Your Website’s Engine Just Got an Emergency Fix: What PHP2Shell Means for Your Business

By Tiffany L. Reed, Founder & CEO, Queen & Vine · October 22, 2026

If your business website runs on WordPress, this one is worth five minutes today. On October 21, 2026, PHP, the code that runs WordPress and most of the websites small businesses depend on, released an emergency fix for two critical security flaws (“Today’s PHP Security Release”). Researchers are calling them PHP2Shell.

No need to panic. But don’t assume you’re covered, either. Here is what happened, what that scary headline really means, and the three questions to send your web host before the day is out.

What Happened
PHP released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21 for two flaws that, under the right conditions, let someone with no login run their own code on the server behind a website (“Today’s PHP Security Release”). Both flaws are rated 9.2 out of 10 for severity (“PHP Fixes”).

The timing is what makes this urgent. Amazon’s security team saw the first attack attempts on October 17, four days before the fix existed, and after the fix went public it described the flaws as broadly exploited (“Amazon Threat Intelligence”). Amazon has not said how many of those early attempts succeeded, so the honest word is attempts, not hacks.

What the “70% of Websites at Risk” Headline Really Means
You may have seen headlines saying 70 percent of websites are at risk. Here is where that number comes from: PHP runs 69.3 percent of the websites whose server language is known (“Usage Statistics of PHP”). That is a count of who uses PHP, not of who can be broken into.

Whether your site is actually exposed comes down to three things: which PHP version it runs, how your host connects PHP to the web server, and whether your host has already applied the fix. Many managed WordPress hosts update PHP for their customers, but the only way to know is to ask.

Who Should Check First
A study of WordPress sites earlier this year found only about 3 in 10 running a supported version of PHP (“WordPress EOL PHP”). That study is from July 2026, before PHP2Shell, but it shows how many business sites sit on old versions nobody has looked at in years. Check first if any of these sound like you:

1. Your site runs PHP 8.1 or older. Those versions no longer get official fixes, so they need an upgrade, not a patch (“PHP Fixes”).

2. Your site is on budget shared hosting that nobody on your team manages.

3. The person who built your site is gone, and nobody is sure who holds the login.

4. Your site runs PHP 8.2. It is patched in this release, but its support ends on December 31, 2026, so plan the move now (“Supported Versions”).

Three Questions to Send Your Web Host Today
A short email or text is enough. Ask for the answers in writing:

1. Is my site on PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor build that includes the fix?

2. If my site is on PHP 8.1 or older, what is the upgrade plan, and by what date?

3. Did you check my site’s logs back to October 17?

If you would like to see your version yourself, it takes about thirty seconds in WordPress: go to Tools, then Site Health, then Info, then Server, and look for the PHP version.

What Waiting Quietly Costs
None of this shows up as a bill. It shows up as a site that slows down or sends visitors somewhere strange, a Google warning in front of your business name, or a weekend lost to cleanup. Your website is usually a buyer’s first impression of you, and it is the place every other listing points back to. Keeping it current is one of the cheapest kinds of brand protection there is.

How We Help
Queen & Vine is not a security firm, and we will never promise anyone a hack-proof website. What we do is help owners know exactly who hosts their site, who holds the keys and whether it is current, and then keep that in step with every other place customers find them. If you are not sure who hosts your site, that is the first gap to close, and we are happy to help you find out.

Do you know which PHP version your site runs right now? Yes, no or “what’s PHP?” are all fair answers.

Crowning your brand with success!

Sources
“Amazon Threat Intelligence Identifies PHP2Shell Exploitation Prior to Public Disclosure in MadPot.” AWS Security Blog, Amazon Web Services, Oct. 21, 2026, aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/.
“PHP Fixes Two Critical RCE Vulnerabilities.” GBHackers, Oct. 22, 2026, gbhackers.com/php-fixes-two-critical-rce-vulnerabilities/.
“Supported Versions.” PHP, The PHP Group, accessed Oct. 22, 2026, http://www.php.net/supported-versions.php.
“Today’s PHP Security Release and How We’re Strengthening PHP Security.” The PHP Foundation, Oct. 21, 2026, thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/.
“Usage Statistics of PHP for Websites.” W3Techs, Q-Success, Oct. 22, 2026, w3techs.com/technologies/details/pl-php.
“WordPress EOL PHP.” Censys, July 2026, censys.com/blog/wordpress-eol-php.