What happened?
On 21 October 2026, PHP fixed two serious security flaws that together go by the name PHP2Shell (PHP’s security advisory). Through them, someone who has never logged in can run code of their own on the server that hosts a website. Whoever manages that can change the website, put malicious software on it, or read data from the server.
The flaws are not in one plugin or one product but in PHP itself, so a large share of all websites was at risk at once. In the Netherlands, organisations such as DigiD, MijnOverheid and the Dutch parliament took their websites offline as a precaution until the update was out.
On 22 October it was not yet clear whether the flaws are being abused on a large scale. Assume that they are, because the technical details are now public.
What is PHP?
PHP is a programming language for building websites. Every time someone opens a page, PHP puts that page together on the server: it fetches the text from the database, adds the menu and the images, and sends the result to the visitor. A large share of all websites works this way, including every website built with WordPress.
A visitor never sees PHP. That is why many owners of a website do not know that theirs runs on it.
Does my website run on PHP?
Your website runs on PHP if it was built with WordPress (WooCommerce included), Joomla, Drupal, Magento or PrestaShop. Many websites that a developer programmed from scratch, for example with Laravel, use PHP as well.
Websites made with a site builder such as Shopify, Wix or Squarespace are not at risk. They do not run on PHP, and the provider looks after the technology itself. A static website, which consists of files built in advance, does not use PHP either.
If you do not know what your website was built with, ask whoever built it or your hosting company. Your hosting company is the company that keeps your website online and that you pay every month or every year for it.
Who has to fix it?
To close the hole, PHP itself has to be updated on the server. A WordPress website is built in layers. At the top is your website: what visitors see. Below it come WordPress and plugins, which you or your developer update. Below those is PHP, which is where the flaw is. PHP runs on the server, which usually belongs to your hosting company. An update of WordPress therefore does not touch PHP.
Who updates PHP depends on where your website is hosted:
| Where your website is hosted | Who updates PHP |
|---|---|
| An ordinary hosting plan | The hosting company |
| Managed WordPress hosting | The hosting company |
| A server of your own (VPS) | You or your developer |
| Shopify, Wix or Squarespace | Nobody, there is no PHP |
| A static website | Nobody, there is no PHP |
By a server of your own we mean a server that you rent and that you or your developer manage. On an ordinary hosting plan you do not have to update PHP yourself, and it costs you nothing. Do check that it has happened, though: a hosting company has thousands of websites and does not update them all at the same moment.
Which PHP version does your website run?
Whether the hole is closed on your website shows in the version number of PHP. You find that number in one of these places:
- in the control panel of your hosting company, usually under “PHP version” or “PHP settings”;
- in WordPress under Tools, then Site Health, on the Info tab under Server;
- in the reply of your hosting company or developer, if you ask them.
A version number such as 8.3.36 consists of a branch (8.3) and a release number (36). Find your branch in the table. The hole is closed if your release number is equal to or higher than the number in the second column. The third column shows until when PHP will still release security updates for the branch, according to the list of supported versions.
| Branch | Fixed from | Security updates until |
|---|---|---|
| PHP 8.5 | 8.5.12 | 31 December 2029 |
| PHP 8.4 | 8.4.27 | 31 December 2028 |
| PHP 8.3 | 8.3.36 | 31 December 2027 |
| PHP 8.2 | 8.2.35 | 31 December 2026 |
| PHP 8.1 and older | no update | already ended |
If your website shows 8.3.30, for example, the hole is still open and your hosting company still has to install the update.
What if your website runs on an old PHP version?
PHP releases no update for PHP 8.1 and older. Some hosting companies repair old versions themselves, but you cannot count on that: the next time a flaw is found, they may not. A website on PHP 8.1 or older should therefore move to a newer branch, preferably 8.4.
In most control panels that move takes one click, but the website can break afterwards. A plugin or theme that has not been updated in years does not always work on a newer version of PHP. Have the move tested on a copy of the website first. If the website is very old, a new website may be the better choice.
If your website runs on PHP 8.2, the update protects it against this flaw, but only until 31 December 2026. After that date PHP 8.2 receives no more security updates. If someone is looking at the website anyway, now is a good moment to have it moved to 8.4 as well.
If your website is so old that replacing it makes more sense than updating it, request a quote for a new website that does not run on PHP.
What should you do today?
As the owner of a website, your part is mostly asking and checking. The actual work is done by whoever manages the server.
- Ask your hosting company or developer whether the PHP update has been installed, and when. You can send the questions for your hosting company in one email.
- Then check the PHP version number yourself.
- Make sure there is a recent backup of the website that is not stored on the same server.
- Update WordPress, the plugins and the theme, and remove plugins you do not use. That does not close this hole, but an outdated plugin can have a hole of its own.
Only take your website offline if you really need to. The next part explains when that is.
Should you take your website offline?
For most websites it is not necessary. Taking it offline is sensible if your website is still at risk, stores personal data or lets customers log in or order, and nobody can install the update within a day. A website with only information and a contact form can stay online, especially if the hosting company installs the update the same day.
If you do take the website offline, show a temporary page with your name, phone number and email address, so customers can still reach you.
What should you do after the update?
The update closes the hole, but it does not undo anything someone did before. According to PHP, the flaw could also reveal pieces of the server’s memory. Those can contain what visitors entered shortly before, such as a password. So go through these points once the new version is active:
- Check in the control panel or in Site Health that the new version number really shows.
- Open the most important pages, send a message through the contact form and place a test order if you have a webshop.
- Look for users with administrator rights whom you do not know, and for plugins that nobody installed.
- Change the passwords that you and your staff use to log in to the website.
- Have your developer replace the access keys stored on the server, for example those of your payment provider or of the service that sends your email.
How can you tell whether your website was hacked?
A hacked website often looks perfectly normal. Watch for these signs:
- there is a user with administrator rights whom you do not know;
- there are plugins, files or pages that nobody added;
- visitors are sent on to another website;
- Google shows a warning next to your website, or Search Console reports a problem;
- spam is being sent from your domain name.
If you see any of these signs, take the website offline and have it repaired before it goes back online. If you see none of them, that is no guarantee that the website is clean. Change the passwords in any case.
Do you have to report a data breach?
A website being at risk is not in itself a data breach. There is a breach once personal data has reached someone who was not allowed to have it, or once you cannot rule that out. On a website, that means for example messages from the contact form that the website stores, or customer accounts.
If you find signs that the website was hacked and it stores personal data, you must report the breach to your data protection authority within 72 hours. That is in Article 33 of the GDPR. You do not have to report it if the breach is unlikely to put the people concerned at risk, but you still record it in your own register of breaches. Whether your case has to be reported is for you to judge; if in doubt, a lawyer can help.
Questions for your hosting company or developer
With these questions in one email, you quickly know whether your website is safe and what still needs to happen.
Questions about the PHP vulnerability of 21 October 2026
- Which PHP version does my website run, with the full version number?
- Has the update against the PHP vulnerability been installed, and on which day?
- Was PHP restarted after the update, so that the new version is really running?
- Will my PHP version still receive security updates after 31 December 2026?
- Have you seen any sign that someone got into the website or the server without permission?
- Who makes sure from now on that PHP is updated, and is that in our agreement?
If the answer to the second question is not a clear yes with a date, assume that your website is still at risk.
Frequently asked questions
Can I update PHP myself?
On most hosting plans you choose the branch yourself in the control panel, for example 8.4 instead of 8.1. The release within a branch, such as 8.4.27, is installed by the hosting company. If you switch branch yourself, make a backup first and then check every page and the contact form.
Why did so many websites go offline at once?
So many websites went offline because the flaw is in PHP itself, and therefore in a large share of all websites at the same time. Organisations that could not update right away took their websites offline as a precaution. The update came out in the afternoon of 21 October, after which most websites came back online.
Is my data safe when I visit a website?
As a visitor you do not have to do anything yourself: the organisation behind a website has to install the update. If a website asks you to change your password, do so. If you use the same password elsewhere, change it there too.
A website without PHP
If your hosting company installs the update and your website runs on a branch that is still supported, nothing else is needed. If you would rather not have to update again at the next flaw in PHP, a website made of plain files is worth considering: it has no PHP, so a flaw like this one cannot touch it. We build websites like that, so read this advice with that in mind. To find out what leaving WordPress would mean for your website, request a quote and include the address of your current website.
Would you rather first see your homepage as a website without PHP? Ask for a free preview.
This is what a website quote looks like.
Want this built, or want to talk it through?
Write to us with what it is for, who will use it and when you need it. We reply within one working day.
Read next
- Website maintenance cost per year: what is includedWhat website maintenance is, how many hours it takes a year and how to decide whether you need a maintenance contract.
- What is a static website? Cost, pros and when to choose oneHow a website made of ready-made files works, what you can and cannot do with it, and what it saves over three years.
- WordPress or a custom website: which is right for you?When WordPress is the right choice, when a custom website is, and what each costs you over three years.
