The PHP Flaw Hitting the News Right Now: What Small Business Owners Need to Know

What happened, in plain English

PHP is the programming language that powers a large share of the web. WordPress runs on PHP. So does WooCommerce, Joomla, Drupal, and a long list of other platforms small businesses use to run their websites. Most business owners have never thought about PHP at all, which is exactly the problem.

Two critical vulnerabilities, now known informally as PHP2Shell, were patched on October 21. Both flaws allowed an attacker to run code on a web server without needing an account or password. That is about as serious as it gets. On October 23, PHP warned of a third related vulnerability that does not yet have a patch.

The scale of the response tells you how serious the security community is taking this. Amazon's security team logged exploit attempts four days before the official disclosure. Within 45 minutes of the October 21 announcement, Cloudflare was seeing tens of thousands of attempts. By the following morning it was in the millions.

Does this affect your business?

If your website is a static site, a Next.js or React app, or hosted on a platform like Squarespace or Wix, you are not exposed through this vulnerability. Those platforms do not run PHP.

If your website runs WordPress, you need to pay attention.

• WordPress: Any WordPress site hosted on a server running an unpatched PHP version is potentially exposed. This includes most shared hosting environments.
• WooCommerce: Same as WordPress — WooCommerce is a WordPress plugin and inherits the same risk.
• Joomla and Drupal: Both run on PHP. Same exposure.
• Custom PHP applications: If your business uses any web-based software built on PHP — a client portal, a booking system, a custom database tool — that server needs to be checked.
• Not sure? Ask your web host or IT provider which PHP version is running on your server. If the answer is anything older than 8.2.35, 8.3.36, 8.4.27, or 8.5.12, the server is unpatched.

What the attack actually looks like

The PHP2Shell flaws let an attacker send a specially crafted request to a web server and get code execution in response — without logging in or exploiting anything in your application itself. The vulnerability is in PHP, the underlying layer your site runs on.

In practice, attackers who successfully exploit this can install malware, add your server to a botnet, steal files, or use your server to attack others. Researchers have documented attempts to install a variant of the Mirai botnet using this exact flaw. A reliable exploit is still being developed, which is why there have been no confirmed successful attacks yet — but that window is closing.

What to do right now

• Contact your web host today and ask which PHP version your site is running. Most hosting control panels (cPanel, Plesk) show this. If you do not have access, email or chat with support.
• If your PHP version is outdated, ask your host to update it. Reputable hosts have already pushed these patches. If your host cannot or will not update PHP promptly, that is worth knowing.
• For WordPress sites specifically: update WordPress core, all themes, and all plugins to their latest versions. This does not fix the PHP vulnerability itself but closes any secondary attack surfaces attackers might try to combine with it.
• Apply the one-line mitigation for the third vulnerability (CVE-2026-115560) if you manage your own server: set session.upload_progress.enabled=0 in your php.ini file until a patch is available.
• If you use a managed WordPress host (WP Engine, Kinsta, Pressable), check their status page or support channel. Most managed hosts have already applied patches at the server level.

Why the timing matters

Security vulnerabilities follow a predictable pattern. The window between public disclosure and reliable working exploits is often short. Right now, researchers say a reliable exploit for PHP2Shell is still proving difficult to build. That will not stay true indefinitely.

The businesses that act in the first 48 to 72 hours after a disclosure like this consistently avoid the worst outcomes. The ones that wait until something goes wrong do not get to decide the cost.