--- title: "PHP2Shell: what the PHP security flaw means for your website — Siite" description: A critical PHP flaw put most of the web at risk. What happened, who was exposed, how we kept every Siite client safe, and why we build websites in Astro. url: "https://siite.co/articles/php2shell-php-vulnerability-what-it-means-for-your-website" type: static generatedAt: "2026-11-02T14:48:47.428Z" --- General # PHP2Shell: what the PHP security flaw means for your website A critical PHP flaw put most of the web at risk. What happened, who was exposed, how we kept every Siite client safe, and why we build websites in Astro. [![Leonardo Miodrag](/images/team/leonardo-miodrag.jpg)By Leonardo Miodrag](/articles/author/leonardo-miodrag/)October 21, 20269 min read ## Contents Today, October 21, 2026, the PHP project shipped an emergency security release. If your website runs on WordPress, Drupal, Joomla or almost any other PHP software, it was exposed to one of the most serious web vulnerabilities in a decade until that patch was installed on your server. First, the part our clients want to know: **every Siite client is secure.** The PHP servers we manage were patched the day the fix shipped. The websites we build in Astro needed no patch at all, because there’s no PHP on them for this attack to reach. The rest of this article explains what happened in plain English, what you should do if your site isn’t with us, and why this is exactly the kind of day we had in mind when we decided how to build our clients’ websites. ## What happened? Security researchers at Wiz, working alongside the security firm Calif, OpenAI and the PHP team, found a group of flaws in **PHP itself**, the programming language that runs on the server behind a huge share of the internet. Wiz estimates PHP powers [about 70% of all websites](https://www.wiz.io/blog/php2shell-php-rce). They named the attack **PHP2Shell**. The flaws are tracked as two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, with a severity score of 9.2 out of 10. According to the [PHP Foundation](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/), they let an attacker who isn’t logged in run their own code on a server running PHP. In owner terms, that means a stranger on the internet could: - **Take over the server** your website runs on, and with it your site, your forms and anything stored there - **Read the server’s memory**, which can contain passwords, login tokens, API keys and data from other visitors’ requests - **Deface the site** or quietly use it to attack your customers ## Why this one is different Most website security problems you hear about are a bad plugin or a weak password. You fix the plugin, you change the password, done. PHP2Shell is not that. The bug sits in the engine underneath the website, not in the website. Wiz demonstrated working attacks against the latest versions of WordPress, Drupal and Joomla, and was explicit that even a simple “Hello World” page on an affected PHP version can be vulnerable. A well-built, fully updated WordPress site was still exposed, because the problem was below WordPress. Three things make it worse than usual: 1. **It’s old.** Every PHP version released in the last decade is affected, going back to PHP 5.4. Plenty of small-business sites run PHP versions that will never get an official fix. 1. **AI made it practical.** The flaws were hard to turn into a working attack, which is partly why they survived so long. Wiz says frontier AI models collapsed that effort from months of world-class team work to about a week for one researcher. The same tools are available to attackers. 1. **The secret got out early.** The vulnerability IDs leaked onto forums a day before the planned release, a demo video was published by mistake, and one software distributor posted patched builds hours ahead of schedule. Anyone could compare the old and new code to work out the attack. The PHP project moved its release forward a full day because of it. The upshot: the window between “patch available” and “attackers using it” is now measured in hours, not weeks. ## What did the fix look like? The PHP project released patched versions **8.5.12, 8.4.27, 8.3.36 and 8.2.35**. Those versions close the hole at its root. Firewall providers such as Cloudflare and the big cloud platforms also shipped blocking rules to buy time for anyone who can’t update immediately, but those are a stopgap. As Wiz put it, applying the PHP update is the only complete fix. If your site runs PHP 8.1 or older, there is no official patch for you. Those versions are past end of life. The fix is moving to a supported version, which on an older WordPress site can mean plugin and theme work first. ## How we kept every Siite client safe We run two kinds of websites for clients, and the PHP2Shell day looked very different for each. **PHP sites we manage** (mostly WooCommerce stores, plus a handful of older sites we took over and host): our team updated PHP on every one of them the day the release shipped, then checked each site was loading, taking orders and sending form leads normally. Clients didn’t have to email us, find their host’s login, or figure out what “PHP 8.3.36” means. That’s what our [hosting and maintenance plans](/services/hosting-maintenance/) are for. **Astro sites**: nothing to do. No patch, no emergency window, no late night. Those sites were never exposed. That second group is the point of this article. ### Not sure what your website runs on? We'll check your site, tell you plainly whether it's exposed, and send you a written growth plan you keep either way. [Get my free growth plan](/contact/) ## Why Astro sites weren’t affected Astro is the framework we use to build most of our clients’ websites. The difference that matters today is when the work happens. A typical WordPress site builds every page **on demand**. A visitor asks for your “AC repair” page, the server starts PHP, PHP pulls the content out of a database, assembles the page and sends it back. That machinery runs on every single visit, and it’s sitting on the public internet waiting for requests, including malicious ones. PHP2Shell attacked exactly that machinery. An Astro site builds every page **ahead of time**. When we publish, Astro turns the site into finished, plain HTML files. Those files are served from a global network of servers close to your visitors. When someone opens your “AC repair” page, there’s no PHP to start, no database to query and no admin login sitting on the same server. The page is just delivered. So when attackers came looking for PHP, there was nothing there for them. Not because we patched faster, but because the thing they were attacking doesn’t exist on the site. We’ll be honest about the limits, because overpromising on security is how agencies lose trust. No website is immune to everything. An Astro site still has a domain, a hosting account and a contact form, and those need strong passwords, two-factor login and someone watching them. We handle all three. But there’s a big difference between securing a few accounts and defending a full application server, a database and 20 plugins from 20 different developers. One is a locked door. The other is a building with a door on every side. ## The same choice makes your site faster and easier to live with We didn’t pick Astro only for days like today. The same “build it ahead of time” decision pays you back every day: - **It loads fast.** Pre-built pages from a nearby server typically load in under two seconds on a phone. That matters for rankings and for the homeowner with a leaking pipe who won’t wait. See [Core Web Vitals](/dictionary/core-web-vitals/) for why Google cares. - **It doesn’t break.** No plugin updates that crash the site on a Tuesday, no “your site is down” email because a database ran out of connections during a storm-week traffic spike. - **It’s hassle-free.** There’s no dashboard full of yellow update warnings. You tell us what to change, we change it. For most service businesses, a website has a few jobs: show up on Google, prove you’re trustworthy, and make it easy to call. It doesn’t need a database and a plugin ecosystem to do those jobs. Every extra moving part is one more thing that can break, slow down, or get attacked. ## When Astro isn’t the answer We don’t put every business on Astro. If you sell products online, you need a real store, and we build those on Shopify or WooCommerce because that’s what store owners and their customers need. WooCommerce runs on PHP, which is exactly why our team was patching servers today. Shopify runs and patches its own platform. The principle is the same either way: pick the simplest tool that does the job, and make sure someone on our team owns the maintenance so you never have to. ## If your site isn’t with us: what to do today If you run a PHP website (WordPress, WooCommerce, Drupal, Joomla, or anything your developer called “PHP”), do this today: 1. **Ask your host or developer one question:** “Which PHP version is my site on, and has it been updated to the October 21 security release?” The safe answers are 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer. 1. **If you’re on PHP 8.1 or older,** treat it as urgent. There’s no patch for you, so the site needs to move to a supported version. 1. **Turn on your firewall rules** if your host or CDN offers them. It’s a bridge, not a fix. 1. **Change important passwords and API keys** if your site sat unpatched after the details went public. The memory-reading part of this attack can expose secrets without leaving obvious traces. 1. **Ask whether anyone noticed anything odd,** like a run of server errors or the site going down briefly. Your host can check their logs. If you can’t get a straight answer to step one, that’s the answer. ## The bigger picture PHP2Shell won’t be the last one. The researchers who found it said it plainly: AI has changed how fast old flaws become working attacks. The businesses that come through that well won’t be the ones with the most security plugins. They’ll be the ones whose websites have the fewest moving parts, with a team that patches what’s left the day a fix ships. That’s how we build for our clients. Not because it makes a nice line in a proposal, but because days like today happen, and our clients shouldn’t have to know about them. ## Frequently asked questions What is PHP2Shell?+ PHP2Shell is the name researchers at Wiz gave to a set of critical flaws in the PHP programming language, disclosed and patched on October 21, 2026, as CVE-2026-109618 and CVE-2026-109619. They let an attacker who isn't logged in run code on a server running PHP and read sensitive data from its memory, regardless of which PHP application the site runs. Is my WordPress site affected by PHP2Shell?+ If it runs on an unpatched PHP version, yes. The flaw is in PHP itself, so a fully updated WordPress site with good plugins is still exposed. Ask your host whether your site is on PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer. If you're on PHP 8.1 or older, there's no official patch and the site needs to move to a supported version. Were Siite client websites affected?+ No Siite client is exposed. The PHP servers we manage, mostly WooCommerce stores, were updated the day the fix was released. The websites we build in Astro were never exposed, because they're served as pre-built pages with no PHP running behind them. Why aren't Astro websites affected by PHP vulnerabilities?+ Astro builds every page ahead of time into plain HTML files that are served from a global network. There's no PHP interpreter, no database and no admin login running on the public site, so an attack aimed at PHP has nothing to reach. Astro sites still need their domain, hosting account and forms secured, but the attack surface is a small fraction of a typical WordPress install. Is a firewall enough to protect my site?+ Not on its own. Firewall providers shipped rules that block known versions of the attack, which buys time. But attackers adapt, and the researchers were clear that updating PHP is the only complete fix. Use the firewall as a bridge while the update gets done. Should I switch my business website away from WordPress?+ Not in a panic, and not before your current site is patched. But if your website's job is to rank on Google, build trust and make the phone ring, it probably doesn't need a database and a stack of plugins to do it. A pre-built site is faster, cheaper to maintain and far less exposed. We're happy to look at your site and tell you honestly whether a rebuild is worth it. ![Leonardo Miodrag](/images/team/leonardo-miodrag.jpg)[Leonardo Miodrag](/articles/author/leonardo-miodrag/)CMO, Partner Leonardo runs marketing and growth at Siite. He's spent the last decade building digital revenue engines for service businesses across the US and Europe — and now leads how Siite turns Austin home service operators into category-defining brands. He writes about strategy, brand and the parts of paid media that don't get talked about enough. - Growth strategy - Brand - Paid media ## Related reading [### Web design built around the phone call](/services/web-design/)[### Hosting and maintenance that keeps you online](/services/hosting-maintenance/)[### Hosting: what it decides for your site](/dictionary/hosting/)