Paid media
Social media
SEO
AI automation
Web design
AI content
Branding
Lumia MKT Team
This week the internet went through one of its biggest security alerts in years. On October 20, 2026, PHP2Shell went public: the name given to two critical flaws in PHP, the programming language that powers about 70% of the world's websites. On October 21, PHP released emergency patches and, that same day, cybersecurity firms were already reporting real attack attempts.
If your business has a website, an online store or a WordPress site, this article is for you. We explain what happened, why it is so serious and what you should check today, in plain English.
What PHP2Shell is and why everyone is talking about it
PHP is the engine behind most websites: WordPress, WooCommerce, Joomla, Drupal, Magento and thousands of custom-built sites. When someone fills out a form, buys from an online store or logs in, PHP is almost always working behind the scenes.
The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, received a severity score of 9.2 out of 10. Put simply, they let an attacker run code on the server that hosts your site without a username or password. They can also expose parts of the server's memory, which sometimes holds passwords, API keys or data from other visitors.
The trickiest part: the problem lives in PHP itself, not in your website. Even if your site is well built and your plugins are up to date, the risk is there if your server runs a vulnerable PHP version. The flaws affect versions from PHP 5.4, released in 2012, through PHP 8.5.
How artificial intelligence found a flaw hidden for years
Part of this story matters as much as the flaw itself. According to public documentation, one of the bugs had been known since 2024 but was never fixed because it was considered very hard to exploit. In August 2026, security researchers auditing PHP's code with help from state-of-the-art AI models found a way to turn it into a real attack.
The lesson is clear: AI does not only speed up marketing or software development. It also speeds up the hunt for vulnerabilities, for defenders and attackers alike. What used to take months of research can now take days, which is why businesses need shorter response times.
Timeline of a chaotic week
| Date | What happened |
|---|---|
| October 17 | Amazon detects an exploitation attempt on its sensors, four days before the problem went public. |
| October 20 | News of the flaws leaks. Cloudflare reports early signs of attacks and turns on temporary protection rules. |
| October 21 | PHP releases the emergency patches, one day ahead of schedule. Security firms observe real attack attempts that same day. |
| Following days | Governments and large organizations take sites offline as a precaution while they update, including government portals in Europe. |
PHP versions that are already protected
These are the officially patched versions. If your server runs this version or newer within the same branch, you are protected against PHP2Shell:
- PHP 8.5.12 or newer
- PHP 8.4.27 or newer
- PHP 8.3.36 or newer
- PHP 8.2.35 or newer
What your business should do today: a 6-step checklist
- Find out your PHP version. In your hosting control panel (cPanel, Hostinger hPanel, Plesk or another), look for "PHP Configuration" or "PHP Version." The exact number shows up there.
- Request or apply the update. If you are on shared hosting, contact support and ask whether they have applied the patches for CVE-2026-109618 and CVE-2026-109619. Reputable providers are doing it automatically, but confirm.
- Update your site too. When you upgrade PHP, make sure your WordPress install, theme and plugins are compatible. Make a backup first.
- Rotate passwords and sensitive keys. Since the flaw can expose server memory, it is good practice to change admin and database passwords, plus the API keys for payment gateways or your CRM.
- Look for signs of intrusion. Strange PHP files on your site, admin users you did not create, odd redirects or a spike in spam sent from your domain are red flags to review with an expert.
- Add a layer of protection. A web application firewall (WAF), such as Cloudflare's or your hosting provider's, helps block automated attacks while you update.
Why this is also a marketing issue
A compromised website is not just a technical problem. Google can flag it as dangerous and drop it from search results, your Google and Meta ads can be rejected, emails from your domain start landing in spam and, most costly of all, your customers lose trust. Years of SEO work can collapse in a single afternoon. If your site handles customer data, a breach can also trigger obligations under the data-protection laws that apply in your market.
That is why at Lumia we build websites with security baked in from the ground up: fast, lightweight pages, no unnecessary plugins, forms protected against bots and servers running up-to-date PHP. Want to see how we work? Check out our web design and development service.
FAQ about the PHP vulnerability
Is my WordPress site at risk? WordPress runs on PHP, so it depends on your server's PHP version. If it is older than the patched versions, yes.
Is updating my plugins enough? No. The flaw is in PHP, the server's engine. You need to update PHP, not just your site.
What if my site is on a platform like Wix or Shopify? On those closed platforms, the provider manages the infrastructure. Even so, it is worth checking their official announcements.
How long does the fix take? In most cases, switching the PHP version in your hosting takes minutes. What takes longer is testing that your site still works properly.
Is your website in safe hands?
If you do not know which PHP version your site runs, who manages it or when the last backup was made, it is time to turn on the light. In a free 30-minute strategy session we review the state of your website with you and tell you what to tackle first. Shall we take a look together?
Sources: The Hacker News · Wikipedia, PHP2Shell · Axios · TechCrunch, CISA alert · TechCrunch · Infobae (Spanish). Information current as of the publication date; always check the official advisories from PHP and your hosting provider.
