A serious security hole was found in the software behind most websites. Here is what to do today.
Many websites run on a free piece of software called PHP. News reports say about 7 in 10 sites use it, including lots of sites for landscapers, cleaners, churches and shops. This week, two serious holes were found in it. A stranger on the internet may be able to take over a website that hasn't been fixed, without needing any password. Fixes came out on October 21, 2026. Attackers are already trying to use the holes.
It isn't your fault, and nothing you did caused it. The fix is a software update, and it's done by whoever runs your website's server, usually your hosting company.
This small, technical problem can threaten your whole livelihood.
For most small businesses, the website is how new customers find you, trust you and call you. If it's taken over, shows a warning, or disappears, those customers don't wait. They go to the next business on the list. Work that used to come in can stop, and winning it back takes far longer than losing it did.
The people who come out of this fine are the ones who are positioned correctly: they know what their site runs on, they've asked their host to confirm it's fixed, and they have a plan B if it isn't. You can do all three today, and we show you how below.
What a stranger could do to a site that isn't fixed
- Read your customers' information: names, emails, phone numbers, messages, and anything else your site keeps.
- Send your visitors to scams, or put fake pages up under your business name, so people stop trusting you.
- Send junk email that looks like it came from you. That can send your real emails to people's spam folders.
- Hide harmful software on your site. Google can then put a warning in front of your customers when they try to visit.
- Lock you out or delete your site, and leave you paying to get it back.
Could this be you? If a company built your site on WordPress, or it sits on ordinary web hosting, it may be. You usually can't tell by looking at your site. That's what the free check below is for. It takes about a minute, and you don't need to know anything technical.
Please do your own research.
Don't take our word for it, and don't take anyone's who is selling something. This page is a public notice, not an ad. Read what major news organizations are saying, and decide for yourself. Three good places to start:
- CNBC: "'PHP2Shell' vulnerability: What is it, and is your data at risk?" Written for everyday readers.
- CNN: "Websites shut down globally after AI finds cybersecurity flaw affecting 70% of the internet" Reports that sites were taken offline as a precaution.
- The Register: "Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure" Says attackers made millions of break-in attempts within days.
Some news sites may ask you to accept cookies or may load slowly. If you want the technical details, they are in the "Sources" box at the bottom of this page.
What happened, in plain words
PHP is the free software that builds many web pages every time someone visits. It's not a program on your computer. It runs on the computer that holds your website, called the server. The people who make PHP announced on October 21, 2026 that it has two serious holes.
- It's serious. The people who make PHP gave it 9.2 out of 10 for how dangerous it is.
- Nobody needs your password. A stranger may be able to take control of an unfixed site from anywhere in the world.
- It's already being tried. News reports say attackers began trying it within hours of the announcement, and some say the attempts number in the millions.
- Only an update fully fixes it. PHP says the temporary tricks online are only partial and don't make a site safe.
Technical details (for your web person)
- CVE-2026-109618 and CVE-2026-109619. Both can allow unauthenticated remote code execution. PHP rates each 9.2 on the CVSS v4.0 scale. Some outside researchers have cited 10.0.
- PHP says all installations serving web requests are at risk, and rates Apache with mod_php highest.
- According to BleepingComputer, Cloudflare's chief technology officer said they were seeing early attacks around the time the fixes were released.
The fixed versions
| If your server runs PHP | It needs at least |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
PHP 8.1 and older no longer receive regular updates. PHP published limited fixes for the 7.4, 8.0 and 8.1 lines, and some hosting companies supply their own patched versions. If you are on one of those, ask your host exactly what they have done.
On October 23, PHP posted a separate informational notice about a related issue (CVE-2026-115560) and advised the same upload-progress setting while a full advisory is prepared.
This is still developing. We will update this page as more is published.
Does this affect my website?
WordPress, or a site someone custom-built for you
These usually run on PHP. You may be exposed until your hosting company has installed the update.
Wix, Squarespace, Shopify, GoDaddy and other site builders
The company runs the servers, not you. It's reasonable to email them and ask what they've done about this.
A simple site made of plain pages
These don't use PHP, so they don't have these two holes. Websites made by Yes On Purpose do not use PHP.
Run the free check below
It takes about a minute and only looks at what anyone visiting your site can already see.
Not having these two holes doesn't mean a site is safe from everything. This page is only about this one problem.
Free quick check
Type your website address, like yourbusiness.com. We will look at what visitors can already see and tell you whether you should ask for help.
We fetch one public page, the way a visitor would. We do not save the address you type, and we cannot see anything private.
What to do today
- Find out what your website runs. Use the free check above, or ask whoever built your site. If it was built with WordPress, it runs on PHP.
-
Ask your host, in writing.
Your hosting company is the one you pay to keep your website online. Copy the message below, email it to them as is, and keep their reply. They will know what the numbers mean:
Has the server for my website been updated to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or a vendor-patched version) to fix CVE-2026-109618 and CVE-2026-109619? If not, when will it be?
- If your host says your site is on a very old version, ask what they can do. Old versions no longer get regular updates. Ask whether they can fix it or move you to a newer one.
- Updating WordPress does not fix this. The hole is in the server's software, not in WordPress or its plugins. Keep your backups and updates going as usual, but the server update is what closes this.
- Watch for warning signs. Pages you didn't make, new users you don't know, your site sending visitors somewhere else, or a message from your host. If you see any of these, contact your host and get help right away.
- If your host cannot confirm a fix, have a plan B. Consider taking the site offline, or putting a simple page up in its place, until they can. We can set that page up for you today, for free (see below).
Your plan B: a free one-page site, today
If your website is down, offline for safety, or you cannot get answers from your host, we will build you a simple one-page website, free, the same day. It is for nonprofits, charities, churches and small businesses.
- Your name, what you do, and how people can reach you
- A link to give, book, or get in touch
- Plain simple pages, so there is nothing to patch
- No cost and no obligation. If you later want a full website, we can talk then.
Sources and how we checked
Technical names and links for anyone who wants them. Every fact above comes from the sources below, last checked October 23, 2026. Where sources disagreed, we say so or we left the detail out.
- PHP.net: security announcement of October 21, 2026 and the notice of October 23. Source for the CVE numbers, the 9.2 rating, the fixed versions, the backport note, and the advice that updating is the only complete fix.
- PHP advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618) and GHSA-6wmf-4rv5-p3rp (CVE-2026-109619).
- News coverage for a general reader: CNBC, CNN and The Register.
- BleepingComputer: report of early attacks seen by Cloudflare, and the note that some researchers rate the flaws 10.0.
- NCSC-NL: php2shell: the Dutch national cyber security centre's tracking page, used to cross-check affected server types and the fixed versions.
The free check looks for visible signs only: server headers, cookies, common website platforms and links. A site can run PHP without showing any of these, and a site that shows them is not necessarily unpatched. That is why we call every result preliminary.