Intro
On October 21, 2026, the PHP project released emergency fixes for two critical security flaws, nicknamed PHP2Shell. PHP runs behind a huge share of the web, including every WordPress, Joomla, and Drupal site.
If your business website was built on one of those, this is worth five minutes of your week. It also raises a fair question: is WordPress secure for a small business? Below: what happened in plain terms, what to ask whoever runs your site, and why the sites we build at Citruit had nothing to patch.
What is PHP2Shell?
PHP is the programming language running behind many websites. Every time someone visits a PHP site, the server runs PHP to assemble the page on the spot.
PHP2Shell is two flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619), both rated 9.2 out of 10 for severity. An attacker doesn't need a password or any help from you. A single specially crafted request can be enough to run their own code on your web server.
The part that catches people off guard: the flaw sits in PHP, not in WordPress or your plugins. It triggers before your site's own code even runs. So a carefully maintained WordPress site with every plugin up to date is still exposed until PHP itself is updated.
This isn't theoretical. Details leaked before the fix was ready, security companies saw attacks almost immediately, and some organizations took their sites offline as a precaution. Once attackers can run code on a server, they can change your site, read what's stored there, or use it to attack others.
What to do this week
You don't need to be technical for any of this. Most of it is one email to whoever built or hosts your site.
Find out if your site runs on PHP.
WordPress, Joomla, and Drupal all do. Not sure what yours is built on? Ask your web person or your hosting company. On Wix, Squarespace, or Shopify? The platform manages the server, so there's nothing for you to patch.
Ask one question: "Has PHP been updated to a patched version?"
The fixed versions are 8.2.35, 8.3.36, 8.4.27, and 8.5.12, or anything newer in those lines.
If you're on PHP 8.1 or older, plan an upgrade.
Those versions no longer get security fixes from the PHP project, so this patch won't come to them.
Don't stop at plugin updates.
Updating WordPress, your theme, and your plugins is good habit, but it doesn't fix this one. Only updating PHP does.
Check your host's announcements.
Many managed hosts, including WordPress.com, protected their customers right away. If yours did, you may not need to do anything.
Keep an eye out for anything odd.
Pages you didn't add, visitors being redirected elsewhere, new admin accounts, or a warning email from your host are all worth a call to your web person.
Why static websites weren't affected
Every site Citruit builds is static. The pages are built ahead of time as finished files. When someone visits, the server hands over the file. Nothing runs, so there's no PHP, no database, and no plugins on the live site.
Think of it like a printed menu versus a cook taking custom orders at the counter. The cook can be talked into something they shouldn't do. The printed menu just sits there being a menu.
That's why PHP2Shell was a non-event for our clients. No emergency update, no maintenance-mode page, no weekend spent checking plugins. Good static website security mostly comes down to this: the less that runs on the server, the less there is to attack. It's also a big part of why static sites load so fast. See what every build includes on our Services & Pricing page.
"But I want to post my own updates"
Fair. That's usually the reason businesses end up on WordPress. Our blogs use Decap CMS, a simple editor where you write and publish your own posts. Behind the scenes, each post is saved as a file and the site rebuilds itself. You get an easy way to post news, and the public site stays static.
No website is risk-free
Static sites remove a whole category of attacks, but they don't make security someone else's problem. The accounts around a website still matter: your domain registration, your business email, and the login for your blog editor. Strong, unique passwords and two-factor sign-in on each of those go a long way.
And if your current site runs on PHP that's patched and well maintained, this isn't a reason to panic and rebuild. It's a good reason to know who's keeping it updated, and how fast they move when something like this happens.
Want a second set of eyes?
We're a Lehigh Valley web design studio, and we offer a free website checkup: we look at your current site and send you three specific, practical fixes. No pressure, no jargon. Book a call or email us at inquiry@citruit.com.