If your small business runs a website — WordPress, Drupal, Magento, a custom site, or almost any PHP-based platform — a pair of critical bugs disclosed on October 21 could let an attacker take over the server with no password, no login, and no mistake on your part. The flaws are being actively probed in the wild, and the patch window is measured in days, not weeks.
What happened
On October 21, 2026, the PHP Project released emergency updates for two critical remote code execution vulnerabilities nicknamed "PHP2Shell." The pair of pre-authentication remote code execution flaws (CVE-2026-109618 and CVE-2026-109619) are rated CVSS v4.0 9.2, and every unpatched PHP installation serving web requests is at risk, with Apache servers running mod_php at highest risk.
In plain English: PHP is the engine that powers an enormous share of the small-business internet — WordPress sites, online stores, booking pages, customer portals. On mod_php, exploitation happens during request initialization, before any application code runs. PHP2Shell is a runtime bug, not an application bug: on mod_php, CMS updates, plugin hygiene and application hardening do not change exposure. The attacker needs no login and no flaw in WordPress, Drupal or the custom code behind the site.
On October 21 around 9:30 am ET, the PHP team released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to address the two vulnerabilities. If your hosting is on an older, end-of-life branch of PHP, you may not get a fix at all from upstream.
Why small businesses should care
This isn't a theoretical risk. Amazon Threat Intelligence has reported an exploitation attempt on October 17, 2026, before public disclosure, and other security vendors have since reported further exploitation attempts. Exploitation attempts began on October 17, four days before PHP released fixes. SOCRadar found PHP2Shell exploit tooling on an exposed attacker server. PHP releases new patches.
The real-world impact of a successful exploit: attackers run commands on your web server as the web user. That typically means stolen customer data, defaced websites, malicious code injected to steal credit cards from your checkout, your site weaponized to phish your own customers, or a foothold used to pivot deeper into your network.
And the exposure is huge. Upstream only patches 8.2 through 8.5, so PHP 8.1, 8.0, 7.x and 5.x get nothing from php.net, and roughly 884,000 internet-facing hosts advertise one of those versions. Plenty of small-business sites are still sitting on those older versions because nobody has looked under the hood in years.
What your IT provider should be doing right now
If you have a managed-IT provider or web host, they should already be doing four things this week:
1. **Inventory every PHP installation you own or use** — your main website, any staging sites, intranet apps, legacy portals, anything a vendor set up and forgot about. 2. **Patch to the fixed PHP release on the right branch** (8.5.12, 8.4.27, 8.3.36, or 8.2.35) and restart the PHP workers. A patched binary that isn't actually running doesn't protect you. 3. **Apply the interim mitigations where patching is slow.** Apply the PHP Project's interim mitigations: memory_limit=-1, session.upload_progress.enabled=0 and, on PHP 8.5, fatal_error_backtraces=0. 4. **Hunt for signs of compromise** on any internet-facing PHP server — unexpected web shells, new cron jobs, outbound connections to unfamiliar IPs — because exploitation was happening before the patch existed.
If you're running an older PHP branch (8.1 or earlier), the honest answer is: upgrade the stack, or move the site to a modern hosting platform. There is no safe long-term workaround. Patching third-party web stacks, monitoring for exploitation, and keeping an asset inventory are exactly the kind of baseline work that belongs in a modern managed IT and cybersecurity program. For businesses with an in-house tech person who needs backup on fire drills like this, co-managed IT support fills the gap without replacing your staff.
What York Businesses Should Do
York County small businesses with WordPress, WooCommerce, or any PHP-based site should ask their web host or IT provider this week whether PHP was patched after October 21 and whether their server logs were reviewed for pre-patch exploitation. If nobody can answer clearly, York Computer can audit your public-facing stack and tell you where you stand.
Sources
- Technical Advisory: PHP2Shell Pre-Auth RCE (CVE-2026-109618, CVE-2026-109619) — Bitdefender
- Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities — Huntress
- Advisory: PHP2Shell Vulnerabilities — Sophos
- PHP2Shell (CVE-2026-109618 & CVE-2026-109619): Critical PHP RCE Flaws — SOCRadar
- php2shell CVE-2026-109618 and CVE-2026-109619 PHP RCE Patch Guide — TuxCare