PHP2Shell: What Small Business Owners Need to Know

The short version

Two critical flaws in PHP, the language behind most WordPress sites, let an attacker take over a web server without logging in. Attacks began on October 21, 2026, the same day fixes were released. If your website runs on WordPress or another PHP system, confirm this week that your host or web provider has updated it, and change your passwords and payment keys.

The flaws are known as PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619. PHP rates both 9.2 out of 10 for severity. Details leaked online on October 20, before the fix was ready, which shortened the time businesses had to respond.

Questions owners are asking

Am I affected?

You are affected if your website or any online tool you run uses PHP version 5.4 through 8.5.11 to serve web pages. That includes most WordPress, Drupal, Joomla and Magento sites, and many custom sites built by local agencies. Sites built on Wix, Squarespace or Shopify run on the platform's own systems, so the platform handles this for you.

How do I find out if my site runs PHP?

Ask whoever hosts or maintains your site. If you log into WordPress yourself, the Site Health page under Tools shows your PHP version. A fixed site shows PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later.

What happens if someone exploits it?

The attacker can run their own code on your web server. In practice, that usually means one of the following:

Your customers' cards are stolen at checkout. A hidden script copies card details as customers pay. Businesses often find out months later, through their payment processor.
- Your email is taken over. Stolen logins let an attacker send your customers fake invoices with new bank details. This is often the largest single dollar loss for a small business.
-Your website is flagged or taken down. Google warns visitors away, leads stop, and the site may need to be rebuilt.

Can someone steal money directly from my account?

It is possible, but less common. One of the flaws can leak passwords and API keys stored on the server, including payment keys for services like Stripe or Square. A stolen key can be used to issue refunds, read customer data or test stolen cards, which can get your merchant account frozen. Moving money out of your bank account usually requires a dashboard login, which is why two-factor authentication on your payment and email accounts matters.

Is updating PHP enough?

No. Updating closes the door, but it does not remove anyone who got in before the fix. Attacks started before the update was available, so a site can be patched and still contain a hidden backdoor. Ask your provider to check for unfamiliar files and administrator accounts, and change every password and key the site uses.

What if my site runs an old version of PHP?

PHP 8.1 and older are no longer supported and will not receive a fix. Many small business sites stay on old versions because an older theme or plugin breaks when updated. If that is your situation, the site needs to be moved to a supported version or taken offline. The UK's National Cyber Security Centre has advised taking unfixable systems offline.

Will my insurance cover a breach?

Check your policy. Many small business cyber policies limit or exclude losses caused by a known vulnerability that was left unpatched. This flaw was publicly flagged by government cyber agencies, so an insurer has a clear argument if you did not act.

I don't have a website. Am I safe?

Not necessarily. Your bookkeeper's client portal, your booking system or a payroll add-on may run on PHP. If one of them is breached and your customers' information is exposed, you still answer to your customers. Ask your key vendors whether they have patched.

Do I have to report a breach?

In Canada, if a breach involves customers' personal information and creates a real risk of significant harm, private-sector privacy law requires you to report it to the Office of the Privacy Commissioner, notify the people affected, and keep a record of it. Speak to a lawyer if you think this applies to you.

Three questions to ask your web provider this week

1. Does our website, or any system you run for us, use PHP? If so, which version is it on now, and on what date was it updated?
2. Have you checked the site for signs of access before the update, such as unfamiliar files or administrator accounts?
3. Which passwords and keys should we change, and will you change the ones you manage?

Ask for the answers in writing. Then turn on two-factor authentication for your email and payment accounts, and confirm any request to change bank details by phone, using a number you already have.

How this applies to Kozentis clients

Websites built on the Kozentis platform do not run PHP and are not affected by these flaws. If you are not sure where your site stands, contact us and we will help you work through the three questions above at no cost.

Sources

PHP security advisory, php.net (October 21, 2026)](https://www.php.net/archive/2026.php#2026-10-21-5)

[Help Net Security: PHP2Shell vulnerabilities patched](https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/)

[The Hacker News: emergency patches as exploit attempts emerge](https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html)

[Huntress: rapid response on the leaked vulnerabilities](https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities)

[Sansec: PHP2Shell and online stores]
(https://sansec.io/research/php2shell)

This article is general information, not legal or security advice for your specific situation.