Update PHP now: what website owners need to do.

Last updated: 21 Oct 2026

If your business website runs on WordPress, WooCommerce, Joomla, Drupal or anything else built in PHP, the server it runs on needs updating this week. The fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Anything older is exposed to PHP2Shell, the pair of critical flaws the PHP project patched on 21 October 2026, unless your host or Linux distribution has shipped its own patched build.

Most of the advice going around is written for developers. This note is for the person who owns the website and needs to know what to do about it, who should do it, and how to make sure it actually got done.

Why you can't ignore this one

PHP2Shell isn't a plugin bug. It's in PHP itself, the software your web server uses to run your site, and it can let an attacker run their own code on the server without logging in. Researchers showed it working against current standard versions of WordPress, Drupal and Joomla.

Cloudflare reported early attacks before the fix was even released. The US cyber agency CISA urged organisations to patch immediately, and the UK's National Cyber Security Centre advised updating quickly and taking systems offline if they couldn't be fixed. When I wrote this, CISA said it hadn't yet confirmed exploitation, but I wouldn't plan around that. Automated scanners don't care how small your business is.

Updating WordPress, your theme or your plugins does nothing for this. The fix happens on the server.

Step 1: find out what you're running

You need one number: your site's PHP version.

• WordPress: Tools, then Site Health, then the Info tab, then Server. Look for "PHP version".
• cPanel hosting: MultiPHP Manager, or Select PHP Version on some hosts.
• Other hosts: look for "PHP settings" or "PHP version" in your control panel.

Write it down, including the last part. On standard builds, 8.3.36 is fixed and 8.3.30 isn't. Hosts and Linux distributions sometimes patch a version without changing its number, so if yours looks old, ask your host before you panic. If you get stuck, I've written a full guide to checking your PHP version.

Step 2: work out who is responsible for updating it

This is where most business owners get caught out. Everyone assumes someone else is handling it.

If you don't know which of these you are, check who you pay for hosting. That's your first call.

Step 3: get the update done

If you're on 8.2, 8.3, 8.4 or 8.5: you need the latest patch release of the same version. On shared and managed hosting this is normally the host's job, and many had patches ready on release day. Ask them to confirm it for your account. On your own server, update the PHP packages and restart PHP-FPM or your web server. A restart matters. Until PHP restarts, the old code is still running.

If you're on 8.1, 8.0, 7.4 or older: the PHP project isn't shipping official releases for these versions. Its security team published source-only backports, and some hosts and Linux distributions ship their own patched builds, so ask. If yours doesn't, the answer is an upgrade to 8.3 or 8.4. That's a bigger job, because old themes and plugins often need fixing on the way. I'd skip 8.2 as a destination, since it stops getting security fixes on 31 December 2026. More on that in my PHP upgrade service.

If you can't update today: some web application firewalls, including Cloudflare's, have added rules to block the known attacks. PHP's advisory also lists temporary settings that reduce exposure. They help, but the PHP team is clear that updating is the only complete fix. Treat these as a stopgap measured in days, not months.

Step 4: check nothing broke

As soon as the update is done, spend ten minutes testing the parts of the site that make you money:

• Submit your contact or quote form, and confirm the email arrives.
• On an online store, place a test order through to the payment page.
• Log in to your admin area.
• Check your conversion tracking still records enquiries, if you run ads.

A form that quietly stops sending email after a server change is one of the most common problems I get called in to fix. Nobody notices until enquiries dry up.

Step 5: make sure you weren't hit before the patch

The flaws were public before the fixes shipped, so it's worth a quick check. Look for admin users you don't recognise, odd files in your uploads folder, pages in Google that you never created, and warnings from your host. I've listed ten signs your website has been hacked, with what to do if you find one.

What I'd do this week if it were my business

Today, find the version and email whoever is responsible. Ask three questions: which PHP version is my site on, has it been updated to a release that fixes CVE-2026-109618 and CVE-2026-109619, and if I'm on 8.1 or older, what's the plan to upgrade. Get the answers in writing.

By the end of the week, the site should be on a fixed release, tested, and checked for signs of compromise. If any of that is unclear, or nobody gives you a straight answer, that's when to bring in someone who does this every day.

I'm a web developer and I've worked on hundreds of sites across WordPress, WooCommerce, Joomla and many different hosts. This is routine work for me. Send me your web address through the free PHP2Shell website check and I'll tell you where you stand, usually within one working day.

Questions people ask

How do I update PHP on my website?

On most shared hosting you change the PHP version in your control panel, for example MultiPHP Manager in cPanel or PHP Manager in SiteGround Site Tools. On managed WordPress hosting the host usually updates PHP for you. On your own server, your developer installs the fixed release and restarts PHP.

Do I need a developer to update PHP?

Not always. A patch update within the same version on a simple site is often safe to do yourself through your hosting panel. If your site is on PHP 8.1 or older, runs an online store, or has custom code, a developer should test the upgrade on a staging copy first.

Does updating WordPress update PHP?

No. WordPress runs on PHP, but it does not control which PHP version your server uses. PHP is updated by your host or on your server.

Is it safe to update PHP?

Updating to the latest patch release of the version you already run is low risk. Moving between major versions, such as 7.4 to 8.3, can break older themes and plugins, so back up first and test on a staging copy.

Filed under: Security · PHP · WordPress · Website owners · 2026

Sources: PHP project, CISA, NCSC, Cloudflare.