Why PHP sites are being targeted in 2026, and what to do
Two critical PHP vulnerabilities were patched in October 2026. What happened, who it affects and the steps to take, in plain English.
Nikolas Gannon · · 2 min read · Systems and security
In October 2026, two critical vulnerabilities were disclosed in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619 and known together as PHP2Shell. On a server that has not been updated, they let someone run their own code on the site without logging in. The PHP team released patches on 21 October, and exploitation has been reported since.
If your site runs PHP, the good news is that the fix is an update. Many managed hosts will apply it for you, so the first step is often a quick email to your host.
Why this one gets attention
Most website vulnerabilities live in a single plugin or theme. This one is in PHP, the language a lot of traditional websites run on. That is why so many applications were affected at once, including WordPress, Drupal, Joomla, Magento, Laravel, Symfony, phpMyAdmin and Nextcloud.
What to do this week
- Find out which PHP version your site runs. Your hosting dashboard usually shows it, or your host can tell you.
- Update to a fixed version: PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer.
- Update your CMS, plugins and themes.
- Have a look for unexpected files, admin users you do not recognise or unusual server load. Signs your PHP website has been hacked walks through the checks.
Once that is done, a patched PHP site is in a reasonable position. The work from here is keeping it updated.
A longer-term option
Some businesses will look at this and decide they would rather not run PHP at all. A static site is one way to do that. It is a folder of files served from a CDN, so there is no PHP layer to patch.
It is not right for everyone, and it does not remove every risk. You still need to look after your domain, your hosting account logins and any form or booking services connected to the site. What it does remove is the server-side software that needed this week’s update.
If you are not sure what your site runs or what to do next, I do free audits. We can work out whether patching and regular updates are enough for you, or whether a rebuild is worth considering.
Free resource: Website security check
Free resource: Website health check
Read next: Moving off PHP: your static site checklist · What a small business automation consultant costs · WordPress vs static site for small business
Questions
What is PHP2Shell?
PHP2Shell is the name for two critical vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619. On an unpatched server they let someone run code on the site without logging in.
Which sites are affected?
Sites running an unpatched version of PHP. That includes WordPress, Drupal, Joomla, Magento, Laravel, Symfony and many other applications.
How do I protect my site?
Update PHP to a fixed version, keep your CMS and plugins current, and check for signs of compromise. Most hosts can help with all three.