If you’ve seen scary headlines about something called “PHP2Shell” this week and felt a slight wobble, don’t worry, I’ve got you covered 😊
What’s PHP, and why should I care?
PHP is the engine that powers WordPress and Drupal, and a huge chunk of the internet besides. According to W3Techs, it runs on nearly 70% of websites where the server-side language is known.
Most security scares involve a single plugin or theme. Think of that as a dodgy lock on one door. This one was different: the problem was in the foundations of the building itself.
So what happened?
On 21 October, PHP released emergency fixes for two critical security holes, CVE-2026-109618 and CVE-2026-109619. Both were rated 9.2 out of 10 for severity. Not ideal!
In plain English, the holes could let an attacker run their own code on a web server without ever needing to log in. Even worse, details leaked online the day before the fix was ready, so the race was on.
What we did about it
We had protective changes in place across our servers at around 9am on the 21st. That was before an official fix even existed.
When PHP released the full update later that afternoon, we installed it straight away.
If we host your website, you don’t need to do a thing. Put the kettle on ☕
Hosted somewhere else?
If your site lives with another host, it’s worth checking:
- Ask your host whether they’ve updated to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12
- Check it yourself in WordPress under Tools → Site Health → Info → Server
- Still on PHP 8.1 or older? It won’t be getting a fix, so it really is time for an upgrade
A gentle reminder
Behind-the-scenes security like this is one of those things you hopefully never notice. That’s rather the point! Strong logins matter too, so if you missed it, have a read of why you should use Bitwarden and 2FA.
Any questions, just drop me a line 👍
