If you’ve seen headlines about “PHP2Shell” and wondered whether your website or application is affected, you’re not alone. Here’s what’s going on, in plain language, and what you can do about it.
What happened
PHP is the programming language that powers most of the web, including WordPress. On October 21,2026 the PHP team released urgent fixes for two critical security flaws. If left unpatched, they could let an attacker run their own code on your web server without logging in.
Security researchers have already seen early attempts to exploit them, so this one is worth acting on quickly.
Why this one is different
Most of the security updates we talk about involve WordPress itself or its plugins. This time the problem sits one layer lower, in the software running on the server underneath your site.
That means a website or application can be well built, fully up to date and still exposed. The fix has to come from whoever manages your server.
The good news: if your site is on a managed WordPress host, the host usually handles this for you. Kinsta, the host we use for our clients, is already rolling the fix out across its platform automatically. If you manage your own server, or you’re on a basic hosting plan, the responsibility may fall to you or your IT team. Custom applications often run on their own servers, where PHP usually has to be updated manually rather than automatically.
Three things to check
If you’re on a Baytek Care Plan, we’re handling this for you and will be in touch directly. The steps below are for anyone checking on their own.
- Find out which PHP version your site runs. The patched versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35 or newer.
- Ask your host if they’ve applied the patch. Most reputable hosts are moving quickly, but it’s worth confirming rather than assuming. Some hosts apply the fix without changing the version number shown, so ask them directly.
- If you’re on PHP 8.1 or older, plan an upgrade. Some hosts, including Kinsta, are patching older versions for this issue. But these versions have reached end of life and no longer get regular security updates, so the next flaw may not be covered. This is a good moment to plan a move to a supported version.
Not sure where you stand?
Security news like this can feel overwhelming, especially when the details are technical. If you’d like a second set of eyes on your site, get in touch and we’ll help you figure out what you need.
