If you’ve seen “PHP2Shell” in the news this week and felt a small knot in your stomach, here’s the short version: if we host your website, it’s already been patched. You don’t need to do anything.
Our hosting partner, 20i, had the fix rolled out across every version of PHP on their platform by 9pm on 21 October – the same day it was released.
That’s really all you need to know. But if you’re curious about what happened (or someone in a meeting asks you), read on – we’ll keep it jargon-free.
What is PHP2Shell?
PHP is the programming language that sits behind a huge number of websites, including every WordPress site. You never see it, but it’s the bit doing the work every time someone loads a page – fetching your content and putting the page together before it reaches their screen.
PHP2Shell is the nickname for two security flaws found in PHP itself (if you like the technical names, they’re CVE-2026-109618 and CVE-2026-109619). On a server that hadn’t been updated, they could let an attacker run their own code on it, without needing a password. That’s why it made headlines, and why the fix was released as a priority on 21 October.
The important bit is that this was a problem with PHP, not with your website. Your content, your design and the way your site was built had nothing to do with it – which also means there was nothing you could have done differently.
10 web terms decodedWhy now, after all these years?
Some of the code involved has been part of PHP for more than ten years.
What’s changed is the tools. The security researchers who looked into it said AI made it much easier to turn these old, obscure bugs into something that actually worked. That cuts both ways – the same tools are helping the good guys find problems faster too, which is how this one came to light and got fixed.
How the fix reached your website
When a flaw like this is found, the fix usually travels in three steps:
- The PHP team fixes it. They released updated versions of PHP on 21 October.
- Hosting companies roll it out. Good hosts move quickly, so the gap between the fix existing and it reaching their servers is as short as possible.
- Your website carries on as normal. Because the fix happens at server level, you don’t need to log in, update anything or even know it happened.
That second step is where your choice of host really matters. 20i put extra security measures in place on the afternoon of 21 October, then rolled out the patches that evening. By 9pm, every version of PHP they run was fixed – including older ones that PHP itself no longer officially supports. It’s one of the reasons we host with them: when something like this comes up, it’s dealt with quickly and quietly, and we can show you exactly when.
If your website is hosted somewhere else
Don’t worry – this is a quick one to check. Just pop a message to your hosting company and ask whether their servers have been updated for PHP2Shell.
The fixed versions of PHP are 8.2.35, 8.3.36, 8.4.27 and 8.5.12 (or anything newer). If your site runs on an older version, ask whether they’ve applied a separate fix for it, as some hosts and providers have. A good host will give you a straight answer, and probably a date.
Where's my Website?Boring is good
The headlines make it sound dramatic, but the reality for most websites is far more boring: a fix was released, hosts applied it, and sites carried on as normal. That’s exactly how it should work.
In website security, boring is good. Regular updates, a host who acts quickly, and someone keeping an eye on things – none of it makes the news, and that’s the point.
If you’d like to know more about how we build and look after websites, our web development page is a good place to start.