If you’ve seen the headlines about WordPress websites being at risk, you’ll know that the UK’s National Cyber Security Centre has today advised protecting your website with a PHP update immediately, and if you can’t, it should be taken offline today to protect against critical threat.
Take a breath. Yes, it’s serious, and yes, it needs acting on today. But it’s fixable, and if you’re one of our maintenance clients, we’re already on it.
If you’re not, get in touch with us ASAP:
Not on a Solve maintenance plan? Here’s what to do
- Find out who manages your hosting: That’s the person or company who needs to install the PHP update. It might be your hosting provider, your developer, or you.
- Ask them to update PHP as soon as the fix is out (3pm UK time today) and to confirm when it’s done.
- Check which version of PHP you’re on: If it’s 8.1 or older, you’ll need to upgrade to a supported version, not just patch.
- Steer clear of quick-fix plugins and copy-and-paste code promising to solve it: Updating PHP is the only proper fix.
- Not sure where to start? That’s what we’re here for.
Here’s what’s happened, what it means for your website, and what you should do next.
What’s actually happened and what is PHP2Shell?
Two critical security flaws have been found in PHP, the programming language that WordPress (and a huge chunk of the web) runs on. Some security researchers are calling it “PHP2Shell”.
- The flaws: tracked as CVE-2026-109618 and CVE-2026-109619, both rated critical (9.2 out of 10). In the worst case, they could let an attacker run their own code on a website’s server.
- The leak: details got out on Tuesday 20 October, a day before the planned announcement, which is why it’s all over the news.
- The fix: the PHP security team is releasing an emergency update at 3pm UK time today, Wednesday 21 October. Full details of which versions are affected will be published alongside it.
- The official advice: the UK’s National Cyber Security Centre has told organisations to find any systems running PHP, keep an eye on them, and apply the update as soon as it’s available.
There are early reports of attackers already trying their luck, so this isn’t one to leave. But a fix is arriving today, and that’s the important bit.
Why does this affect WordPress?
Think of WordPress as the car and PHP as part of the engine. The problem isn’t in WordPress itself, or in any plugin or theme. It’s in the engine underneath, which means any site running a vulnerable version of PHP could be exposed, whether it’s built on WordPress, WooCommerce, Drupal, Joomla or something custom.
One thing worth knowing: your usual WordPress auto-updates won’t fix this. WordPress security firm Wordfence has pointed out that the PHP update happens on the server, not inside your WordPress dashboard. So it’s down to whoever looks after your hosting to install it.
Sites running older versions of PHP (8.1 and below) are the biggest worry, as those versions are no longer officially supported and may not get a patch at all.
On a Solve maintenance plan? You don’t need to do anything
If we look after your website, we’re already handling this for you. Our team is working through every site we maintain, checking PHP versions and getting updates applied as soon as the fix is released. Where a site is on an older version of PHP, we’ll be in touch directly about getting it moved somewhere safe.
There’s no need to log in, change anything or call us. If we need anything from you, we’ll get in touch.
Need critical assistance and not sure if your website is protected? Get in touch today.
Whether you need help getting this update applied, want a second pair of eyes on your website’s security, or would like the peace of mind of ongoing maintenance, we can help.
Email [email protected]
Sources
- PHP: Upcoming Critical PHP Security Release
- BBC News
- Patchstack: Major security alert, PHP vulnerable to critical RCE
- LBC: UK cyber chiefs issue urgent warning over critical security flaws
- NCSC
FAQs
Is my WordPress site affected?
If your site runs on a vulnerable version of PHP, yes. Almost every WordPress site uses PHP, so assume you could be affected until you or your host have checked. PHP will confirm exactly which versions are vulnerable alongside the fix.
Will WordPress automatic updates fix this?
No. The problem is in PHP on your web server, not in WordPress, so updates to WordPress, plugins or themes won’t install the fix. Your hosting provider or developer needs to update PHP.
How do I check which version of PHP my site uses?
Log into your WordPress dashboard and go to Tools > Site Health > Info, then open the Server section. Your PHP version is listed there. Your hosting control panel will usually show it too.
What if my site is on PHP 8.1 or older?
Those versions are no longer officially supported, so they may not get a fix. You’ll need to upgrade to a supported version (8.2 or newer). It’s worth testing your plugins and theme first, as older sites can break on a newer PHP version.
Should I take my website offline?
Only if you can’t get PHP updated quickly and your site is high-risk, for example if it takes payments or stores customer data. In that case, putting it into maintenance mode until it’s patched is sensible, and matches advice from UK and EU cyber security agencies.
How would I know if my site has been hacked?
Warning signs include admin users you don’t recognise, unexpected redirects or pop-ups, files you didn’t add, or Google flagging your site. If anything looks off, get in touch and we can run a security check.
I’m a Solve maintenance client. Do I need to do anything?
No. We’re updating and checking every site we look after, and we’ll contact you directly if we need anything.
