Your Website Runs on PHP. This PHP Vulnerability Is Why the Government Said Patch It Today.

Wired ran the headline this morning: “This is not a drill.” Two flaws in PHP were patched in an emergency release today, October 21, and the details leaked a day early, which means the race between patching and exploitation started before most website owners woke up.

Here is why a flaw in something you have never heard of lands on your desk. PHP is the engine underneath most small business websites. WordPress runs on it. So do Drupal, Joomla, Magento, and a large share of the custom sites built in the last twenty years. If your website takes a form submission, books an appointment, or sells anything, there is a good chance PHP is doing the work behind the screen.

The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, are the most serious PHP vulnerability in years, scoring 9.2 out of 10 for severity. An attacker needs no password and no account. One carefully built request to a vulnerable site can run the attacker’s own code on your server, and read memory from other requests while doing it, the kind of memory that can hold passwords and keys.

Why this PHP vulnerability is different from the usual patch noise

Most security news deserves an eye roll and a calendar reminder. This one earned its headline for three reasons.

First, the bug lives in the engine, not in your plugins or your theme. A site with perfect, updated, carefully maintained code is still exposed if the PHP underneath it is old. Updating WordPress does not fix this. Only updating PHP does.

Second, the disclosure leaked. The flaws were supposed to be announced on a schedule that gave hosting companies time to prepare. Instead the details surfaced on October 20, public exploit code followed, and Cloudflare reported seeing early attack traffic before the fix even shipped. One security firm, Sansec, warned it expected mass attacks to begin within minutes of the release. When the bad guys get the map before you get the patch, the window to act is measured in days, not months.

Third, and this is the part that decides whether your site is actually safe: the fix only exists for current PHP versions. The emergency release patched PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. PHP 8.1 and everything older got no patch from the PHP project, because those branches are end-of-life. An analysis by Orca Security counted roughly 884,000 internet-facing hosts still running PHP 8.1 or older, about 59 percent of the hosts that report a version at all. If your site is one of them, there is no update waiting for you on your current branch. You have to move to a supported branch, or confirm in writing that your host ships its own backported fix.

What we did today

Our own website was running PHP 8.1 when this news broke, which put rdcstech.com in the same boat as most of the internet. We moved it to a supported PHP branch the same day the fix shipped, then checked the site end to end, homepage, blog, admin, and health diagnostics. The final patched build in that branch is still rolling out from our host, and our switch to it lands the moment it is available. We are telling you this for one reason: this is the call we would make for any client, and it is the call we made for ourselves before we wrote a word of advice about it.

The five moves, in order

1. Call the person who runs your website, and ask one question. Your web designer, your IT provider, your hosting company’s support line, whoever keeps your site running. Ask: “What PHP version is my site running, and is it patched against this PHP vulnerability?” This is their job, not yours, and a good provider answers with a number, not a speech. Safe answers sound like this: 8.2.35, 8.3.36, 8.4.27, or 8.5.12 or higher, or a clear statement that they applied the fix to your version themselves. “We handle updates” is not an answer. A version is.

2. If nobody runs your website, that is the finding. Plenty of small businesses have a site a freelancer built years ago that nobody has touched since. If that is you, call your hosting company, or an IT provider, this week, and ask the same question. Not having a web person is exactly how a site ends up on an old PHP version with nobody watching it, and this week is a bad week to be unwatched.

3. Tell them to back up before they touch anything. A PHP upgrade can break an old plugin or a theme. That risk is real, and it is managed the boring way: a full backup of the site and its database first, then update WordPress, the plugins, and the theme, then move PHP. Ask your provider to confirm the backup exists before the change, in those words. If the upgrade does go sideways, the backup is the difference between an annoying hour and a very bad week.

4. Treat “we applied a workaround” as a yellow flag. Reporting on this flaw mentions a partial workaround that blocks one confirmed attack path. The PHP team’s own position, quoted in Wired’s coverage, is blunt: there are no complete mitigations, and updating is the only safe choice. A workaround can buy a day. It is not the fix, and your provider should be able to tell you when the real patch lands on your site.

5. After they patch it, take sixty seconds to look around. Visit your own website. Does the homepage look like yours? Any content you did not put there, any strange redirects when you open it? Patching closes the door; it does not tell you whether anyone walked through it first. If something looks off, stop treating it as a website task. It is an incident, and your IT provider should handle it as one.

Questions owners are asking today

What is PHP, in one sentence? It is the programming language most small business websites are built on, running on the server, generating every page your visitors see.

Does vulnerable mean my site was hacked? No. Vulnerable means the door was unlocked, not that anyone came in. Patch first, then check for signs, in that order.

My host says my PHP 8.1 is fine because they maintain it. Possible? Possible, yes. Some large hosts and Linux distributions backport security fixes into older branches. That is a legitimate way to be safe on 8.1. But it has to be confirmed for this specific flaw, in writing, with the host naming the fix. Fine is a claim. A patched build is a fact.

Will updating PHP break my site? It can, when plugins or themes are very old. That is your provider’s problem to manage, not yours: a backup first, updates in the right order, then the PHP move. And the risk shrinks every day a site is maintained. The risk of staying on an end-of-life branch with a public exploit circulating only grows.

I do not have a web person. What do I do? Start with move 2. Call your hosting company and ask the version question, and consider this the moment to line up an IT provider who actually watches your site. Knowing your version number turns a vague worry into a specific conversation, and hosts answer specific questions faster.

Sources

• PHP.net, security release announcement for PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, October 21, 2026
• CISA, “Critical Vulnerabilities in PHP Require Immediate Patching,” October 21, 2026 (the NSA and FBI issued the same update-or-offline guidance)
• CVE records: CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2 each)
• Wired, “‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire,” October 21, 2026
• SOCRadar, “PHP2Shell: CVE-2026-109618 & CVE-2026-109619,” October 2026
• Orca Security, “PHP2Shell (CVE-2026-109618 & CVE-2026-109619) PHP RCE” analysis, October 2026 (host version counts)

Not sure what your website is running? Call RDCS at (717) 844-5406. We will walk you through the two-minute version check and tell you straight whether you are patched, exposed, or somewhere in between.