Security alert · PHP2Shell
Secure your website after the critical PHP vulnerabilities
On October 21, 2026, PHP fixed two critical flaws (CVE-2026-109618 and CVE-2026-109619) that can let an attacker run code on an unpatched web server without logging in. PHP runs most websites, including every WordPress site. We confirm what your site runs, get PHP updated, check for signs of compromise, and if your site is stuck on an old version, rebuild it so it no longer depends on WordPress or PHP.
Check these four things today
- Which PHP version serves your site? WordPress shows it under Tools, Site Health, Info, Server.
- Is it 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later, or has your host confirmed a patched build?
- Is it PHP 8.1 or older? The PHP project no longer fixes those versions.
- Has PHP been restarted since the update, and do your logs show anything unusual?
Updated October 22, 2026.
Full guide: is my website affected?The scale
Why this one matters for almost every business website
These flaws are in PHP itself, the language most websites run on, not in one plugin or one product.
About 1 in 3
of those websites run a PHP version that no longer gets security fixes (PHP 8.1 and older)
W3Techs version data, October 22, 202611,334
new WordPress vulnerabilities reported in 2025, up 42% on 2024
Patchstack, State of WordPress Security in 2026
W3Techs measures PHP against websites whose server-side language it can detect. The one-in-three figure adds W3Techs' published shares for PHP 5, 7, 8.0 and 8.1, which no longer get security fixes.
What the cyber agencies said
Update now. If you cannot, take the site offline or isolate it.
Government cyber security agencies in the United States, Canada and the United Kingdom issued the same core advice on October 21, 2026.
United States
CISA
“Apply the patch immediately, prioritizing internet-facing systems.”
Systems that cannot be updated right away, or that still run PHP 8.1 or earlier, should be taken offline until they are patched or upgraded.
CISA alert, October 21, 2026United States
NSA
“If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated.”
The NSA notes the flaws are in PHP itself, not in the application running on it, and expects attackers to weaponize them.
NSA advisory, October 21, 2026Canada
Canadian Centre for Cyber Security
Alert AL26-026 tells organizations to update immediately to a fixed, supported release, starting with internet-facing systems; where that is not feasible, to consider isolating those applications from public networks until fixed; and to review logs for signs of compromise.
Cyber Centre alert AL26-026, October 21, 2026United Kingdom
National Cyber Security Centre
Update to the latest PHP; if you cannot apply PHP's temporary mitigations quickly, consider taking the system offline until it is fully mitigated, and check it for signs of compromise.
NCSC news, October 21, 2026
Links go to each agency's own advisory. No agency endorses Data Function or any other company.
The fix
The PHP versions that fix PHP2Shell
Update to the fixed release for your branch, then restart PHP and the web server so every process runs the new code. PHP says there is no complete workaround: updating is the only safe choice.
| Your branch | Fixed in | Security support ends |
|---|---|---|
| PHP 8.5 | 8.5.12 | December 31, 2029 |
| PHP 8.4 | 8.4.27 | December 31, 2028 |
| PHP 8.3 | 8.3.36 | December 31, 2027 |
| PHP 8.2 | 8.2.35 | December 31, 2026 |
| PHP 8.1 and older | No release from the PHP project | Already ended. Upgrade, or use a host build that includes the fix. |
Source: PHP security advisory and supported versions. PHP 8.2.35 fixes this flaw, but PHP 8.2 stops getting security fixes on December 31, 2026.
How we help
Update it, secure it, or rebuild it without WordPress
Most businesses need the first option this week. Sites stuck on old PHP are usually cheaper to rebuild than to keep patching.
Emergency PHP update
For any PHP website, on your hosting or ours.
- Confirm the PHP version and how it serves your site
- Back up the site before anything changes
- Update to the fixed release, or get your host to, then restart PHP
- If an update cannot happen right away, isolate the site or show a holding page
- Check logs and files for signs of compromise
WordPress security and care
For WordPress sites you want to keep.
- Update WordPress, themes and plugins, and remove the ones you do not use
- Move to PHP 8.3 or 8.4 and test on a copy first
- Web application firewall, backups and uptime monitoring
- A monthly care plan so updates never pile up again
Rebuild without WordPress or PHP
For sites on old PHP, heavy plugins or no clear owner.
- A fast site on Next.js, with no PHP or plugins on the public server
- Your content moved and every old address redirected
- Built to AODA and WCAG 2.1 AA
- Small-business packages from $500 plus HST
How it works
From first call to a patched, monitored website
01
Book a call
Free, 30 minutes on Google Meet. Pick a time below and tell us your website address and host.
02
We check
PHP version, hosting, plugins and visible signs of trouble. You get a fixed quote.
03
We fix
Update PHP or isolate the site first, then the WordPress updates or the rebuild.
04
We verify and watch
Confirm the fixed version is serving the site, then monitor it on a care plan if you want one.
Free · 30 minutes · Google Meet
Pick a time for your website security check
Choose a slot with Dawood Cheema, our founder. Have your website address and the name of your host ready; that is all we need to start.
Prefer to write or call? Send us a message or call +1 416-319-3884.
Calendar not showing? Open the booking page (opens in a new tab). Booking is handled by Google Calendar, and the call is on Google Meet.
The trend
Businesses are moving off WordPress, and its vulnerabilities keep rising
WordPress still runs about two in five websites, but its share has fallen every month this year, while reported WordPress vulnerabilities have nearly doubled in two years.
WordPress share of all websites, monthly
Down 3.7 percentage points in a year, from 43.3% to 39.6%, after holding near 43% from 2022 to 2025. The axis starts at 38%.
Use the left and right arrow keys to read each month.
Show the data as a table
| Month | Value |
|---|---|
| Oct 2025 | 43.3% |
| Nov 2025 | 43.2% |
| Dec 2025 | 43.2% |
| Jan 2026 | 43.0% |
| Feb 2026 | 42.8% |
| Mar 2026 | 42.7% |
| Apr 2026 | 42.5% |
| May 2026 | 42.2% |
| Jun 2026 | 41.9% |
| Jul 2026 | 41.5% |
| Aug 2026 | 41.2% |
| Sep 2026 | 40.7% |
| Oct 2026 | 40.2% |
| Oct 22 | 39.6% |
Source: W3Techs, content management systems, monthly history, first of each month, plus October 22, 2026. Part of the fall reflects more websites with no detectable CMS.
New WordPress vulnerabilities reported per year
Up 42% in 2025. Most are in plugins; 46% had no fix when they were made public.
- 20235,948
- 20247,966
- 202511,334
Source: Patchstack, State of WordPress Security reports for 2024, 2025 and 2026.
Latest guide
PHP vulnerability (PHP2Shell): what website owners need to do now
Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, put most websites at risk, including every WordPress site. Which versions fix them, how to check yours, whether to take your site offline, and what CISA, the NSA and Canada's Cyber Centre advise.
Updated October 22, 2026
Questions
PHP updates, WordPress and rebuilds
Is my website affected by the PHP vulnerability?
If your website runs on PHP, which includes every WordPress, WooCommerce, Drupal and Joomla site, treat it as affected until its PHP is on 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later, or your host confirms a patched build. Updating WordPress or its plugins does not change PHP. Sites built on Wix, Squarespace or Shopify are run by those platforms, not by you.
How quickly can you help?
For urgent help, call +1 416-319-3884. Otherwise book a call and a person replies within one business day. On the first call we look at what your site runs and tell you what we would do first.
Do you work with my existing host?
Yes. We work with shared hosting and cPanel, managed WordPress hosts, VPS and cloud servers. Where only the host can change PHP, we raise it with them, then check the result ourselves.
My site runs PHP 7.4, 8.0 or 8.1. What are my options?
The PHP project no longer releases updates for 8.1 and older. Either upgrade to PHP 8.3 or 8.4, which usually means updating or replacing old plugins and themes and testing on a copy first, or rebuild the site so it no longer depends on WordPress or PHP. We tell you which costs less over the next few years.
Will a rebuild hurt my Google rankings?
Not if it is done carefully. We keep your content, redirect every old address to its new page in one step, and check titles, descriptions and structured data before launch. We did exactly this when we moved our own site off WordPress.
What does it cost?
We give you a fixed quote after the first check, before any work starts. Small-business website rebuilds start at $500 plus HST; see our website packages.
Do you need my passwords to check my site?
No. The first check uses what is visible from outside and what you tell us. Never send passwords through a contact form or email; if you hire us, we set up access with you through your host's own tools.
Website security check
Not sure whether your website is affected?
Book a free 30-minute call. We look at what your site runs, tell you what to do first, and give you a fixed quote to update, secure or rebuild it. A person replies within one business day.
Or reach us directly:info@datafunction.ca+1 416-319-3884