PHP2Shell Security Alert: What WordPress Website Owners Should Do Now

Updated October 21, 2026

If your business website runs on WordPress, contact your hosting provider today and ask whether the PHP security fixes released October 21 have been applied to your site. A working homepage and an up-to-date WordPress dashboard are not confirmation that this separate server update is complete.

The PHP security team released fixes for two critical vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. They can allow an attacker to execute code remotely without signing in. The official PHP advisory urges immediate updates.

What does this mean for a WordPress website?

PHP is software that runs on your server and processes WordPress requests. Your hosting provider usually manages it, while your WordPress dashboard manages a different set of updates.

WordPress’s October 21 announcement explains that these issues are in PHP and are not specific to WordPress. No WordPress update is required or planned to address them. Updating your theme, plugins, or WordPress core alone does not apply the PHP fix.

For a business owner, the practical question is simple: who is responsible for the server, and can that person or provider confirm the fix is running?

Which PHP versions include the fixes?

PHP lists the following patched releases in its October 21 advisory:

Some operating-system and long-term-support vendors provide backported fixes: security patches applied to an older version. Ask your host to confirm the installed package addresses both vulnerabilities rather than relying only on the version number.

PHP 8.1 and earlier are outside normal PHP project security support. If your site uses an older branch, ask the provider about its patch coverage and a move to a supported release. Do not assume an older installation is protected.

What to do today

1. Identify who manages your hosting

Start with your hosting account, website maintenance agreement, or the agency responsible for your site. Domain registration, website editing, and server maintenance may be handled by different companies. Route the request to the team that actually controls PHP.

If your business has several websites, list every domain and its hosting account. Include accessible staging sites and separate customer portals so they are not overlooked.

2. Check the PHP version and request confirmation

In WordPress, open Tools → Site Health → Info → Server. Your hosting dashboard may also display the PHP version. Use this information when contacting support; it is a starting point, not a substitute for confirmation of a vendor-supplied patch.

Here is a message you can copy into a hosting support ticket:

Please confirm whether the PHP installation serving our website has been patched for CVE-2026-109618 and CVE-2026-109619, announced October 21, 2026. What PHP version or vendor-patched package is currently running? Does this confirmation cover our production site, accessible staging environments, and other PHP applications in this account? If the update is pending, please provide the expected completion time and your recommended action until it is complete.

3. Coordinate the update and a quick functionality check

Have the hosting provider or developer apply the appropriate fix promptly. Ask them to confirm a current backup and explain any compatibility concerns. A backup supports recovery; it does not prevent an attack.

Afterward, check the parts of the website your business depends on:

• Open key pages on a phone and a desktop.
• Send a clearly labeled test through the main contact form and verify that the intended inbox receives it.
• Check appointment requests, booking tools, and checkout where applicable.
• Test administrator login and any customer login your site offers.
• Ask the developer to review errors if anything behaves differently.

For a law firm, that may mean checking consultation requests. For a medical organization, it may mean verifying scheduling links and location routing. Use test details rather than real client or patient information.

Does a firewall or security plugin solve this?

Do not treat a firewall message as proof that PHP has been patched. The PHP team says temporary mitigations can reduce exposure to specific attack paths but are not a complete solution. Updating remains necessary. Ask your provider to distinguish between temporary protection and a completed update.

Should you take your website offline?

WordPress’s announcement relays national cybersecurity guidance to consider taking systems offline when immediate remediation is not feasible. If your host cannot patch promptly, escalate the issue and ask it to assess whether temporary isolation is necessary.

Have the hosting team implement any isolation. A WordPress maintenance-page plugin should not be treated as equivalent to taking the affected server out of service.

Does this mean your website has been hacked?

A vulnerability announcement is not evidence that your particular website was compromised. However, a normal-looking site does not prove that it is secure. If you notice unexpected redirects, unfamiliar administrator accounts, altered pages, or other suspicious behavior, ask your host or security specialist to investigate and preserve relevant logs. Applying a patch and investigating a possible intrusion are separate tasks.

Keep a record of what was confirmed

Save the support ticket, the affected domains, the confirmed patch or package version, the completion time, and the results of your functional checks. Assign someone to follow up on anything still pending. This turns a general assurance into a record your team can use.

Website care works better when responsibility is clear before an urgent update arrives. Hosting updates, WordPress maintenance, backups, and form testing should each have an owner.

Need help identifying the right next step for your business website? Contact Trendi Marketing with your website address and hosting provider. We can discuss your website support needs and the information to request from your hosting team.

Official sources

• WordPress: Critical PHP Security Release — October 21, 2026
• PHP: October 21, 2026 security advisory and release announcements

This article reflects the official guidance reviewed on October 21, 2026. Check the linked advisories and your hosting provider for subsequent updates.