Back to Blog

Most Small Business Websites Run PHP. Two Critical Flaws Were Just Patched. Attackers Had a Four-Day Head Start.

Most people don’t give much thought to what their website is built on. You picked a platform, someone set it up, and it works. That’s fine. But last Tuesday, the underlying software that runs most small business websites got two critical security patches, and the attackers were already testing the holes four days before the fix came out.

PHP is the programming language behind WordPress, Drupal, Joomla, Magento, and most other content management platforms. Roughly 77% of all websites with a detectable server-side language run on it.[1] If your business has a website on any of those platforms, your site runs PHP.

What was found

On October 21, PHP published emergency patches for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, given the collective nickname PHP2Shell.[2] Both carry a CVSS v4.0 score of 9.2 out of 10. Both are use-after-free bugs, a class of memory flaw that, in this context, lets an unauthenticated attacker run arbitrary code on your web server. No login. No special access. A crafted HTTP request is enough.

One flaw is triggered during PHP’s handling of multipart file upload requests. The other fires on the request that follows a fatal error. Either way, a successful exploit gives an attacker code execution with whatever permissions your web server process runs under.

The timing is the problem

PHP planned a coordinated release, but details leaked early through a deleted Hacker News post and social media before the patches were ready.[3] Amazon’s MadPot threat intelligence honeypot recorded active exploitation attempts on October 17, four days before the official patch release.[2] Canada’s Cyber Centre flagged mod_php as the highest-risk configuration, the setup used by many shared hosting environments.[4]

By the time the patches were public and hosting providers started applying them, someone was already running exploit attempts against live servers.

What you actually need to do

The fix is in the PHP runtime itself, not in WordPress or any plugin. Your web host or managed service provider is the one who needs to apply it. The patched PHP versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Anything older is exposed.

For most small businesses on managed WordPress hosting (WP Engine, Kinsta, Cloudways, Bluehost, SiteGround, and similar), this is something your host should already be handling. Many of them push PHP updates as part of routine platform maintenance. The question is whether they’ve done it yet for your account.

Check your hosting dashboard or admin panel. Most hosts show you the PHP version your site is running. If it’s older than the patched versions above, open a support ticket and ask specifically whether they’ve applied the PHP2Shell patches.

If you manage your own VPS or dedicated server, you need to upgrade PHP to the patched version for your branch and restart PHP-FPM and your web server so the new binary actually loads. Running the upgrade without the restart leaves the old process in memory and you’re still vulnerable.

One mitigation that circulated online, setting session.upload_progress.enabled=0 in php.ini, only blocks one of the two demonstrated attack paths. It does nothing for CVE-2026-109618.[3] Patching is the fix.

PHP 8.1, 8.0, and 7.4 are end-of-life branches with no official patched releases available. If you’re still on one of those, the path is upgrading your PHP version entirely. Your host can usually handle that, though it’s worth testing any plugins or custom code against the new version first.

The bigger picture

Your website is infrastructure. The platform you built on and the software under it both need maintenance. A lot of small business owners treat the site as a finished project once it’s live. It isn’t. The technology running it keeps accumulating vulnerabilities, and somebody’s job is to keep up with the patches.

If you’re not sure what PHP version your site is running, or how patching gets handled for it, that’s a reasonable question to ask your IT provider or web host this week. Not a complicated conversation. Just an important one.