If you're asking "is my website safe" after PHP2Shell, the answer for most small businesses is yes, once your web host has updated PHP. PHP2Shell is a serious flaw in PHP, the software most WordPress sites run on. Large hosts such as SiteGround patched it the day it came out. Your job is to check that yours has.
For most owners this is one email to your host, not an emergency. Last checked 27 October 2026, including a newer PHP flaw that isn't fixed yet.
What is the PHP2Shell vulnerability?
PHP2Shell is the name for two flaws in PHP itself, logged as CVE-2026-109618 and CVE-2026-109619. On a server that hasn't been updated, they could let someone run their own code without a password.
PHP is the language that sits underneath WordPress, Joomla, Drupal and many older custom sites. The flaws are in PHP, not in WordPress or its plugins, which is why keeping WordPress up to date doesn't help this time.
The New Zealand National Cyber Security Centre has an alert with the fixed versions and notes reports of attackers trying it. That's why it's worth checking now, while the fix is quick.
Is my website safe from PHP2Shell?
Your website is safe from PHP2Shell if it doesn't run on PHP, or if your host has installed a fixed version. Sites on Wix, Squarespace, Shopify and WordPress.com are looked after by those companies. Self-hosted WordPress sites depend on their host.
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October. Large hosts moved fast. SiteGround applied the fix to all its servers on the day it came out. PHP 8.1 and older get no official release, so sites still on those versions rely on their host patching them or need moving to a newer version.
is when PHP released the fix. Large hosts applied it within days, so for most sites this is one email to check.
The newer PHP flaw, not fixed yet
On 23 October, PHP announced a separate flaw, CVE-2026-115560. The 21 October updates don't fix it, and the fix is due in PHP's next regular release. It only works on servers with an unusual mix of PHP settings, and there are no reports of it being used in attacks so far.
Until the fix is out, PHP's advice is to switch off one setting, session upload progress (session.upload_progress.enabled). It's mostly used for upload progress bars, so few small business sites will miss it. Hosts that already switched it off for PHP2Shell don't need to do anything more. The email below asks your host about this too.
What to do, by the kind of website you have
What you need to do depends on who runs the server your site sits on. Find your setup in the table and do what it says.
| Your website | Exposed? | What to do |
|---|---|---|
| Wix, Squarespace or Shopify | No, the platform runs it | Nothing |
| WordPress.com | No | Nothing. WordPress.com says there is nothing customers need to do |
| WordPress on a managed WordPress host | Likely patched, worth confirming | Check your host's news page or email them |
| WordPress or PHP site on shared hosting (cPanel) | Depends on the host | Check your PHP version, then email your host |
| Your own server or VPS | Yes, until it's updated | Update PHP, or ask your developer to |
| Static site (plain HTML, no PHP on the server) | No | Nothing for PHP2Shell |
| You don't know | Worth checking | Ask whoever built or hosts the site, using the email below |
If a web designer set up your site and still pays the hosting, they're the one to ask. Plenty of small businesses don't know who hosts their site. The renewal email or invoice for your hosting usually tells you.
How to check your PHP version in WordPress
In WordPress, go to Tools, then Site Health, then the Info tab, and open the Server section. The PHP version is listed there. Your hosting control panel (often cPanel, under "Select PHP Version" or "MultiPHP Manager") shows it too.
Compare the number with the fixed versions: 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later on the same branch. A version starting 8.1, 8.0 or 7 is unsupported and needs moving up.
Some hosts install the fix without changing the version number you see, so an older looking number doesn't always mean you're unpatched. That's why the email to your host below asks them to confirm in writing.
How to update the PHP version safely
On shared or managed hosting, your host updates PHP for you, or gives you a menu in the control panel to switch versions. On your own server, you or your developer install the patched PHP package and restart the web server.
Before switching versions yourself:
- Take a full backup of the site and database, or check your host's last backup date.
- Update WordPress, your theme and your plugins first, so they work on the newer PHP.
- Switch PHP to a fixed version in the control panel.
- Open your home page, contact form and any booking or checkout page to check they still work.
- If something breaks, switch back and ask your developer. Don't leave it on the old version for weeks.
Moving up from PHP 7 or 8.0 is where old plugins tend to break, so step 2 matters more for older sites.
The email to send your web host
If you're not sure your site is patched, a short email to your host or web developer settles it.
Copy this and fill in your domain:
Hi, my website is [yourdomain.co.nz]. Can you confirm in writing whether the server it runs on has been patched for PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and whether session upload progress is switched off until PHP fixes CVE-2026-115560? Which PHP version is the site running, and if it's PHP 8.1 or older, what's your plan to move it to a supported version? Thanks.
Most hosts will answer within a day. If yours can't tell you which PHP version your site runs on, it's worth asking why.
How to check if my website has been hacked
Most sites won't have been touched, but a quick look takes five minutes. Check for admin users you didn't create, pages or links you didn't add, or a Google warning next to your site in search results.
If you do find something, tell your host and change the passwords connected to the site. You can also report a cyber incident to the NCSC in New Zealand. Updating PHP closes the gap, but it doesn't clean up anything already added.
Where the sites I build stand
I build two kinds of website, and neither is exposed to PHP2Shell.
- Custom-built sites are static: plain files served from a fast network, with no PHP or database on the server, so there is nothing for PHP2Shell to attack.
- WordPress sites, for owners who want to edit their own pages, run on Cloudways servers in Sydney. They were patched for PHP2Shell, and the sites run a fixed PHP version. Checking the PHP version is part of every monthly WordPress care plan, along with the WordPress and plugin updates.
No website is risk-free, and every site still needs secure hosting, domain and email settings. If you're on WordPress and happy with it, patching PHP is the fix and you don't need to move.
If you'd like a second opinion on your site or your hosting, send me a message with your web address and I'll tell you where you stand. You can also read how a custom-built website is set up, and what a website costs in NZ over three years including hosting.
I run Obie Digital on my own, building websites and running SEO and Google Ads for small NZ businesses. I grew up in Invercargill, studied Marketing Management at the University of Otago and have 9+ years in digital marketing.
More about how I work
