A serious flaw in PHP, the software that runs most of the web, made the news this week. If you own a website, here is the calm version of what it means and what to do. Think of this as a plain-language guide to author website security and the breach now being called PHP2Shell.
Yes, this one includes your site. I checked, so you would not have to panic-Google it at midnight.
What actually happened
Researchers found a critical flaw in PHP, the layer that sits underneath WordPress and most of the internet. It has a name now, PHP2Shell, which tells you people are taking it seriously.
- Because almost every website leans on PHP in some form, this touches the large majority of sites online. That is why it is headline news and not a quiet developer footnote.
- The flaw lets an attacker take control of a website’s server with no password and no login. It is rated at the highest severity there is, and attempts to use it are already happening.
Why your WordPress updates will not fix this one
This is the part that trips people up, so I will say it plainly. The hole is below WordPress, in the server software itself. Updating WordPress, changing a password, or adding a security plugin does not close it.
You write books. You should not have to know what PHP is. This is the one time I will make you look at it, I promise.
The fix happens at the server level, which means whoever hosts your site is the one who applies it.
What the breach means for author website security
Your site almost certainly runs on PHP, like everyone else’s. What matters is whether your host has applied the patch released on 21 October 2026. The protected versions are PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer. Anything older in those lines is still exposed, and the retired versions (PHP 7.x, 8.0 and 8.1) will not get a fix at all.
You do not need to decode that. You need one answer from your host: are we patched, yes or no.
What to do now
Find your situation.
- You are on managed hosting (most authors). Send your host one message: have you applied the October 2026 PHP security update (PHP2Shell, CVE-2026-109618), and is my site on a supported PHP version? A good host has already done it, so you are only asking them to confirm.
- You manage your own server. Update to the patched PHP release for your branch and restart PHP. If that sentence is not yours to action, it belongs to whoever set the server up.
- You are on old PHP (7.x or 8.1). No patch is coming for those. The real fix is moving to a current version. Start that this week.
While you are there, update WordPress core, your theme and your plugins, and confirm you have a recent backup. Those close the smaller holes patched at the same time.
What is at stake if you ignore it
On an unprotected site, an attacker could deface your pages, steal reader or customer data, quietly inject spam or malware, create fake admin accounts, or take the site down. For an author, the quiet version is the dangerous one: a site that looks fine to you while it serves something harmful to your readers or your search ranking.
How to tell if something is already wrong
A five-minute look:
- Admin users you do not recognize
- Posts or pages you did not write
- A sudden drop in search traffic
- Browser warnings when you visit your own site
- Your host emailing about unusual activity
If any of those show up, tell your host before you start deleting things. A break-in that happened before the patch does not undo itself after it, which is why the check still matters even once you are patched.
Frequently asked questions
Is my website affected by the PHP2Shell breach?
Almost certainly it runs on PHP, like most of the web, so it is in scope. Whether it is still exposed depends on one thing: whether your host has applied the October 2026 PHP update. Ask them to confirm.
Can I fix this myself in WordPress?
No. The flaw is in the server software beneath WordPress, so no plugin, password change or WordPress update closes it. The fix is applied at the hosting level.
How do I know if my host has patched it?
Ask directly: have you applied the October 2026 PHP security release, and is my site on a supported PHP version (8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer)? A clear yes is what you are looking for.
My site runs PHP 8.1 or older. What should I do?
Those versions are retired and will not receive this fix. Plan to move to a current, supported version of PHP as soon as you can, through your host.
Could my site already be compromised?
It is possible, because attacks began before the fix was public. Do the five-minute check above, and if anything looks off, contact your host before changing anything.
Do I need to take my site offline?
Usually no, especially once your host has patched and if they have protections in place. If you see signs of a live compromise, your host is the first call.
What to take away
- A severe, active security flaw affects nearly every website, including yours.
- It is fixed at the server level by your host, not by a WordPress update.
- Ask your host to confirm they have patched you, and get off any retired PHP version.
- Update WordPress and your plugins, and check your backup.
Strong author website security comes down to one habit here: ask your host the direct question, and do not assume silence means safe. Your website is the one part of your author platform you fully control, which is exactly why it is worth protecting.