PHP2Shell: The headlines have moved on. Has your website?

Website security might not be the most exciting topic, but neither is explaining to your boss why the company a website has been hacked. So, let’s talk about PHP2Shell. 

The latest PHP security scare is a reminder that your website can look perfectly fine on the surface while things get a little messy behind the scenes. Here’s what to check now, and how to prepare for the next one. 

When a critical website security vulnerability makes headlines, the immediate priority is to identify affected systems and apply the relevant fixes.

But what happens a few days later, once the updates have been released and the headlines start to fade?

For business owners, the PHP2Shell security alert is a timely reminder that keeping a website secure involves more than responding to the latest threat. It means having the right maintenance, monitoring and support in place before the next one appears.

At Raccoon Web, we believe understanding what happens behind the scenes of your website shouldn’t require a degree in computer science.

So, let’s break down what this latest alert means, what you should check now and the questions worth asking your web agency.

So, what exactly happened?

On 21 October 2026, the PHP development team released security updates addressing two critical vulnerabilities that could allow attackers to execute code remotely on affected servers without authentication.

The original vulnerabilities were rated 9.2 out of 10 for severity, and security researchers reported exploitation activity. Further vulnerabilities were then disclosed on 23 October.

For businesses running websites built on PHP-based technology, including many WordPress sites, the developments are a reminder that website security requires ongoing attention, not just a successful launch.

Why does it matter?

PHP is a programming language used to power the functionality behind many websites. It helps process information, communicate with databases and deliver dynamic content. WordPress, one of the world’s most widely used content management systems, relies on PHP.

The potential implications can extend beyond an individual website or plugin when a vulnerability is discovered in the underlying software.

Attackers may be able to compromise the server itself, depending on the server configuration and whether the vulnerability is successfully exploited, attackers may be able to compromise the server itself.

Don’t freak out, this doesn’t automatically mean every PHP website has been compromised. However, it does mean that identifying affected systems and applying the appropriate security measures is important.

Security patches for the original vulnerabilities are available. However, that doesn’t automatically mean every website has been updated, that previously vulnerable servers haven’t been compromised, or that future vulnerabilities won’t emerge.

I’ve patched my website. We’re good, right?

Hopefully! Applying the right security updates is essential, but it doesn’t automatically tell you whether someone accessed your server before the fix was installed.

The technical response will depend on how your website is built, hosted and maintained. And there are several practical steps businesses should take.

Applying the appropriate security patch addresses the vulnerability it was designed to fix.

However, if a server was exposed before the patch was applied, the update alone cannot confirm whether an attacker accessed it during that period.

If your website was running an affected PHP version, ask your hosting provider or web development agency to confirm:

• Whether the affected PHP environment has been updated to a supported, patched version.
• Whether the relevant services have been restarted or reloaded so the fix is active.
• Whether server and application logs show suspicious activity during the exposure period.
• Whether any additional investigation is needed based on the website’s configuration and exposure.

If there are signs of compromise, a more thorough incident response may be necessary. This could include checking for unauthorised files, accounts, changes or processes, and reviewing credentials that may have been exposed.

It’s also important to understand that updating your WordPress plugins or theme is not necessarily the same as updating PHP itself. The underlying runtime may be managed separately by your hosting provider.

Can we stop this happening again?

Unfortunately, you can’t prevent every vulnerability from being discovered. Software changes, new flaws emerge, and even well-maintained websites can be affected.

What you can control is how prepared you are.

Here’s your website security checklist:

• Keep things updated. Your CMS, plugins, themes and server software all need attention. Retire outdated software that no longer receives security fixes.
• Back it up. Regular backups are great. Tested backups that you can actually restore? Even better.
• Lock things down. Use strong passwords, multifactor authentication and sensible access permissions. Remove accounts and plugins you no longer need.
• Know who’s responsible. Your developer, hosting provider and maintenance team may have different jobs. Make sure nobody is assuming someone else is handling security.
• Have a plan. When the next vulnerability hits, know who will assess it, apply the fix and check whether anything went wrong.

Five questions to ask your web agency

Not sure whether your website is being looked after properly? Start here:

• What PHP version is my website running, and is it supported?
• Who handles urgent security updates?
• How quickly do you respond to critical vulnerabilities?
• Are my website and server monitored for suspicious activity?
• What’s included in my maintenance plan, and what costs extra?

A good agency should be able to answer these without drowning you in technical jargon. If you leave the conversation more confused than when you started, it’s worth asking a few more questions.

You can’t guarantee your website will never have a security issue. You can make sure it’s maintained, backed up and supported by people who know what to do when something goes wrong.

At Raccoon Web, we believe you shouldn’t need to speak fluent developer to understand what’s happening behind your website.

Need a hand keeping your website secure, updated and running smoothly? Get in touch with us.

Whether you need ongoing maintenance or a little help figuring out what’s going on behind the scenes, we’re here to help. 🦝