What Happened This Week
On Wednesday 21 October 2026, researchers disclosed two serious flaws in PHP. PHP is the programming language behind a huge share of the internet.
The flaws sat undetected for more than ten years. AI tools finally exposed them.
Governments and security agencies reacted fast. Some organisations pulled their websites offline. Others rushed to install an emergency fix.
If your business runs a website, this affects you. This guide explains the issue in plain language and shows you exactly what to do next.
What is PHP and Why Does It Matter
PHP is an open-source language that runs on web servers. It collects data and turns it into the pages you see in your browser.
Security firm Wiz says PHP powers about 70% of the world’s websites. That includes WordPress, online shops, forums, and many custom web apps.
| Platform or Tool | Built on PHP |
|---|---|
| WordPress | Yes |
| WooCommerce stores | Yes |
| Wikipedia | Yes |
| Laravel, Symfony, Drupal | Yes |
| Custom business portals | Often |
Most visitors never see PHP. But if your site uses any platform above, PHP runs behind it every day.
What is the php2shell Vulnerability
Researchers from Wiz and Calif named the flaws php2shell. The problem lives inside the language itself. PHP versions released over the last decade are affected.
Under the right conditions, an attacker can take control of a web server and steal sensitive data. One researcher called it the most serious flaw he has ever found.
Two facts make this alert different from a routine bug:
- The flaw is in PHP, not in a plugin. You cannot fix it by tweaking your site’s code.
- The details are now public. Security experts expect more attack attempts in the coming weeks.
Cloudflare reported a sharp rise in attack attempts after the announcement. The numbers climbed from thousands to millions within hours.
Who is at Risk
Every site running an unpatched version of PHP carries risk. Small organisations face the greatest danger.
Why? Large companies have security teams. A small business often relies on a hosting provider or a freelancer. Nobody may be watching for emergency updates.
| Business Type | Risk Level | Reason |
|---|---|---|
| WordPress or WooCommerce store | High | PHP powers the platform |
| Clinic or service business site | High | Often unmanaged after launch |
| Custom PHP or Laravel app | High | Direct dependence on PHP |
| Shopify store | Low | Shopify runs its own hosted platform |
| Static site with no PHP | Low | No PHP code runs on the server |
Pakistani businesses should pay close attention. Many local websites run on WordPress with budget shared hosting. Updates on those servers often get missed.
How Governments and Tech Giants Responded
The response shows how seriously experts take this flaw.
| Organisation | Action |
|---|---|
| PHP Foundation | Released patches on Wednesday and urged all users to update |
| US National Security Agency | Told organisations to patch immediately or take systems offline |
| UK National Cyber Security Centre | Advised patching and checking for attacker backdoors |
| Japan’s Prime Minister | Asked citizens to check whether their sites run on PHP |
| Wikimedia | Took some systems down as a precaution |
| Amazon | Reported attack attempts before disclosure, with normal operations |
Several public bodies also took websites offline until they could patch. That is a drastic step, and it shows the stakes.
Does Your Website Need Action
Use this quick table to find your situation.
| Your Situation | What to Do |
|---|---|
| A developer or agency manages your site | Ask them to confirm the PHP patch is applied |
| Your hosting company manages the server | Contact them and ask for the PHP version and patch status |
| You manage the server yourself | Update PHP now. This is your responsibility |
| You use Shopify or a hosted builder | No action needed on PHP. Stay alert for platform notices |
| You are not sure | Ask us. We will check for you, free of cost |
One important point: the fix must happen at the PHP level on your server. Updating WordPress or a plugin does not solve it.
Six Steps to Protect Your Website Today
1. Find your PHP version. Check your hosting dashboard or ask your host. Many control panels show it under server settings.
2. Apply the PHP security patch. Update to the latest patched release from the PHP Foundation. Treat it like an urgent system update.
3. Back up your site first. Save a full copy of files and the database before you change anything.
4. Scan for backdoors. UK authorities specifically advise this. Attackers who got in early may have left hidden access. Look for unknown files and unusual admin accounts.
5. Consider temporary shutdown if you cannot patch. US and UK agencies say this is a valid option for high-risk sites. It is better than a breach.
6. Monitor your site closely. Watch for traffic spikes, new users, and file changes over the next few weeks.
A regular technical SEO audit also catches crawl errors, mixed content, and security gaps. Make audits a routine habit, not a one-time event.
Why Updating WordPress Is Not Enough
Many site owners assume a WordPress update solves everything. It does not in this case.
PHP sits underneath WordPress. The flaw lives in that lower layer. Plugin updates and theme updates cannot reach it.
You need your hosting provider or developer to update PHP itself. If you manage your own server, you must do it yourself.
This is exactly why ongoing care matters. A site without proper maintenance often goes months without a server-level update. Our web development team builds sites with security and long-term upkeep in mind.
Watch Out for Phishing
Big security stories attract scammers. Expect fake emails and messages that use this alert as bait.
Stay safe with these habits:
- Do not click links in unexpected “urgent security” emails
- Go directly to the service’s official website instead
- Change passwords only through official channels
- Enable two-factor authentication on hosting and admin accounts
Your visitors face the same risk. If a customer asks about a suspicious message, guide them to your official contact details.
Our Free Fix Offer
We want Pakistani businesses to stay safe and online.
Kreation House will check your website for this PHP vulnerability and fix it free of cost.
Here is what our team will do:
| Step | What We Do |
|---|---|
| 1. Check | Identify your PHP version and hosting setup |
| 2. Patch | Apply the PHP security update where we have server access |
| 3. Coordinate | Work directly with your host when they control the server |
| 4. Scan | Look for signs of backdoors and suspicious files |
| 5. Report | Send you a plain-language summary of what we found |
You pay nothing for this check and fix. No sales pressure. No obligation.
Time matters. Attackers are already scanning the internet. Contact our team today and we will start right away.
You can also see our full list of services or learn about our team. Browse our portfolio to see how we work with real businesses.
The Bigger Lesson for Your Business
This incident shows a pattern. AI now finds flaws faster than humans ever could. It also helps attackers build tools faster.
That makes routine maintenance a business essential. Treat your website like any other critical asset. Update it, monitor it, and review it often.
Security also supports your search visibility. Hacked or offline sites lose rankings quickly. Our guide on what SEO is and why your business needs it explains how site health feeds directly into organic growth.
Plan security into your wider digital strategy and your marketing strategy. A protected site gives every ad and every post a safe place to send visitors.
Frequently Asked Questions
What is the php2shell vulnerability?
It is a pair of serious flaws inside PHP itself. Attackers can use them to take control of affected web servers.
Is my WordPress website affected?
Probably, if your server runs an unpatched PHP version. WordPress runs on PHP, so the risk applies.
Can I fix this by updating WordPress or plugins?
No. The fix must be applied to PHP on your server. Your host or developer handles that.
How do I check my PHP version?
Look in your hosting control panel, or ask your hosting provider. Our team can also check it for you.
Is Shopify affected?
Shopify manages its own platform, so store owners do not patch PHP themselves. Watch for official Shopify notices.
Should I take my website offline?
Only if you cannot patch quickly. Security agencies in the US and UK list it as a valid temporary step.
How can I tell if my site was hacked?
Look for unknown files, new admin users, strange redirects, or sudden traffic changes. A professional scan gives a clearer answer.
Is the Kreation House fix really free?
Yes. We check your site and apply the PHP fix at no cost. Contact us to get started.
