Website security, explained for the people who have to fix it.

Start here

Three things to do this week, in order.

1. 1. Find outWhich runtimes serve your sites, which versions, and whether any of this week's incidents touch them.
2. 2. Ask the right questionYour host or your team needs one exact question: is the runtime serving this domain patched, and have its workers restarted?
3. 3. Confirm, then look backProve the fix on the running service, then check whether anything got in before the patch.

Run the free scan on your domain to see which technologies and versions your site serves from outside.

October 2026 incidents

The tracker, the checklist, and why so much broke at once. All october 2026 incidents guides

• October 2026 Security Checklist: What to Do This WeekOctober 2026 security checklist by role: website owners, agencies, server teams and AI tooling. Tick-off lists, fixed versions, and the exact question for your host.
• October 2026 Security Incidents: Every One, TrackedOctober 2026 cyber incidents in one table: PHP2Shell, GitLab, LiteLLM, Railway, Zeabur and more, with fixed version, required action, status and source.

PHP2Shell

The PHP core RCE: versions, fixes, hosts, stacks, and how to confirm the running service is patched. All php2shell guides

• Is PHP2Shell being exploited? Attempts vs compromiseIs PHP2Shell being exploited? AWS and watchTowr report honeypot attempts, Cloudflare reports attack traffic on its customers. No source names a hacked site.
• PHP2Shell checker: what a check can and can't confirmIs my site vulnerable to PHP2Shell? A checker sees a banner, not a patch. What it can confirm, why version numbers mislead, and how to get proof from your host.
• PHP2Shell fixed versions: every PHP branch, one tablePHP2Shell fixed version for PHP 8.5, 8.4, 8.3 and 8.2, plus what to do on 8.1 and older. The branch table with distro backports, checked 24 October 2026.
• PHP2Shell fix: patch PHP, restart workers, verify it ranPHP2Shell fix steps per channel: Debian, Ubuntu, RHEL, Alpine, cPanel, Docker, Heroku. Update the package, restart the workers, then verify the running service.
• PHP2Shell for Small Business: A 10-Minute Plain PlanPHP2Shell is a flaw in PHP, the software behind most websites. Ten minutes, one question for your host, and what the answer means. No jargon.
• PHP2Shell: affected versions, fixes, and what to do nowPHP2Shell (CVE-2026-109618/109619) is an unauthenticated RCE in PHP core. Fixed versions, who is affected, and how to confirm the PHP serving your site is patched.

Is my host patched?

One page per hosting provider: their dated status, what to ask support, and how to confirm it yourself. All is my host patched? guides

• PHP2Shell on shared hosting: what to ask your hostOn shared hosting your provider patches PHP, not you. The exact question to send, an email template, what each reply means, and 12 hosts' dated status.

Other incidents

GitLab, LiteLLM, Railway, TiDB Cloud, Zeabur, Node.js, Plex, Tor, eMudhra, SafePay. All other incidents guides

• GitLab CVE-2026-110264: CVSS 10.0 RCE and fixed versionsGitLab CVE-2026-110264 is a CVSS 10.0 unauthenticated RCE in self-managed GitLab. Fixed versions for every release line, who is in scope, and how to upgrade.
• Node.js security update: 10 CVEs, Brotli RCE, fixed versionsNode.js security update 2026: Brotli RCE CVE-2026-111497 plus nine more CVEs, fixed in 22.23.4, 24.22.1 and 26.12.1. Who is affected and how to upgrade.

Landscape and analysis

What the incidents mean for stores, agencies, startups and small businesses. All landscape and analysis guides

• Who patches my website: your host, your agency or you?Who patches my website depends on the layer and your plan. A responsibility matrix for shared, managed, VPS, agency and Shopify sites, with October 2026 as the example.

Website security basics

Hacked signs, checklists, scanning, hardening, who patches what. All website security basics guides

• How to verify a vulnerability is fixed: 5 proofs to ask forHow to verify a patch worked: five pieces of evidence that show a vulnerability is fixed, what each proves, what it misses, and a PHP2Shell worked example.
• What an external website scan can't prove (and what can)Can a website scan prove my site is secure? No. What an outside scan can see, the five things it cannot, and the owner evidence that settles each one.

WordPress

Plugin and theme incidents, hidden admins, cleanup, and the vendor-key problem. All wordpress guides

• WordPress PHP2Shell fix: update PHP, not just WordPressDoes PHP2Shell affect WordPress? Yes, the bug is in PHP, so WordPress updates do not fix it. Get the fixed PHP builds and the exact question to ask your host.

Hosting panels

cPanel, Plesk, CyberPanel, Cloudflare origin exposure. All hosting panels guides

• PHP2Shell on cPanel: find and update PHP per domainPHP2Shell on cPanel: see which PHP each domain runs in MultiPHP Manager or Select PHP Version, update EasyApache, restart PHP-FPM and confirm the fix ran.

Secrets and supply chain

.env exposure, rotation runbooks, npm worms, GitHub Actions. All secrets and supply chain guides

• Rotate secrets after a breach: order, steps and checksHow to rotate secrets after a breach: what to revoke first, why editing a dashboard variable is not rotation, and how to prove it worked. Dated 24 October 2026.

Agencies and MSPs

Many client sites, one incident, shared tools. All agencies and msps guides

• PHP2Shell for agencies: client triage and evidence listPHP2Shell agency response: group client sites by who controls PHP, collect proof for each site, and tell each client what is confirmed and what is not

Incident response

The first 24 hours, clean restores, reinfection, telling customers. All incident response guides

• Was my site exploited via PHP2Shell? Indicators to checkCheck whether PHP2Shell (CVE-2026-109618/109619) hit your site before you patched: the 17 October look-back window, indicators to check, and what to rotate.
• Website Incident Response Plan: What To Do When HackedA website incident response plan for owners: the first hour, what to preserve, who to tell and when, and how to recover without being hacked a second time.