Skip to main content

DD-320 · Security · WordPress & PHP websites

Is your website patched for PHP2Shell?

On 21 October 2026, PHP released fixes for two critical flaws, now called PHP2Shell, that let attackers take over a web server without logging in. The NSA advised anyone who can’t update straight away to take their systems offline. Most WordPress websites run on PHP.

Book a PHP2Shell check

Check it yourself in two minutes

You’re patched if your PHP version is one of these, or newer:

  • PHP 8.5.12
  • PHP 8.4.27
  • PHP 8.3.36
  • PHP 8.2.35

In WordPress, go to Tools → Site Health → Info → Server. In cPanel, look for “Select PHP Version” or “MultiPHP Manager”. Anything older than 8.2 no longer gets security fixes at all and needs upgrading.

Scope

What our check and fix covers

  • 01PHP version confirmed and updatedWe check the exact version your site runs and get it updated, with your hosting company if they control it.
  • 02Backup first, then updatesA full backup before anything changes, then WordPress, plugins and theme brought up to date.
  • 03Signs of a break-inWe look for admin users you didn’t create, recently changed files and unexpected PHP files in your uploads folder.
  • 04A free firewall in front of your siteCloudflare’s free web application firewall, set up so common attacks are blocked before they reach your server.
  • 05A one-page reportWhat we found, what we changed and anything still worth doing, written for a business owner rather than a developer.

How it works

Four steps, one fixed price.

  1. 1.Book a checkTell us your website address and who hosts it.
  2. 2.Give temporary accessYou create a temporary admin login for us. We’ll never ask you to email your password.
  3. 3.We check and fixUsually within one or two business days, at a time with the least traffic.
  4. 4.Report and closeYou get the report and remove our temporary access. Done.

Straight about it

Only with your permission

We never test or scan a website without the owner’s permission. Everything above happens after you ask us to and give us access.

Questions

Straight answers.

Q.01Is my site affected?
Any website running PHP that hasn’t been updated since 21 October 2026 should be treated as exposed. That includes most WordPress sites, whatever plugins they use.
Q.02I’m on shared hosting. Hasn’t my host fixed it?
Many hosts update PHP for you, but not all of them do, and some leave older versions running unless you switch. We confirm what your site actually runs.
Q.03What if the site has already been hacked?
We’ll tell you straight away, then clean it up or restore it from a clean backup, and change every password and key involved.
Q.04Will my site go down?
Usually for a few minutes at most. We work at the quietest time for your traffic and take a backup first, so we can roll back if anything misbehaves.

Sources: NSA advisory: PHP updates (21 October 2026)

Not sure where you stand?

Book a PHP2Shell check

A quick call, then we confirm your site is patched, update it safely and send you a one-page report.