If you own a website, today’s tech headlines may have gotten your attention. Two critical security flaws in PHP, the programming language underneath WordPress and a huge chunk of the internet, went public on October 21, 2026, and the fixes landed the same day.
So let’s talk about it. What happened, what it means for your site, and what you should actually do about it. No panic required, but no shrugging either.
First off what is a CVE?
CVE stands for Common Vulnerabilities and Exposures. It’s a public catalog where every confirmed security flaw gets its own ID, formatted as CVE, the year, and a number.
Think of it as a case number for a security bug. Today’s two are CVE-2026-109618 (Google Cloud Ref) and CVE-2026-109619 (CISA Ref).
So what is “PHP2Shell”?
That’s the nickname researchers gave these two flaws. Both are rated 9.2 out of 10 for severity, and both can let an attacker run their own code on a web server without ever logging in (Rapid7). Here’s the part that makes this one different. Most WordPress security scares involve a single plugin or theme. This time the problem lives in PHP itself, one layer below everything else. That means any site running on a vulnerable PHP version is exposed, whether it’s WordPress, Drupal, Joomla or a custom build (Patchstack). Researchers showed working attacks against the latest WordPress, Drupal and Joomla installs. And at least one WordPress host reported attackers probing its customer sites the same morning the news broke (Wordify). In other words, this is not theoretical. This is where a lot of site owners get tripped up. Being on PHP 8.4 or 8.5 is a good start, but it isn’t the finish line. Every PHP version from 5.4 through 8.5.11 is affected (Google Cloud). What matters is the number after the second dot.
PHP branch
Safe at this version or higher (all of our website and hosting clients are 8.4 or higher)
PHP 8.5
8.5.12
PHP 8.4
8.4.27
PHP 8.3
8.3.36
PHP 8.2
8.2.35
PHP 8.1 and older
No official release; these versions are end of life
If your site is still on PHP 8.1 or older, this is your sign. Those versions no longer get regular fixes from the PHP project, and moving up should be at the top of your list.
Where things stand for Design Theory clients
The short version: as of today, we’ve seen no impact on any of our client websites. That holds across all three hosting providers/partners that we use, SiteGround, Bluehost and IONOS. Spreading our clients across more than one host is a deliberate choice, and days like this are exactly why. Most of our client sites already run current PHP versions. We’ve been and are actively checking the PHP version on every client site and server PHP settings and confirming each one is on a patched release.
If you’re a client, there’s nothing you need to do. If there’s any known impacts we’ll inform you and if there’s actions you need to take we’ll contact you directly.
If you’re currently not a client of ours here’s what to do today:
- Find your PHP version. In WordPress, go to Tools, then Site Health, then the Info tab, and open the Server section. Your hosting control panel shows it too.
- Compare it to the table above. If you’re below the safe version for your branch, you’re exposed.
- Update PHP or ask your host. Many hosts roll out patches automatically, but “many” isn’t “all.” Get it confirmed in writing.
- Move off PHP 8.1 or older. Test your theme and plugins on a newer version first, ideally on a staging copy of your site.
- Watch for warning signs. Unfamiliar pages, new admin users you didn’t create, login trouble or browser security warnings all deserve a closer look.
- Have a recent backup. If something does go sideways, a clean backup is the difference between an inconvenience and a disaster.
One bonus: if your site sits behind Cloudflare, you have a head start. Cloudflare says its free and paid firewall customers have been protected by default since early on October 21 (Cloudflare). That’s a helpful layer, not a substitute for patching.
If you would like to win back your time and would prefer that someone watching your site on days like this, we’d love to onboard you to our Website Care Program. Let’s keep it a buck, most small business owners didn’t get into business to read security advisories, and they shouldn’t have to. That’s our job. If you’re not a Design Theory client and you’d like a second set of eyes on your website, we’re glad to help. We can check your PHP version, confirm your host has applied today’s fixes, review your site for warning signs, and set you up with ongoing care so the next headline doesn’t land on your desk. Visit our Support Center page to request help today. Tell us a little about you and your business website, and we’ll take it from there.
Sources
