PHP2Shell: what business owners should check
Two PHP flaws from the October 21 CISA alert, what they mean for your business website, the two questions to ask, and how Matano IT helps.
Read the transcript
This week, a serious security flaw called PHP2Shell was announced in PHP, the software behind most small business websites. If your site runs an older version of PHP, it may need an update. The fixed versions are now available. So ask your web person or your hosting company two questions: which PHP version is my site on, and has this week's fix been applied? Not sure, or don't have anyone to ask? Matano IT can confirm it and take care of the update for you. Visit matanoit.com/php2shell to chat, book a time or email us.
On October 21, 2026, CISA issued an alert about two flaws in PHP, CVE-2026-109618 and CVE-2026-109619. Together they go by the name PHP2Shell. If you run a business with a website, this one is worth five minutes of your time, even if you have never heard of PHP.
Why it matters to a business owner
PHP is the software most WordPress sites, and many other business websites, run on. It runs on the server where your site lives, out of sight, every time somebody visits. You don't have to know it is there for it to matter.
When a flaw is found in PHP itself, every site on an affected version needs the fix. The fixed versions are already available, so for most businesses the job is to confirm where your site stands and make sure the update is in place.
What is affected, and what is fixed
PHP 5.4 through 8.5.11 are affected unless the fix has been applied. The fix is in these releases and anything after them:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
If your site is on PHP 8.1 or older, no fix is coming from PHP for that version. The way forward is a move to a supported version.
One detail catches people out: some hosts apply the fix without changing the version number. So the number on its own doesn't always tell you whether your site is fixed. Your host can confirm it for you.
The two questions to ask
You don't need to be technical to get an answer. Ask your web person or your hosting company:
- Which PHP version is my site on?
- Has the fix for CVE-2026-109618 and CVE-2026-109619 been applied?
If the answer to the first one is PHP 8.1 or older, ask a third: what is the plan to move to a supported version? A newer PHP can affect older plugins and themes, so that move should be tested on a copy of the site before it goes live.
If your site runs on WordPress, you can see the version yourself under Tools, then Site Health, then Info, then Server.
When to ask for a second look
Some sites don't have an obvious person to ask. It's worth a second look if you aren't sure who hosts your website, if nobody has updated the site in the last year, or if the person who built it is no longer around. The same goes if your WordPress dashboard shows warnings about PHP or updates.
Not sure, or don't have anyone to ask? Matano IT can confirm it and take care of the update for you.
How Matano IT helps
We confirm which PHP version your website runs and whether the fix is in place. If it needs an update, we test it on a copy of your site first, make the update, and check that everything still works afterward. We can work alongside your host or web person, or take care of it for you.
Our website check shows what is visible from the outside. Many sites hide their PHP version, so confirming it usually takes a look at your hosting account, and we can take it from there with you.
Run the free check and see what to ask on our PHP2Shell page. Or book a 15-minute review or send us an email below, and we'll tell you plainly what we see and what we'd do next.