Managed IT ServicesSummary: The PHP2Shell vulnerability is a pair of critical flaws in PHP, the software that runs most business websites, including WordPress. Fixes came out on October 21, 2026. If your practice or firm has a website, patient or client portal, or online forms, ask whoever hosts it to confirm it is patched this week. Office PCs and staff email are not directly affected, so your team doesn’t need to do anything.
If you own or manage a medical practice, law firm, CPA firm, or financial advisory office in New Jersey, you probably don’t think about the code that runs your website. You don’t need to. But today someone should, because the PHP2Shell vulnerability affects the engine underneath a large share of the web.
This guide explains what happened in plain language, what is and isn’t at risk, how it touches HIPAA and the FTC Safeguards Rule, and five steps to take this week. We’ve left out the technical exploit details on purpose. You don’t need them to protect your business.
What Is the PHP2Shell Vulnerability?
PHP is a programming language that runs on web servers. When a visitor opens a page, PHP builds it on the fly. WordPress, Drupal, Joomla, and countless custom sites and portals depend on it. Wiz Research, one of the teams that found the problem, says PHP powers about 70% of the world’s websites.
The PHP2Shell vulnerability is the nickname for two flaws tracked as CVE-2026-109618 and CVE-2026-109619. The official php.net security release rates both at 9.2 on the CVSS 4.0 severity scale, which is critical. In simple terms, an attacker on the internet could take control of a vulnerable web server without logging in. Once in, they could change pages, plant malware, or reach data the site handles.
What makes the PHP2Shell vulnerability unusual is that the flaw lives in PHP itself, not in a particular plugin or theme. Wiz says even a basic “Hello World” page on an affected version can be vulnerable, and it reports that nearly every PHP version released in the last decade is affected. The PHP project says all PHP installations serving web requests are affected, whether they run under Apache, PHP-FPM, LiteSpeed, or another common setup.
Which PHP versions are fixed?
According to php.net and the CISA alert issued the same day, the fixed releases are:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
PHP 8.1 and older are end-of-life. The PHP project says those versions no longer get updates from it. Its security team did post minimal source-code backports for 7.4, 8.0, and 8.1, and some Linux distributions and long-term support vendors offer their own patches. For a typical small business site, though, the practical answer is the same: if your site runs PHP 8.1 or older, plan to upgrade. Also note that PHP 8.2 itself reaches end of life on December 31, 2026, so a site on 8.2 needs an upgrade plan soon too.
Why the PHP2Shell Vulnerability Matters Right Now
Two things make this the critical PHP vulnerability 2026 will be remembered for, not just another patch notice: how it was found, and how fast attackers can now move.
An AI-discovered vulnerability
The PHP2Shell vulnerability is a clear example of an AI discovered vulnerability. Wiz says its researchers used its Wiz Atlas platform along with Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol throughout the work. OpenAI says the security firm Calif separately identified a critical flaw using GPT-5.6 Sol as part of its “Patch the Planet” program, and that Wiz independently found and reported both flaws. The PHP team then coordinated the fixes.
That’s good news. Defenders found the PHP2Shell vulnerability and fixed it before public release. But the same tools are available to people on the other side.
The window to patch is shorter
In the past, a small business might have had weeks between a patch and real-world attacks. That cushion is shrinking. OpenAI itself has warned that the same AI capabilities “can also help attackers rapidly develop offensive tools and exploits.” Once a fix is public, attackers can compare the old and new code to work out what was broken, and AI makes that faster.
History backs this up. For an earlier PHP flaw in 2024 (CVE-2024-4577), Akamai saw exploit attempts against its honeypots within 24 hours of public disclosure, as reported by The Hacker News. In this case, CISA said it had not observed exploitation when it published its alert. Cloudflare, however, told CyberScoop it was “seeing early attacks emerging.” Either way, the safe assumption is that you have days, not months, to close the PHP2Shell vulnerability on your own systems.
How many sites are exposed?
Estimates vary, so here is who said what:
- A Censys search shared by security researcher Silas Cutler returned about 2.57 million internet-facing hosts identifying as PHP. He estimated that likely more than 1.3 million could be vulnerable.
- Using Shodan data, Mallory found about 884,000 hosts reporting PHP 8.1 or older. That is about 59% of roughly 1.5 million hosts that report a version, as reported by The Hacker News.
These are counts of version labels, not confirmed hacks or a precise measure of the PHP2Shell vulnerability’s reach. But they show how many sites run versions that will never receive an official fix.
Is My Website Vulnerable? What Is and Isn’t Affected
This is the question we’re hearing most: is my website vulnerable? The short answer is that anything web-hosted that runs on PHP should be treated as exposed to the PHP2Shell vulnerability until someone confirms otherwise.
What is affected
- Your business website, especially if it runs WordPress, Drupal, or Joomla. Wiz demonstrated attacks against all three.
- Patient or client portals hosted on a web server, if they use PHP.
- Online forms for appointments, intake, contact, or document uploads.
- Anything else web-hosted, such as a staff intranet, a booking page on your own server, or an old microsite nobody remembers.
What is NOT directly affected
- Office PCs and laptops. The PHP2Shell vulnerability is a server-side problem. Your staff’s Windows or Mac computers aren’t the target.
- Staff email. Microsoft 365 and Google Workspace mailboxes are not PHP sites you run.
- Phones, printers, and copiers. These don’t run your website.
So your staff don’t need to do anything. There is no update for them to click and no password to change because of the PHP2Shell vulnerability. The work sits with whoever manages your website and hosting.
One caution: if you use a hosted EHR, practice management, or accounting portal from a vendor, it’s fair to ask the vendor whether its web-facing systems are patched. You don’t need to panic. Just ask.
The Compliance Angle: HIPAA Website Security and the FTC Safeguards Rule
For regulated businesses, a website hacked through the PHP2Shell vulnerability isn’t only an IT headache. It can be a reportable incident.
Medical practices and HIPAA website security
If your site collects patient information through intake forms, appointment requests, or a portal, that data may be protected health information. A breach of that information can trigger the HIPAA Breach Notification Rule, which requires notices to affected patients and to HHS. See the HHS breach notification guidance. HIPAA website security also means keeping software patched as part of your risk management. If you haven’t reviewed your web systems in your security risk analysis, a security risk assessment is the right place to start. Our HIPAA compliance consulting team can help.
CPA firms, tax preparers, and financial advisors
Accounting firms, tax preparers, and many financial businesses fall under the FTC Safeguards Rule. It requires a written information security program, and it requires reporting certain breaches affecting 500 or more consumers to the FTC. A compromised client upload portal could qualify. The FTC’s Safeguards Rule guide lays out the basics, and our FTC Safeguards Rule compliance page explains how we help NJ firms meet it.
Law firms and cyber insurance
Law firms handle confidential client files and often accept them through web forms. Beyond ethical duties, there is insurance to think about. Cyber insurance carriers commonly ask about patching on applications and renewals. If a breach traces back to a known, unpatched critical flaw like the PHP2Shell vulnerability, expect hard questions during the claim. Keeping a dated record of when your site was patched is cheap protection.
Keep a simple patch record
Whatever your industry, create a one-page note for your compliance file. List the website and any portals, who hosts each one, the PHP version before and after, the date it was patched, and who confirmed it. Save the email replies from your host or developer. If an auditor, insurer, or regulator ever asks how you handled the PHP2Shell vulnerability, you can answer in minutes instead of reconstructing events from memory. It also gives you a ready list for the next critical update, because there will be one.
WordPress PHP Security Update: 5 Steps to Take This Week
You don’t need to be technical to get this done. You need to ask the right people the right questions and keep a record. Here are five steps to close the PHP2Shell vulnerability on your business website.
1. Find out who hosts your website
Many owners aren’t sure. Check your web designer’s invoices, your credit card statements, or the welcome email from when the site launched. Common answers are a web designer, a hosting company, or your IT provider. Write down the name and a contact. You’ll need it for this issue and the next one.
2. Ask them to confirm the PHP version and that it’s patched
Send a short email. You can copy this: “Please confirm which PHP version our website and any portals run on, and whether the October 21, 2026 PHP security updates for CVE-2026-109618 and CVE-2026-109619 have been applied. Please reply with the version number and the date.” Safe answers are 8.5.12, 8.4.27, 8.3.36, or 8.2.35 or newer, or a vendor-patched build they can document.
3. Upgrade any end-of-life PHP version
If the answer is PHP 8.1, 7.x, or older, the site needs an upgrade plan now. CISA advises that organizations that can’t update right away, or that still run PHP 8.1 or earlier, take those systems offline until they’re patched or updated. A web application firewall may give some protection in the meantime, but it isn’t a fix. Upgrading can break old themes or plugins, so ask your developer to test first.
4. Run a WordPress PHP security update for core and plugins
Once PHP is current, update WordPress itself, your theme, and every plugin. Remove plugins you no longer use. Updating PHP closes the PHP2Shell vulnerability, but out-of-date plugins are still the most common way small business sites get hacked. Turn on automatic minor updates if your developer agrees.
5. Check for signs of compromise
Ask your host or IT provider to review the site for anything unusual: new admin accounts, files changed recently, strange redirects, spam pages, or sudden server errors. CISA also recommends watching for web server processes launching unexpected programs. If something looks wrong, don’t just restore and move on. Follow an incident plan like the one in our guide on what to do after a cyberattack.
If your website was built years ago and nobody has touched it since, it is worth a closer look after this patch. Older sites often run outdated PHP, abandoned plugins, and forgotten admin accounts. Fixing the PHP2Shell vulnerability is a good reason to clean up all three at once, so the next alert is a quick confirmation instead of a scramble. Ask your web developer for a list of everything installed on the site, and keep it with your patch record.
Small Business Website Security in NJ: How eMDTec Is Responding
For our managed clients, eMDTec is handling the PHP2Shell vulnerability the same way we handle any critical vulnerability. We’re identifying every client website, portal, and web-facing server we manage or can see, and confirming PHP versions. We’re coordinating patches with hosting providers and web developers. We’re flagging any end-of-life PHP for upgrade. And we’re documenting the dates for each client’s compliance records.
We’re also reviewing firewall and monitoring alerts for unusual web traffic, and we’ll keep watching vendor guidance as it develops. If anything we find changes the picture for a client, we’ll call them directly rather than send a form letter.
Where a client’s website is managed by an outside designer, we reach out to that designer on the client’s behalf, so the owner doesn’t have to chase it. That’s the kind of small business website security NJ practices and firms should expect: someone owns the follow-up.
If you’re not a client yet, our cybersecurity services and managed IT services NJ businesses rely on cover this kind of patch tracking every day. It’s also a good moment to check your broader small business data compliance, since your website is often the front door to the data you’re required to protect.
PHP2Shell Vulnerability FAQ
Do my employees need to do anything about PHP2Shell?
No. The PHP2Shell vulnerability affects web servers running PHP, not office computers or email. Your staff don’t need to install anything or change passwords because of it. The action item is for whoever manages your website and hosting.
My site runs on WordPress. Is that enough to know I’m affected?
WordPress runs on PHP, so a WordPress site should be treated as at risk until your host confirms the PHP version is patched. Wiz demonstrated the attack against WordPress. Updating WordPress alone doesn’t fix it. The PHP version on the server has to be updated.
Which PHP versions fix PHP2Shell?
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, released October 21, 2026, per php.net and CISA. PHP 8.1 and older no longer get official updates from the PHP project, though some vendors offer their own patches.
Has anyone been hacked through PHP2Shell yet?
When CISA published its alert on October 21, 2026, it said it had not observed exploitation. Cloudflare told CyberScoop it was seeing early attacks emerging. Assume attacks on the PHP2Shell vulnerability are coming and patch now.
Does a hacked website count as a HIPAA or FTC breach?
It can. If the site or a connected portal holds patient or client information and that data is accessed, HIPAA or FTC Safeguards Rule notification duties may apply. Talk to your compliance advisor or attorney about your specific facts.
What if my web designer doesn’t answer?
Don’t wait. Contact your hosting company directly and ask the same questions. If you can’t reach either one, call us and we’ll help you find out where your site lives and whether it’s patched.
Not Sure If Your Website Is Exposed? We’ll Check It for You
If you aren’t sure who hosts your site or what PHP version it runs, you’re not alone. eMDTec will run a free website PHP and security check for New Jersey practices and firms. We’ll tell you what your site runs, whether it’s patched against the PHP2Shell vulnerability, and what to fix first, in plain English.