Two critical PHP bugs let a stranger run code on unpatched WordPress, Drupal, Joomla and Magento sites. CISA says patch now. Send us your URL and we will tell you where you stand, free, within a business day.
Updated October 22, 2026 from the PHP advisory and CISA.We look at your site from the outside the way an attacker would: what it runs on, whether it exposes a PHP version, who hosts it, and whether that host has published a fix. You get a plain-English note, a grade, and the exact questions to send your host.
Got it.
We will look at the site and reply to the email you gave us, usually within one business day. If your site is down or you think it was hacked, book a call and we will move it to the front.
Alerts from CISA, the FBI, the UK NCSC and CERT-EU landed within a day of the patch. Several told organizations to take unpatched sites offline rather than wait.
Apply the patch immediately, prioritizing internet-facing systems.
CISA, October 21, 2026. Read the alert
Where immediate remediation is not feasible, organizations should consider taking the system offline until it can be fully mitigated.
UK National Cyber Security Centre
Isolate affected systems, preserve your web server and PHP logs, and report to your local field office or ic3.gov.
FBI Cyber Division guidance for compromised systems
The full timeline, the fixed-version table, every agency statement and a 30-minute checklist are in the PHP2Shell guide.
Most small-business owners do not know. Here is the short version. If you are still not sure, the form above takes thirty seconds.
Your host or server admin must update PHP. Get it in writing.
You cannot patch it yourself. Ask support whether the fix is live, not just scheduled.
No PHP process on the server, so nothing for PHP2Shell to reach. Still confirm any tools you embed.
Flat quotes, agreed before any work starts. You will never get a surprise invoice for an emergency.
We work with your host, or directly on your VPS, to confirm a fixed PHP build is actually serving your site, restart every worker, apply PHP's interim settings at the server level, re-test your forms and checkout, and hand you a dated evidence file. For sites stuck on PHP 8.1 or older, we scope and test the upgrade first.
Attempts were logged before the patch existed. We go through the web root and uploads for files that should not be there, review users, cron jobs and recent changes, rotate credentials and API keys, and restore from a clean backup if needed. If we find a real breach we say so plainly and point you to counsel and the FBI's reporting channel.
Our standard build is hand-coded HTML and JavaScript on Cloudflare's edge. No PHP, no plugins, no database to break into, no monthly hosting bill, and nothing to patch next time this happens. Rebuilds start at $789, usually live in days, and you see a free custom demo before you pay anything.
Honesty note: a static site removes this whole class of vulnerability, but no website is risk-free. Our contact forms run on small Cloudflare functions that we keep updated, and any third-party tools you embed are still their vendor's responsibility.
If it runs on a PHP version older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35, yes. The flaw is in PHP itself, not in WordPress, so updating WordPress, themes or plugins does not fix it. Whoever runs your server has to update PHP and restart the PHP workers.
Ask for it in writing: the exact PHP build now serving your site, confirmation that PHP workers were restarted, and that staging sites and subdomains were covered too. A version label alone is not proof, because distribution packages can backport the fix under an older version number.
Not a normal one. Those branches are end of life, so PHP only published source-level backports for people who build PHP themselves. Some hosts and Linux vendors ship their own fixed packages. If yours does not, the real fix is an upgrade to PHP 8.3 or newer, or moving to a site that does not run PHP at all.
Look for PHP files you did not create in your web root or uploads folder, new admin users, new cron jobs, and web server processes launching shells or downloading tools. If you find any of that, isolate the server, keep your web and PHP logs, rotate passwords and API keys, and report it to the FBI at ic3.gov.
Our standard builds are static HTML and JavaScript on Cloudflare with no PHP runtime, so there is nothing for PHP2Shell to reach. Client sites we built on WordPress run on the client's host, and we are checking each one and confirming patch status with the host.
More answers, including firewalls and whether to take a site offline, in the full guide.
One URL, one form, a straight answer within a business day. If you would rather talk, book a free 30-minute call.
This page summarizes public guidance as of October 22, 2026 and will be updated as the situation changes. It is general information, not legal or incident-response advice. If you believe customer data was exposed, talk to counsel and report to ic3.gov. See our terms.