K2 Ascent
Field notes · News

PHP2Shell: What the Critical PHP Flaw Means for Your Website

26 Oct 20265 min readBy the K2Ascent team

A serious security flaw nicknamed PHP2Shell was confirmed on 21 October 2026 in PHP, the software that quietly runs a large share of the world’s websites, including every WordPress site. If your website runs on PHP, the single most important thing to do this week is confirm with your web host or developer that PHP has been updated to a fixed version, not just that WordPress is up to date.

What is PHP2Shell?

PHP is a programming language that runs on your web server (the computer that stores your website and sends pages to visitors). It sits underneath popular platforms such as WordPress, as well as many custom-built business sites. According to the ABC, PHP runs about three-quarters of the websites whose underlying language can be identified.

On 21 October, the PHP project released emergency updates for two flaws it rated as critical. Its advisory says the flaws can allow “remote code execution” without logging in. In plain terms, an attacker on the internet could make your server run their own instructions, which could expose customer data, change your site’s content or plant a hidden “backdoor” for later access.

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive regular updates from the PHP project, although some hosting providers and software vendors supply their own fixes.

Is this flaw being used by attackers?

When the Australian Cyber Security Centre (ACSC) issued its alert on 21 October, it said it was not yet aware of any exploitation. Since then, the ABC and security firm Malwarebytes have both reported that Cloudflare, a major web security company, saw early attacks emerging. Cloudflare described its own firewall protections as a temporary measure only, not a replacement for patching.

Why did government websites go offline?

Some organisations chose to take sites offline while they patched. The Australian Signals Directorate said cyber.gov.au and other Australian government websites experienced outages, and agencies in several European countries also shut down sites as a precaution. This was a deliberate safety step, not a sign the sites had been hacked.

Does updating WordPress fix it?

No. This is the point most business owners miss. Updating WordPress, your theme or your plugins does not update PHP itself. PHP is managed at the server level, usually by your hosting provider, or by your developer if you run your own server.

Here is a quick way to check your PHP version if your site runs on WordPress:

  1. Log in to your WordPress dashboard.
  2. Go to Tools → Site Health, then click the Info tab.
  3. Open the Server section and look for PHP version.

If the number shown is lower than the fixed versions listed above (for example 8.3.30 instead of 8.3.36), or is 8.1 or older, contact your host straight away. Some hosts and server vendors apply the fix to older version numbers (known as a “backport”), so a direct written answer from your host is the most reliable confirmation.

Will taking my site offline hurt my Google rankings?

Not if it’s done properly and briefly. Google’s John Mueller advised that if you need to take a PHP site down to patch it, the site should return a “503” status code. This is a standard server message meaning “temporarily unavailable, please come back later”. It should not simply time out or show a “page not found” (404) or general error (500) message, which can signal to Google that pages are broken or gone.

Google’s own guidance on pausing a website supports this, with two cautions. A 503 is suited to short outages of a day or two, and a full shutdown should last a few days at most. Longer outages can lead to pages dropping out of Google’s index, with no guaranteed timeline for recovery.

Is your site still on HTTP, not HTTPS?

In separate news the same day, Google announced that Chrome now asks every user for permission before loading a website over an unencrypted “HTTP” connection, rather than just showing a small “Not secure” label. HTTPS (the padlock in the address bar) encrypts the connection between your visitor and your site. If any part of your site still loads over HTTP, visitors will now see a warning before they reach you, which is a fast way to lose an enquiry.

What this means for your business

PHP2Shell is a practical, act-now issue rather than a long-term trend. Here is what we recommend this week:

Frequently asked questions

What is PHP2Shell?
PHP2Shell is the nickname for two critical security flaws in PHP, the language behind WordPress and many other websites. They were fixed on 21 October 2026 and can let attackers run code on a web server without logging in.
Which PHP versions fix PHP2Shell?
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older need a vendor-supplied fix or an upgrade to a supported version.
Does updating WordPress protect me from PHP2Shell?
No. WordPress and plugin updates do not change PHP. Your hosting provider or developer must update PHP on the server.
Will patching my website affect my SEO?
A short, properly handled outage is unlikely to cause lasting harm. Google recommends showing a 503 “temporarily unavailable” status during brief downtime and keeping any full shutdown to a few days at most.
How do I check my PHP version in WordPress?
Go to Tools → Site Health → Info, open the Server section and look for “PHP version”. Then confirm with your host that the October 2026 fixes are installed.

Need a hand checking your site?

If you’re not sure who manages your website’s server, or you’d like someone to check your site is patched and secure, contact the K2Ascent team at hello@k2ascent.com.au. We’re happy to take a look.

Get in touch

Sources

← All articles