If you’ve been on Facebook this week, you may have seen people worrying about a “PHP problem.” I’ve gotten a few questions about it too, so here’s what’s going on in plain words, what it means for your website, and what I’ve already done about it.
What is PHP, and why does it matter?
PHP is the programming language behind a huge share of the websites on the internet, including WordPress, the most popular way to build a business website. When you load a page on a PHP website, PHP is working on the server behind the scenes to build that page.
So when there’s a serious security problem in PHP itself, it gets attention, and it should.
What happened?
On October 21, 2026, the PHP project released updates fixing two critical security flaws. Security researchers have nicknamed them “php2shell.” (Their official IDs are CVE-2026-109618 and CVE-2026-109619, if you like that kind of detail.)
Put simply, under the right conditions these flaws could let an attacker run their own code on a web server that runs PHP, without needing a password or login. Both were rated “critical,” the highest severity level.
According to the PHP Foundation and government cybersecurity agencies in Canada and the European Union, the problem affects PHP servers that handle web requests, across many common setups. These are the affected versions:
- PHP 8.5 before 8.5.12
- PHP 8.4 before 8.4.27
- PHP 8.3 before 8.3.36
- PHP 8.2 before 8.2.35
- Older versions (8.1 and earlier), which the PHP project no longer updates. Some hosting and Linux providers have released their own fixes for these older versions.
The plan was to announce this on October 22, but news leaked early, so the fixes and announcement came out a day ahead of schedule.
Is it fixed? Is it still a threat?
Yes, there’s a fix, but this is still an active situation. Updated versions of PHP are available, and major providers like Ubuntu have released patched packages. But a fix only protects a website once someone actually installs it on the server.
Security agencies are urging site owners to update right away. The European Union’s cybersecurity team (CERT-EU) notes that sample attack code has started circulating, which makes real attacks more likely. Canada’s Cyber Centre said that, as of October 21, it hadn’t seen active attacks yet, but added that this “can change quickly.”
In other words, the emergency isn’t over for sites that haven’t been updated. Sites running outdated or unsupported PHP versions are the ones most at risk.
What I did: I checked my servers
As soon as this news came out, I checked the servers I manage. Everything is fine.
That’s not luck. I’ve been building websites since 1999 and started Net Media Consultants in 2001, and over those years I’ve become very particular about two things:
- Where my servers are hosted. I don’t put client websites just anywhere. I choose hosting carefully because so much of your site’s safety and reliability starts there.
- The software and tools I use. I keep a close eye on what runs on my servers and on your website, and I’m careful about what I let in.
This isn’t new for me. Back in 2021 and 2022, when many Christians and conservatives were being deplatformed, I called my web host and my newsletter provider directly. I made a point of checking with every vendor behind the tools I use, so that none of my clients would have their websites or email lists pulled out from under them. That same care is why I watch closely when a security issue like this one comes along.
When your website is with Net Media, it’s kept updated and looked after. That includes the behind-the-scenes software like PHP that most people never think about until a headline like this one shows up. You shouldn’t have to keep track of security advisories. That’s my job.
What if your website isn’t hosted with me?
If your site is hosted somewhere else, or you’re not sure who looks after it, now is a good time to ask a few simple questions:
- What version of PHP is my website running?
- Has it been updated since October 21, 2026?
- Who is responsible for installing security updates on my server?
If nobody can answer those questions clearly, that’s worth looking into. Many business owners don’t find out their site was running old, unsupported software until something goes wrong.
Let’s take a look together
If you’d like a second set of eyes on your website, I offer a free 10-Minute Website Check. I’ll take a quick look and let you know, in plain English, anything that stands out.
👉 Request your free 10-Minute Website Check
Or just email me at jube@netmediaconsultants.com. I’m happy to answer questions, even if you’re just curious after seeing those Facebook posts.
Thanks for trusting me with your online presence. From Houston to clients across the country, keeping your website running well is something I take personally.
— Jube Dankworth, Net Media Consultants
Sources:
- PHP Foundation: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
- CERT-EU: https://cert.europa.eu/publications/security-advisories/2026-018
- Canadian Centre for Cyber Security: https://www.cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619
- Ubuntu: https://ubuntu.com/blog/php2shell-vulnerability-fixes-available
Recent Comments