The PHP security flaw: how to check if your website is affected

The short version: if your website runs on WordPress, Joomla, Drupal or anything else built with PHP, ask whoever hosts it to confirm today, in writing, that PHP has been updated. Updating WordPress and its plugins is not enough on its own. If they can’t confirm it, the National Cyber Security Centre (NCSC) says to consider taking the site offline until they can.

What’s happened

On 21 October 2026 the PHP project released fixes for two critical flaws in PHP, the programming language behind a huge share of the world’s websites, including most WordPress sites. The flaws, known as CVE-2026-109618 and CVE-2026-109619 and nicknamed “php2shell”, can let an attacker run their own commands on a web server without logging in. PHP rates both 9.2 out of 10 for severity.

The fixes were meant to come out later in the month, but details leaked, so the release was brought forward. Attackers moved quickly. Amazon’s threat intelligence team recorded an exploitation attempt on 17 October, four days before the public announcement, and Cloudflare says it has seen millions of attempts on its network. In the UK, some government services were taken offline as a precaution while fixes went in. The NCSC says it has seen no indication of successful breaches in the UK so far, but calls the scale of this “unprecedented”.

Are you affected? A two-minute check

Work through these in order. Most firms will have their answer by the third question.

1. What is your website built on? If you’re not sure, ask whoever built it, or look at the address of the page you use to log in and edit it. WordPress, Joomla, Drupal, Magento and WooCommerce all run on PHP, and so do many bespoke sites built by smaller web agencies.
2. Who runs the server?
   • A fully hosted website builder such as Wix, Squarespace, Shopify or WordPress.com: the platform runs the servers and is responsible for any fix. There’s nothing for you to update.
   • A hosting company or web developer, which is the usual setup for a WordPress site: they need to update PHP. This is the group that needs to act today.
   • Your own server, in your office or rented: you or your IT provider need to update it.
3. Which PHP version are you on? In WordPress, go to Tools, then Site Health, then the Info tab, open the Server section and look for PHP version. In a cPanel or Plesk hosting account, look for the page that sets your PHP version. Then compare it with the table below.

Which versions are fixed

Some patched versions for older PHP keep their original version number, so the number on its own won’t always tell you whether you’re safe. Written confirmation from your host is the reliable answer.

What to ask your host or web developer

Copy this into an email and fill in your website address:

A good host will reply quickly and specifically. A vague answer, or no answer, tells you something too. Keep the reply: your insurer, or your Cyber Essentials assessor, may ask what you did and when.

If the fix can’t go in today

The NCSC’s advice, in order, is:

1. Update PHP to the latest version.
2. If that can’t be done straight away, apply the temporary settings the PHP project has published. These reduce the risk, but PHP is clear that “there are no complete mitigations, updating is the only safe choice”.
3. If neither can be done quickly, consider taking the site offline until it’s fixed.

A day with a holding page is inconvenient. A website used to spread malware, or to take your clients’ details, is much worse.

Check for signs of a break-in

Attacks started before the fix was public, so patching now doesn’t prove nothing happened earlier. The NCSC recommends checking systems for evidence of compromise, including backdoors an attacker may have left behind. Ask your host or developer to review the server from 17 October onwards, and look yourself for:

• admin or user accounts on your website that nobody recognises
• pages, links or files you didn’t add, or content that has changed
• visitors being redirected to other sites, or warnings about your site in browsers or Google
• warnings from your host about unusual activity
• emails going out from your website’s forms that you didn’t expect.

If you find any of these, don’t just delete them. Tell your host, note what you saw and when, and get help. The NCSC lists assured incident response companies on its website.

It’s not just websites

PHP is built into other systems too, including some webmail, client portals and booking systems, and the admin pages of some firewalls, phone systems and storage devices. If anything like that can be reached from the internet, check with the supplier for an update. The Dutch NCSC is keeping a list of products that include PHP, linked below.

Want us to take a look?

Our free security snapshot already checks your website software from the outside. From outside we can often tell whether a site runs PHP, and sometimes which version, though not always. We’ll tell you what we can see and exactly what to ask your host. Email Ross with your website address, or call 07885 972 512.

If your website runs on WordPress and you’d rather not go through this again, our sister company AlphaPixel builds websites with no PHP, database or plugins to patch. Get today’s fix in first, though: moving a website takes days, and patching takes minutes.