What the PHP2Shell Vulnerability Means for Your Business’s WordPress Website

Update, October 26, 2026: Every RedTree-hosted WordPress website is running fully patched PHP. We’ll keep this post updated as the situation develops.

The PHP2Shell vulnerability is a critical security flaw in PHP, the software running underneath nearly every WordPress website. It went public on October 20, 2026, and the fix arrived a day later. Here’s the part that matters for your business: you can’t fix this one from inside WordPress. It’s handled by whoever hosts and maintains your site.

If you lead marketing or own your organization’s website, we’ll walk you through what happened, why it matters, and what to ask your web partner. No security degree required.

The short version

• What it is: Two critical flaws in PHP that could let an attacker take control of a website’s server without ever logging in.
• Who’s affected: Any WordPress website running on an unpatched version of PHP.
• Who fixes it: Your hosting provider or web partner. Updating WordPress or your plugins won’t fix it.
• What to do: Confirm with your web partner that your site is patched. If RedTree hosts your website, you don’t need to do anything.

What Is PHP2Shell?

Security researchers nicknamed PHP2Shell for two critical vulnerabilities in PHP, the programming language that powers WordPress and much of the web. PHP’s own security team rated both flaws critical. Translation: this was a big deal.

Here’s the easiest way to picture it. Think of PHP as the electrical wiring in the walls, and your website as the appliances plugged into it. This problem is in the wiring. That’s why it’s handled at the building level by your host, not by changing anything inside your website.

Security researchers discovered the flaws and reported them privately so a fix could be prepared quietly. Then the details leaked online on October 20, before the fix was ready. Not ideal. As Huntress explains in its rapid response report, the PHP team moved its release up and shipped patched versions on October 21.

Why the alarm? In the wrong hands, these flaws could let someone run their own commands on a web server without a password. That could mean a defaced website, stolen information, or a site that’s quietly used to attack others.

Why This Matters for Your Business’s WordPress Website

We talk about WordPress security a lot, and usually the culprit is an outdated plugin. Not this time. PHP2Shell lives in the wiring: below WordPress, below your plugins, below everything your team touches day to day.

That changes who’s responsible. As Wordfence points out, updating WordPress doesn’t update PHP. Your team could do everything right on their end and still be exposed.

And this isn’t just an IT problem. For a business, the risks look like this:

• Downtime: A compromised or emergency-patched site can go offline, taking leads, sales, and donations with it.
• Data exposure: Form submissions, customer details, and stored credentials could be at risk.
• Search visibility: Hacked sites can be flagged by Google, which hurts rankings and traffic you’ve worked hard to earn.
• Brand trust: A warning screen or defaced homepage is not the brand experience you’ve worked so hard to build.

The seriousness showed in how organizations responded. The UK’s National Cyber Security Centre told organizations that couldn’t patch to consider taking systems offline. Government, school, and hospital websites across Europe went dark as a precaution while fixes were applied.

Not to be confused with wp2shell: That was a separate flaw in WordPress itself, disclosed in July 2026. PHP2Shell is in the PHP layer underneath WordPress.

Where Things Stand Now

Attackers started probing websites almost immediately, but early attempts largely failed. In its follow-up report, Wordfence said its firewall had intercepted more than 74,000 attempts across the 5 million WordPress sites it protects, with no confirmed compromises.

That window is closing. On October 26, BleepingComputer reported the first confirmed successful attacks.

So here’s where we land: the grace period is over. If your website isn’t patched, treat it as at risk.

What Did RedTree Do?

Websites hosted with RedTree run on our dedicated server through WP Engine, so protection started at the hosting level within hours, without clients lifting a finger. Here’s how it played out, based on WP Engine’s own account.

• Overnight, October 21: Shortly after midnight, WP Engine turned on new firewall rules to block suspicious traffic tied to the vulnerability.
• By 3:00 a.m.: It applied the recommended protective settings across its platforms while waiting for official patches.
• Later that day: Official PHP patches were tested and rolled out. WP Engine confirmed every customer site is running fully patched PHP.
• The result: Its firewall blocked more than one million related requests in 24 hours, with no successful attacks.

Our team monitored client websites and the situation as it developed. On October 22, we sent every RedTree client a plain-English note explaining what happened and confirming they didn’t need to do anything.

“Our clients shouldn’t have to learn what PHP2Shell is. Our job is to know what’s happening underneath their website, act on it quickly, and tell them in plain English what it means for their business.”

Meesha Gerhart, Founder & CEO, RedTree Web Design

Honestly? Our clients didn’t have to think about any of this. That’s exactly what our web hosting and website maintenance plans are built for.

What Should You Do Now?

If RedTree hosts your website: Nothing. That’s why you have us. Your website is patched, and we’re keeping an eye on it.

If you work with another web partner or host, here’s how to make sure your website is covered.

1. Know who owns the layer underneath your website. On most hosting plans, only the host can update PHP. If no one on your team can say who handles it, that’s the first gap to close.
2. Ask your web partner three direct questions. Has our website’s PHP been updated to a patched version? What protection was in place before the patch? Is our site running an older PHP version that won’t receive an official fix?
3. Notice how they respond. A good partner responds quickly, explains things in plain English, and doesn’t make you chase them. If you’re hearing about PHP2Shell from a blog post (hi!) instead of from your web partner, that’s worth a conversation.
4. Watch for warning signs. New admin users no one created, unexpected pages or content changes, or security warnings in Google are all worth raising right away.

If your team has WordPress admin access, you can also check your PHP version yourself under Tools → Site Health → Info → Server. Your web partner can tell you whether that version is patched.

PHP2Shell FAQ

What is PHP2Shell?

PHP2Shell is the nickname for two critical vulnerabilities in PHP, the software WordPress runs on. They could let an attacker take control of a web server without logging in. They’re officially tracked as CVE-2026-109618 and CVE-2026-109619.

Is my WordPress website affected?

Any WordPress website running an unpatched PHP version is at risk. Your hosting provider or web partner controls your PHP version, so they’re the right people to ask.

Will updating WordPress or my plugins fix PHP2Shell?

No. PHP runs underneath WordPress, so updating WordPress, themes, or plugins doesn’t change it. Only your host can install the PHP update.

Does a security plugin or firewall protect my website?

A firewall can help by blocking attack attempts while we roll out a fix. It isn’t the fix, though. The only full solution is a patched version of PHP.

Is PHP2Shell the same as wp2shell?

No. Wp2shell was a separate flaw in WordPress itself, disclosed in July 2026. PHP2Shell affects PHP, the layer underneath WordPress.

Has anyone been hacked through PHP2Shell?

Early attacks largely failed, but the first confirmed successful attacks were reported on October 26, 2026. That’s why patching your website matters now.

I’m a RedTree client. Do I need to do anything?

If RedTree hosts your website, no. Your site runs on our dedicated WP Engine server, which is fully patched, and our team continues to monitor it. If your site is hosted somewhere else, reach out and we’ll help you confirm it’s been patched. Either way, we’re always here to chat.

Not Sure Who’s Watching Underneath Your Website?

Your website is one of your hardest-working brand assets. It deserves a partner who’s watching the wiring, not just the paint. For our clients, this week was a non-event, and that’s exactly how it should feel.

If you’re not sure how your website is hosted, maintained, or protected, let’s chat. We’ll take a look and give you the real talk on what we see.