PHP2Shell: Is Your WordPress Website at Risk? Check It Today

Tech Engineers Group — Sat, 24 Oct 2026 13:07:12 +0000

This article was originally published on the Tech Engineers Group blog.

A serious new website problem called PHP2Shell is in the news, and hackers are already using it. If your business website runs on WordPress, it could be at risk right now, even if it’s new. The good news: it can be fixed. This guide explains what’s going on in plain English and what to do today, before a hacker finds your site first.

The short version

PHP2Shell is a weak spot in the software that runs most websites, including WordPress.
Hackers are already using it to break into websites without a password.
A fix was released on October 21, 2026, but it only protects your website once it’s installed.
Check your website today. It takes 2 minutes, or we’ll check it for you for free.

What is PHP2Shell?

Think of your website like your shop. Behind every WordPress website is a piece of software called PHP. It’s like the lock on your back door.

Security experts just found a serious weak spot in that lock. They named it PHP2Shell. With it, a hacker can walk into your website without a key or password.

A new, stronger lock (a security update) came out on October 21, 2026. But it doesn’t install itself everywhere. Until your website has it, the back door is still weak.

Why you need to act today

This isn’t something to put on next month’s to-do list.

Hackers are already using it. Break-in attempts started even before the fix came out.
They don’t pick you by hand. Hackers use automatic tools that check thousands of websites a day, looking for ones that haven’t been fixed.
Small business websites are easy targets. They often go months without updates, and hackers know it.
It’s in the news everywhere. That means more hackers know about it every day.

If a hacker gets in, they can:

Send your customers to scam or adult websites
Get a red “This site may be hacked” warning shown on Google
Steal names, emails and phone numbers from your contact forms
Get your website shut down by your hosting company
Make you lose calls and customers while it’s broken

Fixing it before a break-in is usually quick. Cleaning up after a break-in takes longer, costs more and can hurt your Google rankings.

Is my website at risk?

If your website runs on WordPress and nobody has updated it since October 21, 2026, the answer is probably yes.

It doesn’t matter if your website is new, small or was built last year. Almost every WordPress website needs this update.

How to check your website in 2 minutes

You don’t need to be a tech person:

Log in to your WordPress website (usually yourwebsite.com/wp-admin).
On the left menu, click Tools, then Site Health.
Click the Info tab at the top.
Click Server.
Find the line that says PHP version and look at the number.

Now compare it with this table. Find the row that matches the start of your number:

If your number starts with	You’re safe if it’s at least
8.5	8.5.12
8.4	8.4.27
8.3	8.3.36
8.2	8.2.35
8.1, 8.0, 7 or 5	Not safe. Your website needs an upgrade

Example: if you see 8.3.30, that’s lower than 8.3.36, so your website needs the update.

Can’t log in, or not sure what you’re looking at? That’s normal. Call your web person or hosting company and ask: “Has my website been updated for PHP2Shell?” Or just call us and we’ll check it for you.

What to do today

Check your PHP version using the steps above, or ask us to.
Ask your web person or hosting company to install the update. Ask them to back up your website first.
Make sure your website still works after the update. Test your contact form, phone buttons and any booking or checkout pages.
Check for signs of a break-in (see the list below). The update stops new break-ins but doesn’t remove a hacker who’s already inside.

Signs your website may already be hacked

Call someone right away if you notice any of these:

Your website sends people to strange or spam websites
Google shows a red warning screen or “This site may be hacked”
You see users or pages on your website that you didn’t create
Your website is suddenly very slow or keeps crashing
Your hosting company emails you about a virus or suspends your account
Customers tell you something looks wrong

Let us check your website for free

Tech Engineers Group is a website and WordPress security team in Piermont, New York. We help local businesses across Rockland County, Westchester, the Hudson Valley, New York City, Long Island and Bergen County, NJ.

Here’s what we do, so you don’t have to:

Check your website for free and tell you in plain English if it’s at risk
Install the update safely, with a full backup first
Make sure everything still works afterwards: your forms, buttons and pages
Scan for hackers and viruses and clean them out if we find any
Remove Google warnings so customers trust your website again
Keep your website updated so you don’t have to worry next time

Already been hacked? Our WordPress malware removal service cleans out the hacker, closes the doors they used and gets your website working again.

Don’t wait for a hacker to find your website first

Every day a website stays unfixed is another day hackers can find it. The check is free and only takes a few minutes.

Call (914) 774-7931 today or send us a message, and we’ll tell you if your website is safe.

PHP2Shell: common questions

What is PHP2Shell in simple words?

It’s a serious weak spot in the software that runs most websites, including WordPress. Hackers can use it to break into a website without a password. A fix came out on October 21, 2026, but every website has to install it.

Is my small business website at risk?

If your website runs on WordPress and nobody has updated it since October 21, 2026, it’s probably at risk. It doesn’t matter how new or small your website is.

How fast do I need to act?

Today. Hackers are already using PHP2Shell, and they use automatic tools that check thousands of websites a day looking for ones that haven’t been fixed.

I updated my website. Am I safe now?

You’re protected from new break-ins. But if a hacker got in before you updated, they can still be inside. A quick scan will tell you for sure.

Can my hosting company fix it?

Often, yes. Call or email them and ask: “Has my website been updated for PHP2Shell?” If they say no, or they don’t know, call us.

How much does it cost to fix?

Checking your website is free. If it needs an update or a clean-up, we’ll tell you the price before we start any work.

Need help? Tech Engineers Group is a WordPress and web design agency in Piermont, NY. We check WordPress websites for PHP2Shell for free and fix them fast for small businesses in Rockland, Westchester, the Hudson Valley and NYC. Read the full guide here: PHP2Shell: Is Your WordPress Website at Risk?

The 10-Minute AI Visibility Test Every Small Business Should Run This Month

Tech Engineers Group — Wed, 07 Oct 2026 09:03:37 +0000

You do not need a tool, a subscription or an agency to find out whether AI assistants are recommending your business. You need ten minutes, a notes app and a willingness to read a few answers that might sting. Here is the exact test we run on day one with every new client, written so you can do it yourself.

Before you start
Open a fresh, logged-out session where possible so your own history does not skew the results. Use at least two assistants: ChatGPT and Google's AI Mode (or Gemini) are the minimum; Perplexity is a useful third because it shows its sources. Pick your main service and the town where you want the most work.

The five prompts
1-'Who is the best [service] in [town]?' This is the money prompt. Note every business named and the reason given for each.
2.'I need a [service] in [town] that [your real differentiator, e.g. does emergency calls / is licensed for commercial work]. Who should I call?' Tests whether your specialty is visible.
3.'What does [service] cost in [county]?' Tests whether your content is used as a source for pricing questions, which are extremely common.
4.'Is [your business name] a good [service]? What do people say?' Tests what the model knows about you specifically.
5.'Compare [your business] and [top competitor named in prompt 1].' Reveals which facts the model has about each of you.

How to read the results
•Not named at all in prompts 1 and 2: your site is not surfacing for plain-language searches or has nothing quotable. Start with page structure.
•Named in prompt 4 but not prompt 1: the model knows you exist but does not trust you enough to recommend you unprompted. Usually a reviews or consistency problem.
•Wrong facts in prompt 4 (old address, services you dropped): a data consistency problem on directories you have forgotten.
•Competitor gets a reason you also deserve: that strength is not written anywhere on your site or in your reviews.
Tip: Ask a follow-up every time: 'Why did you choose those three?' The model will explain its reasoning and often cite the exact page or review it used. That is a free audit.

Turn the notes into a to-do list
After the test, you will typically have three to five concrete gaps. Most of them fall into the same buckets: a missing town page, a missing FAQ, an inconsistent phone number, too few recent reviews, or a differentiator you never wrote down. Fix the cheapest one first, then re-run the test in thirty days. Keep the log; the trend matters more than any single result.

How often to repeat it
Monthly is enough for most local businesses. AI answers change as the underlying search results change, so a single test is a snapshot, not a verdict. Three months of logs will tell you clearly whether your work is moving the needle.

Frequently asked questions
Do I need paid versions of the AI tools?
No. The free versions of ChatGPT, Gemini and Perplexity all run live searches for local questions and are fine for this test.
What if the AI says it cannot recommend specific businesses?
Rephrase: 'List three well-reviewed [service] companies in [town] and why.' Most assistants will answer that form of the question.
Should I test from my own town?
Yes, and from a logged-out or private session so your own history does not influence the answer.

Key takeaways
•Five prompts, two assistants, ten minutes.
•Always ask the model why it chose the businesses it named.
•Log results monthly and fix the cheapest gap first.

About the author
This article was written by the team at Tech Engineers Group, a digital growth agency in Piermont, NY that builds websites and runs AI search (GEO) programs for local businesses across Westchester, Rockland, NYC, Long Island and the Hudson Valley. Want to know whether AI assistants recommend your business? Run a free AI visibility check or read more guides at techengineersgroup.com.

DEV Community: Tech Engineers Group