Last week, a piece of technology most business owners have never heard of nearly broke the internet. PHP, the programming language behind roughly 70% of the world's websites, was found to have two critical security flaws. Together they're called PHP2Shell.

If your website runs on WordPress, or your business relies on any web portal built on PHP, this affects you. Even better-written websites are exposed, because the problem isn't in your site. It's in the engine underneath it.

Here's what happened, what it means for your business, and the questions you should be asking your web host this week.

What Is the PHP2Shell Vulnerability?

PHP2Shell is the name for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 for severity. On October 21, 2026, the PHP project released emergency updates to fix them.

In plain terms, the flaws let an attacker run their own code on a web server without a password or login. Security professionals call this unauthenticated remote code execution. It's about as serious as a vulnerability gets. Once an attacker can run code on your server, they can change your website, steal the data behind it, or use the server as a foothold for something bigger.

A few details make PHP2Shell especially concerning:

• It has been hiding for over a decade. The vulnerable code dates back to PHP 5.4, released in 2012, and sits in the PHP engine itself.

• Your website's own code doesn't matter. Security researchers at CrowdStrike noted that the exposure doesn't depend on which content management system, framework or plug-ins you use. Even a basic page on an unpatched server can be attacked.

• It leaves very little behind. CrowdStrike also reported that an attack leaves virtually no digital traces, which makes it hard to tell after the fact whether a site was hit.

• AI helped find it. Researchers from Calif, OpenAI and Wiz found the flaws with the help of AI tools, which is a preview of how AI is changing cybersecurity threats on both sides.

Was 70% of the Internet Actually Breached?

No, and the difference matters. You may have seen headlines saying 70% of the internet was hit. Here's what that number actually means.

According to W3Techs, PHP runs about 70% of all websites whose server-side language is known. That includes every WordPress site. So PHP2Shell put a huge share of the web at risk. It did not mean 70% of websites were broken into.

That said, "at risk" turned into "under attack" quickly:

• Amazon's threat intelligence team detected an exploitation attempt on October 17, four days before the flaws were publicly disclosed.

• Details and proof-of-concept code leaked early, which pushed the PHP team to release its fixes a day ahead of schedule.

• On October 26, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both flaws to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch by the end of the week, as BleepingComputer reported.

CISA's catalog only lists vulnerabilities that attackers are actively using. Once a flaw is on that list, assume someone is scanning for it.

Why Updating WordPress Won't Fix PHP2Shell

This is the part many business owners will miss. Clicking "update" on WordPress, your theme or your plug-ins does not fix PHP2Shell.

PHP is the language WordPress runs on, not part of WordPress itself. The fix has to happen one layer down, on the server, by whoever manages your hosting. As The Hacker News put it, updating your application doesn't update the PHP runtime underneath it. That comes from your server, your host or your container image.

The fixed PHP versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Your site needs to be on one of these, or on a patched build from your hosting provider.

Which Websites Are Most at Risk?

Any server running PHP that serves web traffic should be treated as exposed until it's confirmed patched. Some situations carry more risk than others:

• Sites on older PHP versions. According to Tenable, PHP 5.4 through 7.3 is end-of-life and gets no fix from the PHP project. Versions 7.4 through 8.1 have no official release either, only minimal source patches. If your site runs one of these, the real fix is an upgrade.

• Sites nobody is watching. The website a former employee or a one-time web designer built years ago, which no one has logged into since.

• Client portals and web apps. Payment pages, intake forms, scheduling tools and document portals often run on PHP and hold the most sensitive data.

• Other internet-facing equipment. Researchers have also seen PHP2Shell probes aimed at network devices with web interfaces, not just websites.

Questions to Ask Your Web Host or Developer This Week

You don't need to be technical to protect your business here. You need to ask the right person the right questions and get clear answers in writing.

1. What version of PHP is our website running right now?

2. Has it been updated to a version that fixes PHP2Shell (8.2.35, 8.3.36, 8.4.27, 8.5.12 or a patched vendor build)? When?

3. If we're on an older PHP version, what's the plan and timeline to upgrade?

4. Do we run any other websites, portals or tools on PHP that also need patching?

5. Have you checked our server for signs of compromise since October 17?

6. Who gets notified the next time something like this happens, and how fast?

If nobody can answer these, that's a finding in itself. It usually means no one owns your website's security.

Your Website Is Only One Door Into Your Business

PHP2Shell is a website story, but the lesson is bigger. Your website, your firewall, your remote access, your email and every connected device are all doors into the same business. An attacker only needs one of them to be unlocked.

That's why EMCO Technology looks at the whole picture. Through our network services and cybersecurity work, we review the full network, the website setup included, to find openings before someone else does. It's also why we keep coming back to the same point: businesses invest in productivity but often overlook IT security until something like this makes the news.

Clarity is one of our core values. When a story like PHP2Shell breaks, you should get a straight answer about whether it affects you, not a wall of jargon.

PHP2Shell FAQs

What is PHP2Shell?

PHP2Shell is a pair of critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in the PHP programming language. They let an attacker run code on a web server without logging in. PHP released fixes on October 21, 2026.

Is my website affected by PHP2Shell?

If your website runs on PHP, which includes every WordPress site, it's likely affected until your server is updated. Ask your web host what PHP version you're running and whether it's been patched.

Does updating WordPress fix PHP2Shell?

No. The flaws are in PHP, not WordPress. Updating WordPress, themes or plug-ins won't change your PHP version. Your host or server administrator has to update PHP itself.

Is PHP2Shell being actively exploited?

Yes. CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog on October 26, 2026, which means attackers are using them in real attacks.

What should I do if my site runs an old version of PHP?

Plan an upgrade to a supported PHP version as soon as possible. PHP 5.4 through 7.3 will not receive a fix from the PHP project, so patching alone isn't an option.

Find the Openings Before Attackers Do

Not sure whether your website, or anything else on your network, is exposed? EMCO Technology offers a Network Security Assessment. We review every point of your network, including your website setup, to identify openings and possible attack vectors in your business. Then we walk you through what we found in plain language.

Contact our team today to schedule your Network Security Assessment.