PHP2Shell: what the new PHP flaws mean for your small business website

On October 21, 2026, the PHP project shipped emergency security releases for two flaws researchers are calling PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Both are rated 9.2 out of 10. Either one can let an attacker run their own code on a web server without logging in, just by sending it crafted requests.

That matters to almost every local business with a website. PHP is the language behind WordPress, Drupal, Joomla, Magento, and Laravel, and by W3Techs' count it runs about 7 in 10 websites whose server language is known. If your site sits on any of those, someone has to update PHP on the server it runs on. The question is who, and how fast.

What PHP2Shell actually is

There are two separate bugs, and they reach the same outcome:

• CVE-2026-109618 is a memory-corruption flaw. When PHP runs out of memory partway through reading a request, cleanup code can treat half-built data as valid.
• CVE-2026-109619 is a use-after-free flaw. Internal state from one request can outlive its memory, and a later request on the same worker can use it.

The official PHP security advisory says every PHP installation serving web requests is at risk, whether it runs under PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, or LiteSpeed. Details leaked before the coordinated release, and Rapid7 reports signs that other researchers are independently reproducing the work, with a public exploit expected soon. Rapid7's advice is to update "on an emergency basis, outside of normal patch cycles."

The fixed versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and older are past end of life and get no official release. The PHP team published source patches for 7.4 through 8.1, but someone has to build and install them by hand.

The mitigations listed in the advisory, such as changing memory limits and turning off session upload progress, only reduce the risk. The advisory is clear that updating PHP is the only complete fix.

What this means if your site runs on WordPress

WordPress itself is not the bug, but every WordPress site runs on PHP, and Tenable notes that researchers confirmed pre-login code execution against specific versions of WordPress, Drupal, Joomla, and Magento. Updating WordPress plugins or core will not fix this. The PHP version on the server has to change.

Who does that depends on how your site is hosted:

• Managed WordPress hosting. Your host updates PHP. Many good hosts moved quickly; some patched before the public release. It is still worth checking your host's status page or support portal for a dated notice that names the fixed version.
• Shared hosting with a PHP version picker. Many control panels let you choose "PHP 8.2" or "PHP 8.3." Picking a branch is not the same as being on a patched build. The host still has to install 8.2.35 or 8.3.36 behind that menu.
• A VPS or server you (or your developer) set up. Nobody is coming. Someone needs to install the patched packages, restart PHP-FPM or Apache, and confirm the new version is the one serving traffic.
• An old site on PHP 7.x or 8.0/8.1. This is the hardest spot. There is no official release to install. The realistic options are a hand-built backport or moving the site to a supported PHP version, which can break older themes and plugins.

If you are not sure which of these describes your site, that is useful to know too. It usually means nobody is watching for this kind of problem.

What about hosted builders like Durable, Wix, and Squarespace?

Hosted website builders manage their own servers, so there is nothing for a customer to update and often no setting to change. That is the upside. The downside is that you cannot see what they run or when they patched. You depend on the company to tell you, and many do not publish anything for issues like this.

We are not saying any particular builder is or was vulnerable. Many do not use PHP for customer sites at all. The point is about visibility: when a flaw this serious lands, a business owner should be able to get a plain answer to "am I affected, and when was it fixed?"

How we handled PHP2Shell at NurtureSite

Every NurtureSite customer site runs on infrastructure we operate and update together, not on a server each customer has to maintain. On October 21, the day the fixes shipped, we:

1. Checked the PHP version on the NurtureSite app and on every customer and demo site we host.
2. Rebuilt the NurtureSite platform on PHP 8.4.27 and every customer site on PHP 8.2.35, the patched releases.
3. Restarted each site on the patched build and checked that it was serving pages again.

Customers did not need to log in, click an update button, or call anyone. We also post fixes like this in our Recent updates so there is a dated record of what changed.

That is the practical difference between owning a server and having a site that is maintained for you. With WordPress on your own hosting, you have full control and the full job: PHP, plugins, themes, backups, and the next emergency like this one. With a closed builder, someone else does the job but you cannot see it. NurtureSite sits in between. We run the servers and patch them, and we tell you when we do.

A quick checklist for any business website

Whatever you run on, it is worth spending ten minutes on this week:

• Find out what your site runs on. WordPress, a builder, a custom app? Your developer or host can tell you in one email.
• Ask for the PHP version and the date it was updated. You want to hear 8.2.35, 8.3.36, 8.4.27, or 8.5.12 or later, or a vendor package that includes both fixes.
• Get it in writing. "We're on it" is not the same as "patched on this date."
• If your site is on PHP 8.1 or older, plan a move to a supported version now. PHP 8.2 itself reaches end of life on December 31, 2026, according to the PHP project.
• Keep a backup you can restore. If a server is compromised, a clean, recent backup is what gets you back online.

If you would rather not manage any of this yourself, see how NurtureSite compares to WordPress and to Durable, or start a free trial and see what a site that is kept up to date for you looks like.

Next steps

A modern service business website should capture leads, explain your offers clearly, and stay easy to update without a developer. NurtureSite builds your core pages, blog, analytics, and consent tooling together so you can launch in about fifteen minutes and keep improving from one dashboard.

Further reading:

• Getting Started
• Local SEO checklist for service businesses
• Website lead capture best practices