PHP Security Alert: Is Your Business Website Affected?
Recent headlines about PHP security vulnerabilities have left many business owners wondering whether their websites are at risk.
The reassuring news is that fixes are available, and not every website is affected. What matters is the technology your site uses and whether the relevant security updates have been applied.
What has happened?
Two critical vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619 and commonly called PHP2Shell, were disclosed on 21 October 2026.
PHP is software that runs on web servers. Under certain conditions, these flaws could allow an attacker to run code on an affected server without logging in. The PHP team has released security updates and urges users to update promptly. Read the official PHP security advisory.
Is my WordPress website affected?
WordPress uses PHP, so its hosting environment needs checking. Having an affected version does not mean your website has been hacked.
Updating WordPress, themes or plugins alone does not patch PHP. Your hosting provider or server administrator needs to confirm that the underlying PHP installation has received the fixes.
What about Wix?
Standard Wix sites do not support PHP code. Wix’s custom development tools use JavaScript, so we would not expect the website itself to be directly affected by these particular flaws.
If your Wix site connects to a separately hosted service, that service may need its own check. See Wix’s documentation on PHP support.
What about custom apps?
A custom app running on JavaScript, TypeScript, Python or static HTML, with no PHP component, is not directly affected by these PHP flaws. An app that uses a PHP backend needs checking, wherever it is hosted.
That is why we review the technology behind each site and app individually.
How do I check my website?
Start with your hosting provider or technical contact. Ask them to confirm whether your website uses PHP and whether both CVE-2026-109618 and CVE-2026-109619 have been patched.
The fixed PHP releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Some hosting providers use vendor packages containing equivalent fixes, so a version number alone may not settle the question. PHP’s update guidance.
You do not need to make unfamiliar server changes yourself. Getting confirmation from the person responsible for your hosting is a useful first step.
What we’re doing
We are currently reviewing the sites and apps we manage, checking which technologies they use and whether any relevant updates are required.
If we manage your website, no action is needed from you at this stage. We will contact you directly if anything requires attention.
Unsure about your website? Whether you are a current client, we have worked together before, or you simply need some guidance, get in touch with your website address. We would be happy to help you understand what needs checking.