Skip to content
PixelHeist
  1. Home
  2. Blog
  3. The PHP security flaw, and what we did about it

The PHP security flaw, and what we did about it

Two critical flaws in PHP were disclosed this week. Here is what they mean for a small business website, and why every site and server we look after is already secured.

By The Pixel Heist team ·

A stack of three servers connected to a large teal shield with a check mark, beside a padlock and code brackets.

If you run a website, there is a decent chance you have seen the headlines this week. Two serious security flaws were found in PHP, the programming language behind a huge share of the web, including most WordPress sites. This post explains what happened in plain language, and what we have done about it.

The short version: we have fully secured our websites and servers. If you are a Pixel Heist client, there is nothing you need to do.

What happened

On October 21, the PHP project released emergency fixes for two flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed “PHP2Shell.” Both are rated critical (9.2 out of 10). In practice, either one could let a stranger run their own code on a web server without needing a password.

The important detail is that the problem sits in PHP itself, not in WordPress, a plugin, or a theme. Keeping your site’s software up to date does not protect you on its own. The server underneath has to be updated too.

The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and older no longer receive fixes at all, so a site still running one of those needs to move to a supported version.

What we did

Every website and server we host and maintain has been updated and secured against both flaws. We did not wait to see whether the problem would reach our clients. Patching this kind of thing is exactly what the hosting and maintenance part of our work is for, and it is why you have not had to think about it.

If you are a client, you do not need to log in, install anything, or change anything. Your site is covered.

If your site is hosted somewhere else

Not everyone has someone watching their server. If your site lives with another host or agency, or you are not sure who looks after it, it is worth a short email to ask:

  1. Have you applied the October 21 PHP security release to my server, and on what date?
  2. Which version of PHP is my site running?
  3. If it is PHP 8.1 or older, what is the plan to upgrade it?

Be aware that some hosts patch PHP without changing the version number, so an older-looking number does not always mean an unpatched server. That is why it is worth asking rather than guessing. Managed hosts generally handle this themselves, but a self-managed server or VPS will not update itself.

Questions

If you are not sure whether your site is affected, or you would like us to take a look at how it is hosted, get in touch. We are glad to help.

Sources: CISA alert, Codeable’s guide for WordPress site owners.