PHP2Shell: what the PHP outage means for your marketing site

If your website went into maintenance mode this week, or you have spent two days waiting for a host to reply, you are in good company. On 21 October 2026 the PHP team released emergency fixes for two critical flaws, now known together as PHP2Shell. WordPress, Drupal, Joomla and Magento all run on PHP, which means a very large share of the web was exposed until the server underneath it was patched. Security bodies, including CERT-EU, went as far as telling organisations to take PHP sites offline if they could not patch quickly, which is why so much of the internet has looked a little broken.

Most marketing leads own the website and have never once thought about the server it runs on. That is entirely reasonable. It is also why this week felt so confusing, because the fix sat with someone else and nobody was quite sure who. This post explains what happened, helps you work out whether your site is affected, and gives you the questions to ask so you can get a clear answer today.

What is PHP2Shell?

PHP2Shell is the name for two flaws in PHP itself: CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 for severity, which puts them among the most serious web vulnerabilities in years.

Used together, they let an attacker run their own code on a web server without logging in. In practice that could mean reading data they should never see, changing what your site shows to visitors, or quietly leaving a way back in for later.

The part worth holding onto is that the flaws live in the PHP engine, and in nothing built on top of it. A WordPress site with every plugin up to date and a careful developer behind it was still exposed, because the problem sat one layer down.

Is my website affected by PHP2Shell?

If your site runs on PHP and your host has not yet patched it, then yes. Every PHP version back to 5.4 is affected, and the default server setups most hosts use are vulnerable out of the box. The quickest way to orient yourself is by platform.

One distinction will save you some worry. Vulnerable means exposed, and a breach is a separate question. A site that was open for a few hours has very likely come through fine, and downtime this week is a sign that a host was patching rather than a sign that anything was taken.

What should a marketing team do about PHP2Shell today?

You do not need to touch a server, and you should not have to. What you need is a clear answer from the person who looks after it, so here is how to get one.

1. Find your PHP version. In WordPress, go to Tools, then Site Health, then Info, then Server. On anything else, look in your hosting panel or ask your developer.
2. Ask your host one question. "Is the PHP build serving our site patched for CVE-2026-109618 and CVE-2026-109619?" The answer you want is "done". If the answer is "scheduled", ask when.
3. Treat WordPress updates as a separate job. Updating WordPress or its plugins keeps them healthy and leaves PHP exactly as it was. The two are maintained separately.
4. If you are on PHP 8.1 or older, plan an upgrade to 8.2 or later. Test it on staging first, because older plugins can break along the way.
5. If you cannot patch today, ask whether the site should go offline or read-only until it is done. A firewall such as Cloudflare lowers the risk while you wait, and the patch remains the fix.
6. Keep an eye out afterwards. New admin accounts you did not create, files you do not recognise or odd errors are all worth flagging to your developer, even a week from now.

Who looks after your website's server?

For a lot of marketing teams, this was the first week they had to think about PHP at all, and that is the real lesson in it. Your website is a growth tool, and the server underneath it is a job that someone has to own, with a name attached and a sense of how fast they move.

WordPress itself is fine here, and plenty of WordPress sites were patched within hours by hosts who were on top of it. The question is how your week went. If your team spent it waiting on a host, an old agency or a freelancer to reply, that is worth noticing, because the next one of these will arrive without warning too.

There are two sensible answers, and either is a good one.

• Keep your stack, and make ownership clear. Know who patches PHP, how quickly they do it, and how you will hear about it.
• Move to a hosted platform such as Webflow, where hosting and security updates are the platform's job and your team gets on with publishing.

We build on Webflow for exactly that reason. Our clients' marketing teams had a normal week, and the word PHP did not come up once.

If this week was a scramble and you would like a second opinion on where your site should live, we are happy to talk it through. Start a conversation and we will help you work out what makes sense.

Sources

• PHP2Shell: why websites are going offline for emergency security updates (Malwarebytes)
• PHP2Shell: critical PHP RCE (CVE-2026-109618, CVE-2026-109619) (Sansec)
• PHP2Shell: is your WordPress, Laravel or PHP site affected? (BrillMark)
• New PHP vulnerability means the internet will have a very rough couple of days (AppleInsider)