On October 21, the PHP project released emergency fixes for two critical security flaws, and the FBI’s Cyber Division told organizations to “patch and hunt immediately.” PHP is the programming language behind most of the web, including every WordPress site, so if your business has a website, there’s a good chance this applies to you.
The short version
- What it is: two flaws (CVE-2026-109618 and CVE-2026-109619, nicknamed “php2shell”) that let an attacker run their own code on a web server without a password. Both are rated 9.2 out of 10.
- Who’s affected: any website running PHP that hasn’t been updated since October 21. That includes WordPress, Drupal, Joomla and Magento sites.
- Is it being used yet: yes. Security companies reported attack attempts the same day the fix came out.
Three things to do this week
- Ask your web host or web person one question: “Has our site been patched for the October 21 PHP security release?” The fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12 or newer. Older versions need a fix applied by the host.
- Check for anything that shouldn’t be there: admin accounts you didn’t create, plugins you don’t recognize, or your contact form suddenly sending spam.
- Make sure you have a backup from before October 20. If something did get in, that backup is how you get back to a clean site.
Our sister company Digitech wrote up the full details, including how to check your PHP version in WordPress, what “hunt” means in practice, and what we did on our own servers the day the fix came out: Patch it, then hunt: what the new PHP flaw means for your website.
Need a hand?
If you’re not sure whether your site was updated, we’ll check it for you. Call 708-596-2990 or email admin@dynamic83.com.
