If you’ve seen a headline this week about a “critical PHP flaw” and wondered whether it’s your problem, the short answer is: if your website runs on WordPress, it might be. The fix is your hosting company’s job. Your job is one email asking whether they’ve done it.

What happened

PHP is the software running underneath most websites, including every WordPress site. You never see it. If WordPress is the body and the paintwork, PHP is the engine.

On 22 October, Australian time, the people who maintain PHP released urgent fixes for two serious holes in it. Researchers have nicknamed them PHP2Shell. Details leaked the day before the fixes were ready, and attackers were scanning the internet for unpatched websites within hours.

They’re serious because of what they allow. Someone could take control of the server your website runs on without needing a password. Researchers showed it working against a fresh WordPress install. With that kind of access an attacker could put malware on your site, or send spam that looks like it came from your business.

Why updating WordPress won’t fix it

The fault is in the engine, so working on the body won’t help. Keep WordPress and its plugins up to date anyway, because that matters for plenty of other reasons, but it does nothing for this one. The fix is a newer version of PHP on the server.

On most small business websites, that server belongs to your hosting company. On shared hosting, which is what most trade business sites sit on, you can’t update PHP yourself and nobody expects you to. A lot of hosts patched within hours of the fixes coming out. What you want to know is whether yours was one of them.

How to check

  1. Work out whether your site is WordPress. Ask whoever built it, or type your web address with /wp-admin on the end (yoursite.com.au/wp-admin). A WordPress login page means yes. If your site is on Wix, Squarespace or Shopify, those companies run their own servers, so this one is theirs to sort out.
  2. Find out who hosts it. It’s whoever sends you the hosting bill. If your web designer looks after that, ask them.
  3. Send them one question: “Has the PHP on my website’s server been updated for the PHP2Shell security fixes released on 22 October?” A decent host can answer that in a line. If they quote a version number, you want 8.2.35, 8.3.36, 8.4.27, 8.5.12 or anything newer.

If the answer is PHP 8.1 or older, that’s a longer conversation. Those versions don’t get official security releases any more. PHP’s own team has published patches for 7.4, 8.0 and 8.1 that a host can apply by hand, but there’s no guarantee yours will. Ask what they’ve done, and when your site is moving to a supported version.

What not to do

  • Don’t install a plugin that claims to fix it. A WordPress plugin can’t change PHP, and security firms are warning people away from these.
  • Don’t download test code or “checker” tools that turn up online. Some of what’s going around is reported to contain malware.
  • Don’t move hosts in a panic. Get an answer from the one you’ve got first.

If something already looks wrong

If your site has been throwing errors or dropping out since about 21 October, tell your host exactly that and ask them to check the server. Then change the password you use to log in to your website, and the one for your hosting account.

PHP2Shell in plain English

PHP2Shell is the name given to two critical security flaws in PHP, the programming language behind most websites, including all WordPress sites. Fixes came out on 22 October 2026 (Australian time) in PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and versions 8.1 and older are out of official support. An attacker can use the flaws to take over a web server without logging in, so a business website on unpatched PHP is exposed however carefully the site itself was built. Updating WordPress or its plugins does not close the gap, because the fault sits in PHP. On shared hosting the hosting company controls PHP, so a small business owner’s part is to ask the host whether the fix has gone on. Sites on Wix, Squarespace or Shopify are maintained by those platforms. Static websites, which serve pre-built pages and run no PHP at all, are not affected.

What about the sites we build

Every website Tradie IT builds is static. The pages are built once and served as plain files from Cloudflare, and the contact form runs as a separate small service. There’s no PHP on any of them, so this flaw had nothing to attack, and our website clients didn’t need to do anything this week.

Static doesn’t mean unhackable, and we won’t pretend it does. Anything on the internet needs looking after. It does mean one less engine to keep patched, which is part of why we build sites this way.

We checked our own systems the day the fixes came out, too. Keeping software updated is one of the three basics in Cyber basics for tradies, and this week it’s the same rule applied to a server you probably never think about.

Next step

Not sure what your site runs on, or your host’s answer didn’t make sense? Send us your web address and we’ll tell you whether this one affects you.

Written 23 October 2026, the day after the fixes came out.