Critical security update to patch PHP2Shell vulnerability in websites running PHP
On 21 October 2026 the PHP Foundation released a critical security patch for a new vulnerability called PHP2Shell. It affects millions of websites.
PHP is the software behind many websites, including sites built on WordPress, Drupal, Magento and Joomla. If a website isn’t updated, an attacker could potentially take control of the server it runs on.
What you need to do depends on how your website is run. Choose the tab that matches your situation:
- Smaller sites - for example on WordPress.com hosting or self-hosted WordPress.org via a hosting company
- Managed for you - for example via an agency
- Self-hosted - where you host and manage your website yourself
Smaller sites, for example on WordPress
Many charities use WordPress to manage their website, with the web space provided by a hosting company such as 123Reg, Fasthosts, Hostinger, Ionos or Bluehost. For the WordPress part:
- WordPress.com, where you pay WordPress to provide the service: this has been patched automatically.
- WordPress.org, where you run your own copy of WordPress: you’ll need to check that your PHP version has been updated in your web hosting portal. See information on self-hosted services
To find out what you need to do with your hosting provider, search their help pages for PHP2Shell.
For the security patch to work, you need to be running PHP 8.2 or newer.
If a company/agency manages your website for you
Ask the team or person looking after your website to make these checks, and to confirm they have completed all the actions needed to secure your site.
- Does our website or any online service run on PHP, and which version?
- If we use PHP 8.2 or newer, when will the update be installed, and does anything need to be done on our side?
- If we use PHP 8.1 or older, will our host provide a fix? If not, what is the plan to move to a supported version?
- Are recent backups in place, so we can restore the site if something goes wrong during the update?
- Who should we contact if we notice anything unusual on the site?
If you host and manage your services yourself
Read the detailed technical guidance from the National Cyber Security Centre or the PHP Foundation security advisory. In summary:
- Review all of your web systems for anything running on PHP.
- Apply the security patch, updating where necessary.
- If you run more than one site, check each one.
- If you’ve been running an older version of PHP, take care: a major update could break some features.
If you need time to apply the security patch, be prepared to take your services offline.
Part of this guide is based on content from Bobi Robson at Poteris.
