Is my WordPress website safe from PHP2Shell?
If your business website runs on WordPress you may have heard about a new security issue this week. Here's what it is, whether it affects you and what to do about it in plain language.
Updated October 22, 2026
What is PHP2Shell?
PHP is the software that runs behind most WordPress websites and a large share of the internet. On October 21, 2026 the team that makes PHP released emergency fixes for two critical security flaws. Researchers nicknamed them PHP2Shell.
The flaws are in PHP itself, not in a plugin or theme. So a site can be fully up to date on WordPress and its plugins and still be at risk if the server's PHP hasn't been updated.
Is anyone being attacked?
Security companies have reported attempts to use these flaws since the details leaked on October 20. The good news is that fixes are available and many hosting companies applied them quickly.
Because the details are public, it's still worth checking your site soon.
Which websites are affected?
Any website that runs on PHP and hasn't been updated, which includes most WordPress sites.
Websites built on platforms that don't run on PHP aren't affected by these flaws.
Sources: PHP security advisory, October 21, 2026 and Help Net Security
How do I check my website?
It takes about two minutes if you can log in to WordPress.
Find your PHP version
In WordPress go to Tools, then Site Health, then the Info tab. Open Server and look for the PHP version.
8.2 or newer?
Ask your hosting company whether the October 21 security update has been applied to your server.
8.1 or older?
Your site needs to move to a newer version of PHP. Those older versions won't get a fix.
Before you switch: changing PHP versions can break an older site. Take a full backup first and test everything afterward, or have your web designer handle it for you.
Watch out for scam emails
News like this is often followed by fake emails claiming your website needs an urgent security fix. They usually ask you to click a link or log in somewhere.
- Don't click the links
- Never send your password by email
- Forward it to someone you trust first
Not sure where your site stands?
Tell us your web address and whatever you know about your hosting. We'll take a look and reply by email within one business day with what we found and what to ask your host. It's free, "I'm not sure" is a fine answer to any question, and we'll never ask for your passwords.
Already a Webify client? We've already been in touch about your website.