As of October 27, 2026, attackers are exploiting two critical PHP flaws nicknamed PHP2Shell, according to CISA. If your Battle Creek or Kalamazoo business website runs on WordPress or other PHP software, your host needs to be on a fixed PHP version. One question to your host this week gets you the answer.
What is PHP2Shell?
PHP2Shell is the nickname news coverage gave two PHP bugs (The Hacker News), CVE-2026-109618 and CVE-2026-109619, that can let an attacker run code on a web server without logging in. The PHP project says the fixed releases "fix two critical vulnerabilities that can allow unauthenticated remote code execution" (PHP.net security advisory, October 21, 2026). One bug involves out-of-memory handling. The other lets leftover request data get reused by a later request on the same worker.
Is PHP2Shell being exploited right now?
Yes, as of October 27, 2026. CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog on October 26, 2026 (CISA alert). CISA's catalog is a list of flaws attackers are using in real attacks. The PHP project calls the risk highest for mod_php, where an unauthenticated request can trigger the attack before any of your site's code runs (PHP.net).
Does this affect my business website?
It does if your site runs on PHP. WordPress runs on PHP, and so do many contractor and shop sites, quote forms and booking plugins. The PHP project says all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed (PHP.net). Sites on a hosted builder like Wix or Squarespace aren't running your own PHP, so the host handles it. If you're not sure which you have, that's the first thing to find out.
What should I do this week?
Get your site onto a fixed PHP version. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP project says that "only an update is a complete solution," since its stopgap settings "do not make an installation safe" (PHP.net). Here's what I'd do:
- Ask your host or web provider. Send this: "Is our site running PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer, or the vendor's patched build? Please confirm in writing."
- Check the version yourself if you can. In WordPress, open Tools, then Site Health, then Info, then Server, and read the PHP version. Linux hosts often patch PHP under their own version numbers, so ask your host before you panic over a number.
- Don't skip it for an old site. PHP 8.1 and older no longer get updates from the PHP project, though the team made minimal backports for PHP 7.4, 8.0 and 8.1 (PHP.net). Ask whether your host applied them.
- Plan the upgrade if you're on 8.2. PHP 8.2 reaches end of life on December 31, 2026 and gets no security fixes after that (PHP supported versions).
Do Windows servers need anything extra?
Yes, if your PHP runs on Windows. On October 26, 2026, the PHP team released rebuilt Windows packages (PHP 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1) with a Brotli fix for CVE-2026-111497, an out-of-bounds write (PHP.net). The decoder can be reached through the cURL extension when automatic response decompression is on. PHP says that's off by default in cURL, but apps and libraries can turn it on. Most small sites run on Linux hosting, so this likely won't apply to you.
How do I know if my site was already hit?
I can't tell you from outside, and I won't guess. Ask your host to check for PHP files that changed since October 21, 2026, for admin accounts you didn't create, and for unfamiliar scheduled jobs. If anything looks wrong, change your admin and hosting passwords and have your provider restore from a clean backup. A site that's patched today may still have been touched before the patch.
Who can help me check?
Start with whoever hosts your site and send them the question above. If nobody owns that for your business, that's the real gap. I can look at your web presence and tell you who's responsible for what. My notes on what a contractor website needs and on builders versus a site made for search explain how the pieces fit. If your email setup has the same ownership gap, a quick audit covers that too.