The PHP Warning: Is Your Business Website Exposed?

1 What Happened

On October 21, 2026, PHP released emergency fixes for two critical security flaws. The security world nicknamed them "PHP2Shell." They let an attacker take control of a web server without a password or a login of any kind.

The FBI's Cyber Division didn't mince words. Update immediately, and "if an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated." The NSA gave the same advice.

Governments took that seriously. Every public-facing government website in Finland went offline, and so did every website of France's Interior Ministry. Wikimedia shut down supporting services, and the Internet Archive briefly went dark to patch.

The attacks didn't wait for the announcement, either. Amazon caught an attack attempt on October 17, four days before the public warning. By the day of the announcement, Amazon said PHP2Shell was "now being broadly exploited in the wild."

2 What PHP Is, and Why You've Never Heard of It

You've never had to think about PHP, and that's the point. It's the engine under the hood of about 70% of the websites on the internet. Every time someone fills out a form, logs in, or loads a page on one of those sites, PHP is doing the work.

The biggest thing built on PHP is WordPress, which runs roughly 40% of all websites. WordPress didn't cause this. But when the engine has a crack in it, every car built on that engine is in the shop.

3 A 14-Year-Old Crack, Found by AI

Here's the part that should bother everyone. According to OpenAI's Greg Brockman, this flaw had been sitting inside PHP for 14 years. Every PHP version going back to 5.4 is affected.

It wasn't a human who finally caught it. An AI security firm called Calif found it in August using OpenAI's AI, and Wiz found it separately with its own AI tools. OpenAI was blunt about what that means: "the same capabilities can also help attackers rapidly develop offensive tools and exploits."

In other words, the machines that find holes for the good guys find them for the bad guys too. Old code that nobody has looked at closely in years is exactly where they'll look first.

"A flaw in PHP isn't a flaw in one website. It's a flaw in the foundation under most of the internet."

4 Why This Keeps Happening to PHP

I'll say what a lot of developers think and won't say in public. PHP started in 1995 as one programmer's toolkit for his personal homepage. Its name originally stood for "Personal Home Page."

It was never designed to carry the weight of most of the internet, and it shows.

This isn't PHP's first emergency. In 2024, a different flaw let attackers run their own code on PHP servers, and it was still being exploited in 2025. Since July 1 of this year, the PHP Foundation has counted 15 new security flaws in PHP alone.

Part of this exact problem was spotted in a 2024 audit, and it went unfixed because the team couldn't agree on how to fix it. That's not a knock on the volunteers who maintain PHP. It's what happens when a 30-year-old system holds up far more than it was ever built for.

So why is PHP still everywhere? Honestly, it's mostly WordPress. A huge share of small business websites are built on it, and nobody wants to rebuild what already works.

PHP isn't still here because it's the best tool. It's still here because it's everywhere.

5 Are You at Risk? A 3-Question Check

Most business owners have no idea what their website runs on. That's fine. These three questions will tell you where you stand.

If any answer made you nervous, you're exactly who this warning was for. The good news is that it's fixable, and it starts with a few steps you can take this week.

6 What to Do This Week

One more thing worth saying plainly. As of this writing, no specific businesses have been publicly named as breached, and CISA said it had not seen exploitation as of the day of the warning. That's a reason to act now while it's quiet, not a reason to wait.

7 The Bigger Question

If your website is a simple five-page brochure, patch it and move on. You'll probably be fine. But if your site books appointments, takes payments, or holds your customers' information, this week is a warning shot.

I've seen what an aging WordPress site looks like up close. One farm attraction I took over had 14 plugins and logged 318,042 PHP warnings in its last 17 days. After the rebuild, searches from people who didn't know the farm's name grew about 10×.

Read the full Majestic Meadows story.

Rescuing businesses from WordPress is what I do. Every one of my clients came to me from WordPress, and none of them lost the online reputation they'd spent years building. If you're weighing the move, start with whether your platform is holding you back, or see how a WordPress rescue works.

Every site I build is custom-built and yours to keep, with security and updates handled for you.

Quick Answers

Is my WordPress site affected? WordPress runs on PHP, so every WordPress site is exposed until the server under it is updated. The flaw is in PHP itself, not in WordPress.

How do I check my PHP version? In WordPress, go to Tools, then Site Health, then Info, and open "Server." If you're not on WordPress, ask your host or your developer.

My site runs PHP 8.1 or older. What now? Ask your host whether they patched their own copy. If they didn't, the site has to move to a supported version, which often breaks older themes and plugins.

My host already updated. Am I safe? The hole is closed, but anyone who got in before the fix could still be there. Change your passwords and watch for anything unusual.