If your business has a website, there is a strong chance this affects you.
On 21 October 2026, the team behind PHP released emergency fixes for two critical security flaws, nicknamed PHP2Shell. PHP is the programming language running behind roughly 70% of the web, including WordPress, WooCommerce, Magento and many of the online stores and booking systems Gulf businesses rely on every day.
The flaws let an attacker take control of a website by sending one specially crafted request. No password. No login. Once inside, they can steal customer data, plant spam or malware, or use your site to target your customers.
The good news: the fix exists, and for most businesses it takes one conversation with whoever hosts your website. This guide explains what happened in plain language and the three things to do this week.
What is PHP2Shell?
PHP2Shell is the name for two critical vulnerabilities in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 for severity, and they reach back to PHP 5.4, more than a decade of releases.
Here is the simple version. Every time someone visits a PHP website, the server sets aside a bit of memory to build the page, then cleans up afterwards. Researchers found that if a request makes PHP fail halfway through, that clean-up goes wrong. A skilled attacker can then shape what sits in that memory and get the server to run their own commands. That is the “shell” in PHP2Shell: control of the server.
Two things make this different from the usual security scare:
- The flaw is in PHP, not your website. Your site can be well built and fully up to date and still be exposed. Updating WordPress or your plugins will not fix it. The WordPress security team has confirmed no WordPress update is needed or planned; the fix has to happen on the server.
- Attacks have already started. Security firm Patchstack reported confirmed exploitation on the day the patch was released, and attack attempts may date back to 17 October.
How AI found a bug hiding for over a decade
The most striking part of this story is who found it. In August 2026, a researcher at California security firm Calif found the first flaw with help from OpenAI’s GPT-5.6 Sol model, during an audit of PHP’s code funded through OpenAI’s Patch the Planet initiative. Weeks later, Google’s Wiz team found both flaws independently using its own AI tools. Both teams took over test WordPress sites without logging in.
The weakness itself was not entirely unknown. A 2024 external audit of PHP spotted early signs of the underlying problem, but nobody could show a working attack at the time, so the fix stalled.
It was considered too complicated to exploit. Calif even traced the bug’s roots to PHP research from 2004.
What changed in 2026 was AI. As Wiz put it in its announcement, the vulnerable code had been sitting there for years; AI made it possible to understand the weakness and turn it into a working exploit.
That cuts both ways. The same tools helping defenders find old flaws are available to attackers. For business owners, the lesson is simple: the window between a flaw going public and attackers using it is shrinking, so patching quickly matters more than ever.
Why you’re seeing so many maintenance pages
If websites you use this week have shown “down for maintenance” pages, this is likely why. Government advice has been blunt: patch now, or take the site offline until you can.
In the US, the NSA and FBI advised taking affected systems offline if they could not be updated immediately. Government portals, systems supporting Wikipedia, the Finnish government and several UK public bodies temporarily pulled services offline as a precaution. Hosting companies have also been rolling out patches across their servers, which can mean brief outages or temporary limits on file uploads.
A short planned outage is a sign a business is taking security seriously. If your own site needs to go offline for a few hours, a quick note to customers on social media goes a long way.
3 steps to protect your website this week
1. Ask your host to install the PHP fix now
This is the step that actually closes the door. Contact whoever hosts or manages your website today and ask them to confirm the PHP security update is installed on your servers. The patched versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 or newer.
If you use WordPress, you can check your version yourself under Tools > Site Health > Info > Server. Some hosts apply the fix without changing the version number, so if yours looks older, ask them to confirm in writing.
If your site runs PHP 8.1 or older, it no longer gets official security updates. Plan an upgrade to PHP 8.3 or newer, since 8.2 reaches end of life on 31 December 2026.
2. Change passwords and turn on two-factor authentication
One of the flaws can leak passwords and access keys from server memory. Once your host confirms the patch is in, reset the passwords for your website admin and hosting accounts, and ask your developer to replace the connection keys your site uses for payments, email marketing and other tools.
Then switch on two-factor authentication (2FA) everywhere you can: your website, hosting account, domain registrar and email. Even if a password has been exposed, 2FA stops someone from logging in with it.
3. Watch out for phishing emails using this news
Scammers love a headline. Expect emails that look like they come from your host, bank or software provider, warning about “emergency maintenance” or asking you to reset your password through a link.
- Don’t click links in unexpected emails. Go to your provider’s website directly or call their official number.
- Don’t install any “PHP2Shell fix” plugin or code snippet from a forum or social media post. Security firm Patchstack has warned against unofficial fixes, and some may contain malware.
- Be wary of unsolicited calls or messages offering to fix the problem for you.
Questions to send your web host or developer today
You don’t need to be technical to get a clear answer. Copy these into an email and keep the reply on file:
- Which version of PHP is our website running, and does it include the fixes for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)?
- When was the fix applied, and was the server restarted afterwards?
- Are all our sites covered, including test sites, landing pages and older sites we no longer use?
- If we are on PHP 8.1 or older, what is the upgrade plan and timeline?
- Have you checked our site for signs of a break-in since 17 October, such as unknown admin accounts or unfamiliar files?
Ask the same of any vendor that runs an online tool for you, such as a booking system, customer portal or ecommerce platform.
Why this matters for your search visibility too
A hacked website is not only a security problem. Attackers often use compromised sites to publish hidden spam pages, which can trigger Google’s “This site may be hacked” warning and wipe out rankings that took years to build. That same spam can also be picked up by AI assistants like ChatGPT and Gemini when they answer questions about your brand.
Once you’re patched, keep an eye on Google Search Console for security alerts or a sudden jump in indexed pages you don’t recognise. If your site does need to go offline, ask your developer to show a proper temporary maintenance status (a 503 code) so Google knows the outage is short-term.
