PHP2Shell Flaws Are Now Being Exploited: Is Your Site Protected?
PHP recently released an emergency security update for two critical flaws nicknamed “PHP2Shell” by security researchers; attackers are now exploiting them. Every site running on PHP, including WordPress, should be updated now.
Key Takeaways:
- PHP released emergency fixes on 21 October 2026.
- Attackers have now successfully exploited the flaws.
- Updating WordPress will not fix the problem. PHP must be updated.
- The UK’s National Cyber Security Centre (NCSC) has advised immediate action.
What Happened With PHP2Shell?
On 21 October 2026, PHP released an emergency security update for two critical flaws that are now known as PHP2Shell. Both flaws can let hackers run their own code on a server without having login details. The severity of these flaws is rated as 9.2 out of 10. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Amazon’s threat intelligence team spotted an attacker targeting these flaws four days before the fix release. On 26 October 2026, BleepingComputer reported a successful hacker attack, recorded on a security researcher’s honeypot server. On 23 October, PHP also warned of a third, less likely risk that only affects unusual server setups. A fix for this will come in PHP’s next regular release.
Which Websites Are Affected?
Every website that uses PHP to serve its pages, including WordPress sites, is at risk. This flaw is in PHP, not in WordPress or its plugins; just updating WordPress won’t fix it. On a website where you use shared or managed hosting, PHP is controlled by your hosting provider. Websites on an old version of PHP like 8.1 are at high risk, as those old versions no longer receive official updates.
Why It Matters for UK Businesses?
The NCSC has encouraged UK businesses to act immediately. If a hacker attacks your site, they could read your database passwords, change your website files, steal your customer data, or install a hidden backdoor. Hacker attacks are too frequent; Wordfence alone blocked more than 74,000 attack attempts between 20 and 22 October.
There is a legal side too. If customer data is exposed and this is likely to put people at risk, UK GDPR requires you to report the breach to the ICO as soon as possible, and where feasible within 72 hours.
What UK Website Owners Should Do Now
- Check your PHP version: On WordPress, navigate to Tools > Site Health > Info > Server.
- Contact your web host or developer: Ensure that PHP is updated to a patched version and restarted.
- Upgrade outdated versions: If you have PHP 8.1 or older, upgrade to a compatible version. If you have PHP 8.2, plan ahead, since support ends on 31 December 2026.
- Unable to update yet? The NCSC recommends applying temporary fixes first; if that doesn’t work, take the site down until it is sorted.
- If your update was delayed, check your site for any hacking attempts.
Not sure where your website stands? Request a free website audit, and we’ll help you check your setup and update safely.