Your WordPress site needs a PHP security update

What happened

This is the PHP incident on BBC News and in The Guardian. Two critical issues in the PHP engine, reported as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), can allow someone on the internet to run code on the server without logging in.

The UK National Cyber Security Centre has called the scale “unprecedented”. The Guardian reports governments took sites offline as a precaution, and that the long tail of websites without ongoing maintenance is what stays exposed. WordPress.org says update PHP immediately. Your host may already be applying the patch. Do not assume they have. Researchers told the BBC that around 90% of at-risk systems worldwide were still unpatched this afternoon.

• Not a WordPress bug. Core, plugin, and theme updates do not fix this.
• The host applies the fix. PHP lives on the server, usually behind the hosting control panel.
• Old PHP is a bigger job. PHP 8.1 and earlier no longer get official security updates. Those sites need a version upgrade, which can affect plugins.

What are the dangers if this is left

These flaws sit in PHP itself. An attacker on the internet can run code on the server without logging in. Leaving the site unpatched is not a WordPress delay — it is an open door.

• The site can be taken over. Someone else can change pages, add admin users, or lock you out. Customers would still see your name on it.
• Customer and payment data can be stolen. Contact forms, accounts, bookings, and checkout data live on the same server. P1 sites are the first target because that data is worth more.
• The server can be used to attack others. Compromised WordPress sites are used to send spam, hide malware, or hit other networks. Hosts then suspend the account.
• Search and email stop working for you. Google can drop a hacked site. Mail sent from it can start landing in spam. That is slower to reverse than a PHP update.
• Cleanup costs more than the patch. A same-branch patch is hours. Removing a backdoor, rebuilt plugins, or a restored shop is a separate job and can run to hundreds or thousands of pounds.
• Waiting is not a plan. Updating WordPress, plugins, or the theme does not close this. PHP 8.1 and older will not get an official fix. Governments and hosts have already taken sites offline as a precaution.

The patched versions

Ask your host, or whoever has panel access, to confirm the full version number. “PHP 8.3” is not enough — it must be one of the builds below.

In WordPress: Tools → Site Health → Info → Server. Official notice: wordpress.org/news.

What should we do

Every site is one of three jobs. I confirm which after I look. Each higher price includes the work in the columns to its left. Hack cleanup, if the site is already compromised, is a separate quote.

Details

The 30-day backup is part of the P1, P2 and P3 work. After that, a monthly care plan from £99 covers ongoing backups, updates, monitoring, and the next emergency without a panic invoice. Tick the form if you want that quoted.

After you submit the form

1. 1

   I reply within one working day with the agreed package and how to share access.

2. 2

   You share hosting and WordPress access (password manager, temp admin, or hosting invite). I take a complete files-and-database backup, store it away from the live host for 30 days, and check it can be restored.

3. 3

   PHP is patched or verified. You test the live site. I send a one-page report: old version, new version, and where the independent backup is held.