and plugin license coverage, software updates, backups, incident response, and a monthly check to make sure everything still works.

All prices are in Australian dollars. USD figures are a guide only and move with the exchange rate.

Sources

Hand off the next security update

My website maintenance plans cover hosting, updates, backups, and a monthly check that everything still works. When the next PHP2Shell lands, it’s my job to patch it, not yours. Plans start at A$150 per month (approx. US$100).

See the clever care plan →

Written by:
Nicole Sidoti