On Wednesday, the world found out about a serious flaw in PHP. If you’ve never heard of PHP, that’s okay. It’s the behind-the-scenes programming language that runs around 70% of the websites on the internet, including WordPress.
The flaw has a nickname, PHP2Shell, and it lets an attacker take over a web server without a password. And attackers moved fast. Within 45 minutes of the announcement, Cloudflare says it logged tens of thousands of attempts to use it. Within two hours, hundreds of thousands. By Thursday, millions.
This wasn’t a small story. The UK pulled 32 government services offline as a precaution. South Korea issued a nationwide security alert. Japan’s government told website operators to patch right away or take their pages offline. The former head of the UK’s National Cyber Security Centre called it “the most serious vulnerability discovered for five years.”
So if your business runs on WordPress, your site is almost certainly running on PHP under the hood. And “is my site at risk?” is a fair question to be asking right now. We’d like to help you answer it.
What actually happened
Researchers at the cybersecurity firm Wiz found two separate flaws in PHP and quietly reported them to the people who maintain it. The fix came out on Wednesday. But according to Cloudflare, attempts to use the flaws started showing up roughly 10 hours before the public announcement. So word got out before the fix did.
One detail from the Wiz team is worth sitting with. These flaws had been hiding in PHP for decades. Turning them into a working attack took a chain of steps “at the edge of what human researchers could practically achieve.” Then, in Wiz’s own words, “frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.”
Here’s what that means in plain terms. Weak spots that used to be too hard for most people to use are now within reach of anyone with access to a strong AI model. The number of weak spots didn’t change on Wednesday. The number of people who can take advantage of them did.
And what can an attacker do once they’re in? Run their own programs on your web server, no password needed. Steal your data. Lock up your site with ransomware. Send your customers to a fake payment page. Use your server to mine cryptocurrency on your dime. Or use your site to attack someone else, with the trail leading back to you.
Why WordPress sites feel this the most
WordPress is built on PHP. So is your theme. So are your plugins. And the hosting plan your site lives on runs PHP too. If any one of those is on an old, unpatched version when the next attack comes along, your site is a target.
That would be manageable if somebody was keeping an eye on it. But for a lot of small businesses, nobody is. Here’s how it usually goes… someone built the site two or three years ago, handed over the login, and moved on. The hosting was picked for price, not security. A dozen plugins got added along the way by whoever had the password at the time. Automatic updates might be on. Might be off. Might be quietly broken.
For a long time, that was fine, because the internet mostly left small sites alone. It isn’t leaving them alone anymore. And the folks doing the attacking now have AI helping them.
Questions to ask whoever built or hosts your site
Building a good-looking website and keeping the server under it safe are two different jobs. Plenty of great designers, marketers, and agencies do the first one beautifully. The second takes a different set of skills: keeping the server patched, reading its logs, restoring from a clean backup, and knowing whether your hosting keeps your site walled off from the other sites on the same machine.
Sometimes one team does both. Sometimes it doesn’t, and nobody ever spelled out who’s responsible for what. That’s not anybody’s fault. It just needs to be clear before something like PHP2Shell shows up, not after.
So it’s worth asking whoever built or hosts your site a few simple questions. Who keeps the server and PHP up to date? Has our site been patched for PHP2Shell? What happens if our site gets hacked? A good partner will be glad you asked.
Because when nobody owns that job, the business owner usually finds out the hard way, weeks later. A customer calls to ask why your site sent them to a fake pharmacy checkout page. Or the hosting company emails to say your account has been suspended for “abnormal activity.”
Is this the time to move to something more stable?
Honest answer: it depends on what your site actually does for you.
If your site is a brochure (hours, menu, contact form, a few photos), you probably don’t need to leave WordPress. You need the hosting patched and someone watching for alerts. There are managed WordPress hosts that do exactly that. They cost more than an $8-a-month shared plan, and they’re worth it.
If your site is doing real work for your business (customer accounts, scheduling, payments, inventory, e-commerce beyond a tiny shop, anything with important data in it), then yes, this is a good time to think about moving. Not because PHP is bad. It’s because “WordPress plus thirty plugins on shared hosting” is hard to keep secure, and every new round of attacks makes it harder. The next PHP2Shell is already being discovered by someone’s AI model as you read this.
A custom web application built on a modern framework, with its own protected setup and someone whose actual job is keeping it running, is a different thing from a WordPress site. Most owners don’t see the difference until they’ve had both.
What to do this week
- Find out what version of PHP your site runs on. Your hosting dashboard usually shows it, or whoever runs your site can tell you in a minute. If it isn’t on one of the fixed versions listed below, it needs updating now.
- Make sure WordPress, your theme, and your plugins all update automatically. If something has been sitting there “waiting for review” for months, it either needs an update or it needs to go.
- Make sure you have a backup that really works. Not just “the host says they do backups.” A backup you’ve personally restored from, or watched someone restore from, in the last six months. Hosts lose backups.
- Ask whoever built or hosts your site, in writing, what they’d do if it got hacked. If there isn’t a plan yet, now’s a good time to make one together.
- If any of those answers worry you, get a second opinion before the next round of attacks instead of after it.
For your web person: PHP2Shell is CVE-2026-109618 and CVE-2026-109619. The fixed PHP releases are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and older no longer get updates from the PHP project, so those need a vendor backport or an upgrade to a supported version.
How Accolades can help
We help in three ways, in roughly the order folks need them.
First, we look over the site you have. We’ll tell you honestly whether WordPress is the right fit for your business, whether your hosting is doing its job, and whether whoever keeps it running has the depth to keep it running next year. That usually ends with a short written report and one of two next steps. Either we point you to the right managed WordPress host (we don’t charge you a monthly fee to watch over it, we just point you to a good one), or we have a conversation about moving the site.
Second, if your site is doing real work, we move it. A custom web application, a modern framework, a setup we actually understand, and a maintenance plan that includes patching everything when the next PHP2Shell shows up. We’ve done this enough times that the move runs with a demo every week, not a leap off a cliff.
Third, we take over sites that have already been hacked. This one is less fun. It usually means rebuilding a clean setup, bringing over the data that’s still trustworthy, and figuring out what the attackers did while they were inside. It goes a lot faster if you call us before an attack than after.
If any of that sounds like you, book the 30-minute discovery call. We’ll tell you honestly which one fits. And a lot of times the answer is “stay where you are, fix these three things, and we’ll see you in two years when the business has grown enough to need something custom.” We’re OK with that answer when it’s the right one. What we’re not OK with is leaving a business owner holding a site they don’t know how to protect.