PHP2Shell for Small Business: A 10-Minute Plain Plan

PHP2Shell is a pair of flaws in PHP, the software that runs most websites, including every WordPress and WooCommerce site. The PHP project disclosed them on 21 October 2026. You cannot fix PHP from your dashboard. Your host or server admin does. Your job takes ten minutes: find out if you use PHP, find out who runs it, and send them one question.

Checked on 23 October 2026. The full background on PHP2Shell has the rest of the story.

Minute 1 to 2: Does your site use PHP?

PHP is the language many sites are built in. If your site runs on WordPress or WooCommerce, it uses PHP. There are no exceptions. How the flaw touches a WordPress site has its own page.

For any other site, use this short list:

• Shopify, Wix, Squarespace and Webflow do not run your PHP. The company runs their software for you.
• A site built by an agency or a freelancer may use PHP. Ask them.
• Web addresses ending in .php are a strong hint.
• In WordPress, open Tools, then Site Health, then Info, then Server. It shows the PHP version.

Not sure? Treat it as yes until someone tells you otherwise. Asking costs nothing.

Minute 3 to 4: Who runs your server?

Someone looks after the computer that holds your site. It is one of three people:

1. Your host. You pay a company monthly for hosting. This is the most common case. The host patches PHP.
2. Your agency or freelancer. They manage the server for you. They patch PHP.
3. You. You rented a server (a VPS) and set it up yourself. You patch PHP.

Check your hosting invoice or ask whoever built the site. If it says "managed", someone else handles updates. If it says "VPS" or "cloud server" with no "managed" label, assume it is you. WordPress.org explains that your host controls the PHP version.

Minute 5 to 6: Send the one question

Copy this into an email or a support chat. Put in your own domain.

For [your domain], is the PHP that serves my website patched for CVE-2026-109618 and CVE-2026-109619? Please tell me the fixed PHP version or build name. Please confirm the PHP processes were restarted after the update. Do I need to do anything on my side?

Send it now. Save the reply with its date. If you run the server yourself, the runtime patching steps are on their own page.

Minute 7 to 8: What does the answer mean?

Replies fall into three groups. Sort yours into one.

Minute 9: What should you do while you wait?

Not much. Some of the usual panic moves cause damage.

• Do not take the site offline unless your host or a security professional tells you to. It costs you sales and fixes nothing.
• Do not restore an old backup and call it done. A backup brings back old files. It does not update the PHP on the server. You may also lose recent orders.
• Keep the reply. Save the email or chat transcript with its date. It is your proof.
• Keep working as usual. Check your orders and admin users for anything odd. AWS reported attempts against its test systems from 17 October, four days before the public notice (vendor-claimed, AWS). Neither CVE was in CISA's exploited list at our 22 October check.

What does updating WordPress do about it?

Updating WordPress is still a good habit. It does not fix this flaw.

The flaw is in PHP, the engine under WordPress. A WordPress update changes WordPress, not PHP. Plugin updates are the same. The fix is a patched PHP on the server, plus a restart. That is the host's or admin's job.

Some hosts let you pick a PHP version in your control panel. Picking "8.3" there does not prove you got the fix. The label shows the branch, not the exact build. Ask for the build name. The shared hosting page has more.

Minute 10: When should you call someone?

Call a person, not a chat bot, if any of these is true:

• Your host will not answer after two tries, or only says "you are fine".
• You run a store and take card payments.
• You see a new admin user, or files you do not recognise.
• Your site changed after a host update and now shows errors.
• You run the server yourself and do not know how to update PHP.

Call your host's phone line, your agency, or a freelance system admin. Show them the question and the reply. If you already see signs of a break-in, the first 24 hours checklist is the next step. Store owners can also read the WooCommerce patching steps.

The wider security to-do list for this week covers more than PHP. What the two CVEs actually do and the rest of the PHP2Shell guides go deeper.