Website hacked? Incident response for site owners

Incident response is the work between "something looks wrong" and "the site is back and stays back". It covers what to write down, what to keep, who must be told and how to close the way in that was used. The order matters, and a rushed cleanup is the usual reason sites get hit twice.

What matters right now

• PHP2Shell (CVE-2026-109618 and CVE-2026-109619) was disclosed on 21 October 2026. The PHP project notice lists the fixed releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35. AWS reports honeypot attempts from 17 October, so a patch applied now does not tell you what happened before it.
• The UK NCSC advises that systems which could not be updated at once should be assessed for compromise, with backdoors checked for, before patching.
• If personal data of people in the EU is likely at risk, GDPR Article 33 expects notice to the regulator within 72 hours of becoming aware, where feasible. US rules depend on state and sector, and the FTC guide is the usual starting point.
• A restored backup can carry the backdoor with it. WordPress.org's hacked-site guide says to find and close the entry point as well as clean the files.

Where to start

• If you have just found the problem, start with the full website incident response plan.
• If you run a small business and need an hour-by-hour list, read what to do in the first 24 hours.
• If you cannot sign in to WordPress, see getting back into wp-admin without destroying evidence.
• If you run PHP and patched after 17 October, follow the PHP2Shell indicators to check.
• If cleanup keeps failing, read why WordPress malware keeps coming back.
• If you plan to restore, use how to choose a clean restore point.
• If customers may be affected, copy the breach email templates.
• If you are weighing professional help, compare one-time, annual and DIY cleanup costs.
• If PHP2Shell is the trigger, the shortest path is the 10-minute PHP2Shell response.

The free Red scan reads the stack your site serves and matches each version to known vulnerabilities. It can say a version is affected. It cannot tell you whether you were already compromised.