If your business runs on WordPress, treat this as urgent — not optional.
On October 21, 2026, the official PHP Foundation issued an emergency security release to fix two critical, maximum-severity vulnerabilities in PHP. Dubbed PHP2Shell by security researchers, this flaw affects the core engine that powers over 75% of the web.
Updating your WordPress plugins or themes will not fix this issue. The underlying server software running beneath WordPress must be patched immediately.
Why You Might Have Already Noticed Tech Outages
If you've noticed digital services glitching recently — such as Revolut card payments failing at checkout, mobile banking apps going temporarily offline, or online booking portals dropping out — it isn't a coincidence.
When a core underlying language like PHP suffers a major security flaw, major infrastructure platforms, hosting networks, and payment gateways undergo emergency maintenance or get targeted by automated scanning tools.
Automated hacker bots don't care how big or small your business is. They scan thousands of IP addresses across West Lothian every hour — from Livingston and Broxburn to Linlithgow and Bathgate — looking for unpatched servers to exploit.
What Happens If Your Site Is Left Unpatched?
Think of your website like a physical shop:
- WordPress is the shop counter, shelves, and till.
- PHP is the physical lock on the front door.
Updating a WordPress plugin is like polishing the till. It doesn't matter how clean the till is if the front door lock is broken.
If an attacker finds an unpatched PHP server, they can:
- Steal sensitive customer data (contact form messages, customer addresses, or account details).
- Crash your site or lock you out of your admin dashboard completely.
- Inject malicious code that redirects your visitors to online scams.
- Use your business domain to send spam, getting your official business emails blacklisted.
Hoping you won't be targeted is not a strategy. If you don't know when your live server's PHP engine was last updated, you must check now.
What Needs to Happen: 4 Clear Steps
1. Identify Your Live PHP Version
Your web developer or hosting provider must inspect your live production server — not just the WordPress admin dashboard. They need to verify what PHP version is handling live web traffic.
2. Apply the Emergency Security Patch
PHP has released official patched versions:
- PHP 8.5 → Update to 8.5.12 or higher
- PHP 8.4 → Update to 8.4.27 or higher
- PHP 8.3 → Update to 8.3.36 or higher
- PHP 8.2 → Update to 8.2.35 or higher
3. Upgrade Unsupported PHP Versions
If your site is running PHP 8.1 or older (e.g., PHP 7.4 or 8.0), the PHP Foundation is not releasing official patch builds for these end-of-life versions. Your developer must perform a controlled upgrade to bring your site onto a modern, supported branch (such as PHP 8.3).
4. Restart Server Services & Verify Live Site
Simply running an update package on a server isn't enough; the PHP processes (like PHP-FPM or Apache) must be restarted to flush out the old code in memory. Afterwards, test contact forms, checkout flows, and logins to confirm everything works smoothly.
What NOT to Rely On
The following will not protect you from this specific vulnerability:
- ✗ "We have Wordfence / a security plugin installed." (Plugins operate inside WordPress; PHP vulnerabilities exist below WordPress).
- ✗ "We updated our WordPress theme/plugins last week."
- ✗ "Our business is too small for anyone to care about." (Scanners hit every website automatically).
Need Help Checking Your Website?
If you have a dedicated web designer, developer, or managed IT provider, send them this post or ask them directly:
"Has our live server PHP runtime been patched for the October 21 PHP2Shell security release (CVE-2026-109618 / CVE-2026-109619)?"
If you built your site years ago, don't have an active web developer, or aren't sure who manages your hosting server, feel free to reach out to our engineering team at Laraworks. We are based in Broxburn, West Lothian, and we can quickly audit your setup, tell you plainly if you are exposed, and help you get it secured.
