PHP2Shell: We'll Fix Your Website and Make It Secure

21 October 2026 will be remembered as a black day for the internet. Governments switched their own websites off, security agencies told everyone running PHP to patch or go offline, and millions of business websites woke up exposed to a flaw called PHP2Shell. We are fixing websites for businesses right now: send us your link and we fix your website, patch it fast and make it secure, so you can get back to running your business. Below is what happened, how to check whether you are exposed, exactly what we do, and the do-it-yourself steps if you prefer to handle it in-house.

What PHP2Shell is, in plain words

PHP2Shell is the name security researchers gave to two flaws in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619. They are rated 9.2 out of 10 for severity. In plain words: an attacker who finds a vulnerable server can run their own code on it without logging in. That means they can change your pages, plant redirects to scam sites, steal form submissions and customer data, or use your server to attack others.

Every PHP version from 5.4 onwards is affected, which covers almost every WordPress, WooCommerce, Laravel, Magento and custom PHP site built in the last twelve years. Amazon's threat team spotted an attempt to use it on 17 October, four days before the fix was even announced.

Is your website affected?

• ✦Yes, if your site runs on WordPress, WooCommerce, Laravel, CodeIgniter, Magento, OpenCart or custom PHP code.
• ✦Most at risk: sites on Apache with mod_php, which is common on cheap shared hosting, because the attack can run before any of your site's own code does.
• ✦Not affected: Shopify, Wix, Squarespace and Webflow sites, which do not run on PHP you control.

We fix your website and make it secure, fast

You don't need to touch cPanel, plugins or servers. Send us your website link on WhatsApp or through our contact form, and our web team takes it from there:

1. 1A free check: we tell you your PHP version, your hosting setup and whether you are exposed, usually the same day.
2. 2Backup, then patch: PHP updated to a fixed version, WordPress core, plugins and themes updated, unused ones removed.
3. 3Compromise check: admin users, recently changed files, redirects and Google's security reports reviewed.
4. 4Hardening: a firewall in front of the site, automatic backups and update monitoring switched on.
5. 5Test and report: forms, checkout and bookings tested, and a short plain-language report of what we changed.

Sites that are too old to patch safely get an honest answer and a quote for a rebuild on a modern, maintained setup, so the next black day is a five-minute update for you instead of a crisis. Either way, you get a website that is fixed, secured and watched.

Prefer to do it yourself? The 30-minute checklist

1. 1Back up everything first: files and database. If an update breaks something, you roll back in minutes instead of days.
2. 2Check your PHP version: in WordPress go to Tools, Site Health, Info, Server; in cPanel open MultiPHP Manager or Select PHP Version.
3. 3Update PHP to a fixed version: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. For most sites, 8.3 or 8.4 is the sensible choice.
4. 4Update WordPress core, every plugin and every theme, and delete the ones you no longer use.
5. 5Restart PHP or ask your host to, so the new version is actually the one running.
6. 6Test the site on a phone and a laptop: forms, checkout, bookings and the WhatsApp button.
7. 7Check the version again after the restart. A surprising number of sites are 'updated' in the panel but still running the old PHP.

On PHP 8.1 or older? Upgrade, don't wait for a patch

PHP 8.1, 8.0 and 7.4 no longer receive normal updates. The PHP team published emergency fixes for them as source code only, which almost no shared host will compile for you. In practice the fix for an old site is an upgrade to PHP 8.3 or 8.4, which can break very old plugins and themes. That is the moment to replace them, not a reason to stay exposed.

How to tell if your site was already hit

Because attempts started before the announcement, security firms advise reviewing activity from 1 August 2026 onwards. Look for:

• ✦Admin users you don't recognise in WordPress.
• ✦Files changed recently that nobody on your team touched, especially in the uploads folder.
• ✦Your site redirecting some visitors to betting, crypto or pharmacy pages, often only on phones or only from Google.
• ✦A 'This site may be hacked' warning in Google results or in Search Console.
• ✦Your host suspending the account for sending spam or using too much CPU.

This attack happens below your website's own code, so your site's logs may show nothing. If you see any of the signs above, change every password, restore from a clean backup and get the site scanned properly before you relaunch it.

Why a security plugin alone won't save you

Security plugins and firewalls that run inside WordPress are good at blocking login attacks and known bad requests, but PHP2Shell strikes before they load. A firewall in front of the site, such as Cloudflare, helps while you patch, and Cloudflare added rules for this flaw. But the only real fix is updated PHP on the server.

Keep your website secure from now on

PHP2Shell was found with the help of AI, and AI will find more flaws like it, faster than before. Patch windows are getting shorter. The websites that come through untouched are the ones on a maintenance routine: updates applied within days, backups every day, and someone watching. That is what we provide. Send us your website link today, and we will fix it, secure it and keep it that way.