PHP Vulnerability: What Philadelphia Businesses Need to Know About PHP2Shell

Your website probably isn’t the first thing you worry about on a Tuesday. It sits there, looks professional, and collects contact forms. But on October 20, details of two critical flaws in PHP leaked online before a fix was ready. PHP is the software that runs most of the internet’s websites, and that likely includes yours.

Security researchers named it “PHP2Shell.” If your firm’s website runs on WordPress, it runs on PHP. For a Philadelphia law firm, CPA practice or title agency, that site may also hold intake forms, client portals or document uploads. A PHP vulnerability like this one isn’t only a tech problem for Philadelphia businesses. It can turn into a client-confidentiality problem.

What Happened, Without the Jargon

PHP is the engine behind WordPress, Drupal, Joomla, Magento and many client portals. Researchers found two holes in it (tracked as CVE-2026-109618 and CVE-2026-109619). Both are rated critical. In plain terms, an attacker on the internet could run their own commands on your web server. They wouldn’t need a password or a login.

Normally these things get fixed quietly before the bad guys hear about them. This time the details leaked a day early. PHP rushed out patched versions on October 21, and security firms reported that attacks were already starting. So the clock started before most website owners knew anything was wrong.

PHP’s own developers were blunt: there’s no settings tweak that fixes this. The only real fix is updating PHP.

Why This One Is Worse Than the Usual Plugin Bug

Most WordPress security news is about one bad plugin. You update the plugin and move on. This is different. The flaw lives in PHP itself, the layer underneath WordPress. So a perfectly maintained site with every plugin updated can still be exposed if the server’s PHP version is old.

That’s where a lot of firms get caught. Somebody built the site five years ago, the hosting renews on autopilot, and nobody has looked at the PHP version since. Nobody knows who’s supposed to check it.

The Old-Version Trap

PHP released fixes for its supported versions: 8.2, 8.3, 8.4 and 8.5. Versions 8.1 and older are end-of-life, meaning PHP no longer officially supports them. Some hosts and Linux vendors may patch older builds themselves, but you shouldn’t count on it.

Running end-of-life software is like driving a car the manufacturer stopped making parts for. It works until it doesn’t. We made the same point about hardware in how long business computers last and when to replace them. Software ages out too, and usually with less warning.

It’s Not Just Your Website

PHP also shows up in places you might not expect:

Client portals and intake forms built on PHP frameworks
Hosting control panels like cPanel and Plesk
Vendor appliances and line-of-business software with a web-based admin page
Old “test” or staging sites that nobody remembers are still online

That last one is the sneaky one. A forgotten copy of your 2019 website is still a working door into a server.

What to Do This Week

You don’t need to become a server admin. You do need answers to a few questions:

Find out what PHP version your site runs. In WordPress, go to Tools > Site Health > Info > Server. Or ask your host or web person directly.
Confirm it’s patched. You want 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer. If your host patches PHP itself, get written confirmation that the fix is installed.
Plan an upgrade if you’re on 8.1 or older. Test the site on a supported version first, because old themes and plugins sometimes break.
Take down what you don’t need. Retire old staging sites, abandoned microsites and unused portals.
Check that your backups work. Back up before you patch, and make sure you can actually restore.
Look for signs someone got in. Watch for unfamiliar admin accounts, new files you didn’t upload, or a site that suddenly redirects visitors somewhere else.

If your answer to “who checks our PHP version?” is a shrug, that’s the real problem to fix. It belongs on the same list as your other recurring tech costs. We covered how to plan for that in our guide to building a small business IT budget.

The Bigger Lesson

PHP2Shell will get patched and forgotten, and there’ll be a new one by spring. Panicking about each one isn’t the answer. You need someone who knows what’s running on your website and servers, keeps it current, and can tell you within an hour whether the latest headline affects you. For Philadelphia businesses that handle confidential client data, that’s simply part of doing business responsibly.

Not Sure If Your Website Is Exposed?

Abuzz Technologies has been keeping Philadelphia and South Jersey businesses out of trouble since 2008. Book a free 20-minute consultation and we’ll tell you what PHP version your site runs and whether you need to act. No sales pitch, no obligation.

Schedule a Free Consultation