What to Do About PHP2Shell: A Checklist for Website Owners

If your website runs on WordPress, Drupal, Joomla, Magento or shared hosting, ask your hosting company or web agency today whether they have installed the PHP security update released on 21 October 2026. This checklist covers what to ask, how to protect your Google ranking if you go offline, and what to check afterwards. For how the flaw was found and why it matters, read PHP2Shell Explained.

What happened

On 21 October 2026, PHP released emergency fixes for two critical flaws, nicknamed PHP2Shell, that can let an attacker take over a web server without logging in (PHP Foundation). Attack attempts began before the fix was out, though by 22 October researchers found the public attack code mostly fails against standard setups (Sansec). The full story is in PHP2Shell Explained.

Is my website affected?

Your website is probably affected if it runs on PHP and has not been updated since 21 October. Every PHP version from 5.4 onwards is vulnerable (Krebs on Security).

Your website is built with	Runs on PHP?
WordPress, WooCommerce	Yes
Drupal, Joomla, Magento	Yes
Shared hosting with cPanel or Plesk	Usually yes
Wix, Squarespace, Shopify, Webflow	No, and the platform handles the servers itself
Custom sites in Next.js, Python or similar	Usually no, unless PHP is also installed on the server

Not sure what your website runs on? Your web agency or hosting company can tell you in one email.

What to do today

The fix is a software update on your server, so it is a job for whoever runs your hosting. Send them these four questions today:

1. Have you updated PHP to a patched version? The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and PHP must be restarted afterwards (watchTowr). If the site runs PHP 8.1 or older, there is no official release: ask whether they applied the backported fix or need to upgrade to 8.2 or later (Help Net Security).
2. Was the site reachable before the update, and have you checked it for signs of an attack, such as new admin users or unknown files? Updating stops new attacks but does not remove an attacker who already got in.
3. Are WordPress, plugins and themes also up to date? A separate WordPress flaw, wp2shell, was disclosed in July 2026 (Elastic).
4. Do we have a recent backup stored somewhere other than the server?

If you manage your own server, follow the official PHP security advisory and your hosting provider's instructions. Temporary workarounds reduce some risks but do not make a site safe; only the update does (Patchstack).

Watch out for scam emails. Fraudsters pose as hosting companies and domain registrars, especially during a security scare (hosting.com). Don't click links in urgent emails about your website; open your provider's site by typing its address yourself. Never add a PHP file or code to your site because an email asked you to (WP Cerber).

In Luxembourg: if you think your site was broken into, CIRCL is the national incident contact for private companies and communes, and GOVCERT.LU for the public sector.

If you took your site offline

A day offline will not hurt your Google ranking, but several days can get pages removed from search results. Google's John Mueller has said a short outage is fine if the site tells Google to come back later, while pages that stay unreachable start dropping out within days (Search Engine Journal).

• Show a maintenance page with status code 503, not a 404 or a blank page. A 503 tells Google the outage is temporary. Your agency will know how to set this.
• Keep robots.txt reachable if you can, since Google pauses crawling when it can't read it.
• Patch and come back online quickly. Taking the site down is a stopgap, not a fix.
• Check Google Search Console after you're back, under Pages and Security issues.

After the patch: check your search and AI visibility

The damage from a security incident often shows up weeks later, as lost rankings and fewer mentions in AI answers. Attackers who get into a website commonly add hidden spam pages or links, which can lead Google to flag the site or drop it from results.

In the weeks after patching, check:

Letzscale can do this check for you. We check how your business appears in Google and in AI assistants such as ChatGPT, Gemini and Google AI Overviews. If your site went offline this week, or you're not sure it came through clean, get a free report in English or French.

FAQ

What is PHP2Shell?

The name for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, patched on 21 October 2026. They let attackers run their own code on a web server without logging in.

Is my WordPress site affected?

Yes, unless your host has already updated PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or applied the fix to an older version. WordPress runs on PHP, so the flaw sits underneath it.

Do I need to take my website offline?

Usually not. Early press coverage urged unpatched sites to go offline until they could update (The Register). By 22 October, researchers at Sansec found the public attack code doesn't work on a default PHP setup and said online shops don't need to go offline (Sansec). Update anyway. If you do go offline, use a 503 maintenance page and keep the downtime short.

Will this hurt my Google ranking?

A short outage won't. Downtime lasting several days, or a hacked site with spam pages, can.

Is it being exploited?

Yes. Cloudflare and watchTowr reported attacks from 21 October (watchTowr).

Sources

This checklist is general information, not security advice for your specific setup. For the security fix itself, follow your hosting provider and the official PHP advisory.