Two Critical PHP Vulnerabilities Could Put Your WordPress Website, Customer Data and Business at Risk, Even If Everything Appears to Be Working Normally.
Two critical security vulnerabilities have been discovered in PHP, the technology that powers WordPress. Emergency security updates have been released, and website owners are being urged to act quickly. But what exactly has happened, how serious is the threat and what does it mean for your business website?
On 21 October 2026, the PHP development team released emergency fixes for two major security vulnerabilities, collectively known as PHP2Shell.
Both vulnerabilities have received a critical security severity rating of 9.2 out of 10. They could potentially allow criminals to run malicious code on vulnerable website servers without needing a username or password.
The discovery has prompted urgent warnings from cybersecurity organisations, including the UK’s National Cyber Security Centre (NCSC). Some government websites and other major online services were temporarily taken offline as a precaution.
And while the headlines have focused on large organisations, smaller businesses shouldn’t assume they’re safe.
Millions of websites use PHP, including those built with WordPress. If your website is running an affected version that hasn’t been patched, it could be exposed to attack.
Perhaps most worrying of all, your website could be vulnerable even if it appears to be working perfectly normally.
What Is PHP and Why Does WordPress Use It?
PHP is a programming language that works behind the scenes on websites.
If you own a WordPress website, PHP helps make almost everything happen. It processes information, generates pages, handles forms, connects to databases and supports much of your website’s functionality.
Most business owners never need to think about PHP. It’s usually managed through their website hosting provider, and when everything is working properly, there’s little reason to give it much attention.
Unfortunately, this also means that many website owners have no idea which version of PHP their website is running, whether it’s still supported or whether important security updates have been installed.
That’s what makes this latest discovery particularly concerning.
What Exactly Is the New PHP Security Vulnerability?
Security researchers have identified two serious weaknesses in PHP itself, rather than in WordPress or a particular plugin.
The vulnerabilities have been officially identified as:
- CVE-2026-109618: A memory corruption vulnerability that could allow attackers to execute malicious code on a vulnerable server.
- CVE-2026-109619: A vulnerability involving how PHP handles information in memory, potentially allowing attackers to access sensitive information or execute code.
Both have been rated critical.
In simple terms, these weaknesses could allow someone to interfere with the server running your website without having legitimate access to it.
This is particularly serious because the vulnerabilities exist within the underlying technology.
Updating WordPress, changing your password or installing a security plugin doesn’t necessarily resolve the problem.
The PHP software itself needs to be properly patched.
For a more detailed technical explanation, see the NHS England PHP2Shell cybersecurity advisory.
What Could Hackers Do to a Vulnerable WordPress Website?
The potential consequences depend on the website, its hosting environment and the level of access an attacker manages to obtain.
However, successful exploitation could potentially allow criminals to:
- Steal sensitive information: Customer details, website data and other information stored on the server could be exposed.
- Install malicious software: Hackers could introduce files or programs designed to maintain unauthorised access.
- Redirect website visitors: Customers could be sent to fraudulent websites, phishing pages or other dangerous destinations.
- Modify website content: Attackers could insert spam, unwanted links or malicious scripts into your pages.
- Disrupt your business: Your website could become unavailable, preventing customers from contacting you, making enquiries or purchasing products.
- Use your website for further attacks: A compromised server could potentially be used to carry out other malicious activity.
For a small business, even a temporary website outage can be expensive.
Lost enquiries, interrupted sales and damage to customer confidence can quickly become a much bigger problem than the original security issue.
There are also potential consequences for your visibility on Google. If a compromised website begins distributing malware or directing visitors to dangerous content, Google may display security warnings or restrict access to affected pages.
A security problem can therefore become a business problem and an SEO problem.
As I explain in my guide to improving your website’s SEO, technical website health is an important foundation for attracting visitors and turning them into customers.
Your WordPress Website Could Be Vulnerable Without You Knowing
One of the most dangerous assumptions website owners make is that everything must be secure because their website is still working.
Unfortunately, that isn’t how website security works.
Your homepage could load normally. Your contact forms could still send emails. Your online shop could continue processing orders.
None of these things proves your website is safe.
Some attacks are immediately obvious. Others can go unnoticed while malicious code, unauthorised access or stolen information remain hidden.
And in the case of these PHP vulnerabilities, a website doesn’t have to be visibly broken to be exposed.
That’s why checking whether your website is running vulnerable software is so important.
The absence of problems isn’t evidence that the necessary security updates have been applied.
If you’re unsure whether your website is protected, I can help you investigate your WordPress website and establish what needs attention.
Why Is This PHP Vulnerability Being Taken So Seriously?
There are several reasons why the discovery has caused such widespread concern.
Firstly, PHP is used by an enormous number of websites around the world. The potential number of affected systems is therefore substantial.
Secondly, these vulnerabilities could potentially be exploited remotely, without an attacker needing a valid website login.
Thirdly, security researchers have demonstrated ways of exploiting the weaknesses, meaning the threat isn’t purely theoretical.
There have also been reports of attempted exploitation following the disclosure.
The National Cyber Security Centre has advised organisations to take immediate action, identify their PHP systems and apply security updates.
Where immediate fixes aren’t possible, it has even advised organisations to consider taking affected systems offline until they can be properly protected.
That’s an unusually strong warning and one that website owners should take seriously.
However, it’s important to distinguish between websites being vulnerable, attempted attacks and confirmed successful compromises. Not every website running PHP has been hacked.
Which WordPress Websites Are Affected?
The problem isn’t limited to a particular WordPress theme, plugin or website type.
It affects vulnerable versions of PHP running on website servers.
Emergency fixes were released on 21 October 2026 for the following supported PHP branches:
PHP Branch Security-Fixed Version
PHP 8.2 8.2.35
PHP 8.3 8.3.36
PHP 8.4 8.4.27
PHP 8.5 8.5.12
Earlier releases within these branches are affected unless the hosting provider has applied an equivalent security fix.
Websites using PHP 8.1 or older face an additional concern because those versions no longer receive normal security updates from the PHP development team. Some specialist hosting and software vendors may provide independently maintained security fixes.
You can find the official releases in the PHP development team’s release archive.
Not every WordPress website is currently vulnerable. Some hosting providers have already deployed fixes, and some managed hosting platforms have confirmed that their customers are protected.
But if you don’t know which PHP version your website uses or whether your hosting provider has applied the updates, you cannot confidently establish your security status.
And that’s something worth finding out sooner rather than later.
Won’t My Hosting Company Fix This Automatically?
Possibly, but you shouldn’t simply assume they have.
Some managed WordPress hosting providers take responsibility for maintaining PHP and applying critical security updates.
Other hosting companies allow customers to select and manage their own PHP versions.
Some may automatically install security patches, while others may require action from the website owner.
There can also be differences between the PHP version advertised in a hosting control panel and the actual security updates applied to the server.
The important thing is to establish what your hosting provider has done, whether your particular website is protected and whether any further work is required.
If you manage several websites under one hosting account, it’s also worth checking each installation rather than assuming they’re all running the same configuration.
Does Updating WordPress Fix the Problem?
Unfortunately, no.
WordPress and PHP are separate pieces of software.
WordPress is the content management system you use to manage your website. PHP is part of the underlying technology that allows WordPress to operate.
You could have the latest WordPress version, fully updated plugins and a modern website design while still running a vulnerable PHP installation.
Likewise, having an SSL certificate, a secure password or a WordPress security plugin doesn’t automatically protect you against these particular weaknesses.
These are all useful security measures, but they don’t replace the need for patched PHP software.
Security company Cloudflare has deployed additional protections against PHP2Shell, but it also stresses that website operators still need to apply the PHP security updates.
Can the PHP Security Vulnerability Be Fixed?
Yes. The PHP development team has released emergency security updates to address both vulnerabilities.
For affected websites, the essential solution is to ensure the server is running an appropriately patched PHP version.
However, updating PHP isn’t always straightforward, particularly on older WordPress websites.
Some themes, plugins and custom website functionality may not be compatible with newer PHP versions.
Changing PHP without checking compatibility could cause parts of a website to stop functioning, generate errors or even prevent the entire website from loading.
That’s why a proper assessment should involve more than simply changing a setting in the hosting control panel.
Depending on the website, it may be necessary to review compatibility, take suitable backups, coordinate updates with the hosting provider and test the website afterwards.
It’s also important to distinguish between fixing a vulnerability and investigating an existing compromise.
Installing a security patch closes the known weakness, but it doesn’t automatically remove malicious software or unauthorised access that may already exist.
What Should WordPress Website Owners Do Now?
The first priority is to establish whether your website is running a vulnerable PHP installation.
That means identifying the PHP version, confirming whether the appropriate security updates have been applied and understanding how your hosting provider manages PHP security.
If your website is affected, the necessary updates should be treated as urgent.
It’s also sensible to review your website for signs of suspicious activity, particularly if it has been running vulnerable software since details of the weaknesses became public.
For websites with older themes, plugins or custom functionality, compatibility needs to be considered before making major changes.
And if your hosting provider cannot supply the necessary fixes promptly, you may need to consider additional protective measures while a permanent solution is arranged.
The Dutch National Cyber Security Centre maintains technical guidance on PHP2Shell, including affected systems and recommended action.
The important thing is not to ignore the problem or assume someone else has already dealt with it.
How UK SEO Coach Can Help Protect Your WordPress Website
I’m Enrico, the person behind UK SEO Coach.
I’ve spent nearly 20 years working with websites, helping businesses improve their online visibility, resolve technical problems and keep their websites functioning properly.
Although SEO is a major part of my work, website performance, hosting, technical maintenance and security are closely connected.
Following the discovery of these PHP vulnerabilities, I’m helping WordPress website owners understand whether their websites are affected and what action they need to take.
I can help investigate your website’s PHP installation, check whether the necessary security updates have been applied, identify potential compatibility issues and assist with the work needed to bring your website up to date.
Where there are signs of a more serious security problem, I can also help establish what further investigation or specialist assistance may be required.
You won’t get an unnecessarily complicated technical explanation.
I’ll explain what I find, what it means for your business and what needs to happen next.
And if your website is already protected against these particular vulnerabilities, I’ll tell you.
You can read more about my experience or explore my WordPress website services.
