If your website runs on PHP (and most WordPress, WooCommerce, Joomla and custom-built business sites do), there's a critical security issue you need to know about. It's called PHP2Shell. The good news is that for most sites the fix is quick: often the same day, sometimes within an hour, and usually without changing anything about how your website looks or works.
We wrote this for business owners, practice managers and office administrators who look after a website but aren't developers. You don't need to understand the technical detail. You need to know whether you're affected, who fixes it, and how long it takes. Start with the free check below. If you'd rather we just look for you, get in touch and we'll tell you where you stand.
Free website check
Does your website need the PHP2Shell fix?
Type in your website address. We'll read what your homepage publicly shows and tell you straight away whether you need to act.
This check makes one normal visit to your homepage, like a web browser does. It doesn't test for or try to trigger the vulnerability, and we don't store the result. Because many hosts fix older PHP versions without changing the version number, a clear result is a strong guide, not a guarantee.
What is PHP2Shell, in plain English?
PHP is the engine underneath your website. Your site's pages, contact forms, booking tools and online shop all run on top of it. PHP2Shell is the name researchers gave to a pair of flaws in that engine itself (tracked as CVE-2026-109618 and CVE-2026-109619). The PHP project rates both as critical.
That's what makes this one different from a typical "update your plugin" warning. The problem isn't in your website's code, your theme or your plugins. A well-built, well-maintained site can still be exposed simply because the PHP version underneath it hasn't been patched.
How could it affect your business?
In the worst case, an attacker could send a carefully crafted request to your website and run their own code on your server. If that happens, they're operating with the same access your website has. In practical terms, that can mean:
- Your customer and client data: enquiry form submissions, bookings, order history and anything else your website stores in its database.
- Your passwords and keys: the database password, email sending credentials and payment or API keys saved in your site's settings.
- Your website itself: defaced pages, hidden spam links that damage your Google rankings, or malicious code that infects your visitors.
- Your reputation and obligations: if personal information is exposed, you may have notification obligations under the Privacy Act's Notifiable Data Breaches scheme. That's a far bigger job than a patch.
If you're on shared hosting, it's also worth asking how well your account is separated from other sites on the same server. A neighbouring site that hasn't been patched can be a risk to you if the separation is weak. Your host can confirm this for you.
None of this means your site has been compromised. It means it's worth closing the door quickly rather than waiting to find out.
How to tell if you need to update
The free check above gives you a quick answer in seconds. To check by hand, or to confirm what the check found, it usually takes under an hour:
- Find out which PHP version your site uses. In cPanel this is under MultiPHP Manager. On managed WordPress hosting it's often shown in your hosting dashboard. If you see something like "PHP 8.1 [Outdated]", keep reading.
- Check whether that version includes the fix. This is the step people get wrong. The version number alone often doesn't tell you. Many hosts apply the fix to older versions behind the scenes, so "PHP 8.1" might be patched or might not. You need your host to confirm it.
- Check everything, not just the main site. Staging sites, old subdomains, booking portals and that microsite from a campaign three years ago all count. Forgotten sites are where problems usually start.
As a rough guide to what you'll find:
| Your PHP version | What it means | What to do |
|---|---|---|
| 8.2, 8.3, 8.4 or 8.5 | Still supported. Fixed versions are available now. | Make sure your host has installed the latest update. Usually a quick job. |
| 8.0 or 8.1 | Officially out of support, but many hosts (including cPanel) have released a fix for this specific issue. | Get the fix installed now, then plan a move to a supported version. |
| 7.4 or older | Well out of support. A fix may only be available through a paid extended-support provider, if at all. | Treat as urgent. Restrict access while a fix or upgrade is arranged. |
| Don't know | The most common answer, and that's fine. | Run the free check, ask your host, or ask us to check. |
The quickest way to get an answer from your host
If your website is on managed or shared hosting, your host normally installs PHP updates for you. Copy and paste this into a support ticket:
"Please confirm the PHP version serving our website is patched for PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Please tell us the exact installed version, confirm the web server has been restarted since the update, and confirm the status of any other PHP versions on our account."
A good host will reply with specifics. If you get a vague "you're fine" with no details, or no reply within a day, that's worth following up, and it's exactly the kind of thing we can chase on your behalf.
How quickly can it be fixed?
For most small business websites, faster than you'd expect. These are typical timeframes once we have access to your hosting:
| Job | Typical time |
|---|---|
| Check which PHP version you're on and whether it's patched | 15 minutes to 1 hour |
| Install the security fix on your current version | 30 minutes to 2 hours per site |
| Temporary protection if a fix isn't available yet | Same day |
| Upgrade a small, well-maintained site to a supported PHP version | Usually 3 to 10 business days, including testing |
| Upgrade an older or heavily customised site | A few weeks, scoped after a quick review |
The important thing to understand is that patching and upgrading are two separate jobs. Patching closes the security hole now, usually on the same PHP version, so nothing on your site changes. Upgrading moves you to a newer, supported version of PHP so you keep getting security fixes in future. It needs testing because older plugins or custom code sometimes need adjusting.
Don't wait on the upgrade to apply the patch. Patch first, today if possible, then plan the upgrade calmly.
Should you upgrade PHP as well?
If you're on PHP 8.1 or older, yes. Those versions no longer get regular security updates, so the next issue might not get a fix at all. PHP 8.2 support ends on 31 December 2026, so if you're there, it's worth planning ahead too. PHP 8.4 is the sensible target for most sites right now. It's supported until the end of 2028.
For most WordPress sites with up-to-date plugins, the upgrade is straightforward. Where it takes longer, it's usually because of an abandoned plugin, an old theme or custom code written years ago. A quick review tells you which camp you're in before you commit to anything. And if the review shows your site is overdue for more than a PHP upgrade, our free website rebuild preview shows you what a modern version could look like.
What we do, start to finish
We like to keep this simple and fast:
- Check: we confirm which PHP version every one of your sites is running and whether it includes the fix. Usually same day.
- Patch: we install the fix ourselves, or get your host to do it and verify they actually did.
- Protect: if a fix isn't available for your version, we put temporary protections in place while we arrange an upgrade.
- Upgrade: if you're on an out-of-support version, we test your site on a supported one in a safe copy first, fix anything that breaks, then switch over with a backup ready.
- Report: you get a short written summary of what we checked, what we changed and what (if anything) still needs attention.
If anything looks like your site may already have been tampered with, such as unfamiliar files, strange admin accounts or unexpected redirects, we'll tell you straight away and talk through next steps. Patching closes the hole, but it doesn't clean up anything that's already got in.
Don't sit on this one
Most of the time, the fix for PHP2Shell is a short, low-drama job. The risk comes from not knowing whether it's been done. An hour to confirm you're patched is a very good trade against the cost of a breach, a hacked site or a Google blacklist.
Start with the free check at the top of this page. If you'd like a hand, contact us and we'll check your site and tell you exactly where you stand, usually the same day.
Common questions
What is PHP2Shell?
PHP2Shell is the name for two critical security flaws in PHP, the software that powers most WordPress and small business websites. They're tracked as CVE-2026-109618 and CVE-2026-109619. Because the flaws are in PHP itself rather than your website's code, even a well-maintained site can be exposed until the PHP version underneath it is patched.
Is my WordPress site affected by PHP2Shell?
If your WordPress site runs on a PHP version that hasn't had the PHP2Shell fix installed, it may be exposed. Updating WordPress or your plugins won't fix it, because the problem is in PHP itself. Check your PHP version in your hosting dashboard and ask your host to confirm the fix is installed.
How do I check which PHP version my website uses?
In cPanel, open MultiPHP Manager to see the PHP version for each domain. Managed WordPress hosts usually show it in the hosting dashboard. The version number alone may not tell you whether the fix is installed, because many hosts patch older versions behind the scenes, so ask your host to confirm.
Can I check my website for PHP2Shell online?
Yes. The free check on this page reads what your homepage publicly shows, such as the PHP version and the platform it's built on, and tells you whether you need to act. It doesn't test or trigger the vulnerability. If your PHP version is hidden, your host or a developer will need to confirm the fix is installed.
How long does it take to fix PHP2Shell?
Checking your PHP version usually takes under an hour, and installing the fix on your current version typically takes 30 minutes to 2 hours per site. If you're on an out-of-support version, upgrading a small, well-maintained site usually takes 3 to 10 business days including testing.
Is my hosting provider responsible for fixing PHP2Shell?
On shared or managed hosting, your provider normally installs PHP updates. On your own server, it's up to whoever manages it. Either way, ask for written confirmation of the exact installed version and that the server was restarted afterwards. A vague reassurance isn't enough.
Not sure where your website stands? We check, patch and upgrade websites for Australian businesses quickly and with minimal fuss. Ask us to check your site.