The PHP project shipped emergency fixes this morning (Oct 21, 2026, about 9:35 AM ET) for two critical remote code execution bugs, CVE-2026-109618 and CVE-2026-109619, now being called PHP2Shell. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
If you build or look after WordPress, Joomla or Drupal sites for small businesses, this one lands on your desk whether you sell maintenance or not. Most of those owners have never heard of PHP, and they will call the person who built the site.
Here's a short, practical routine to get through the day without panic.
1. What actually changed (from the official advisory)
- The PHP team says all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. They rate mod_php highest, with a demonstrated exploit that fires before any application code runs.
- They say there are no complete mitigations. Updating is the fix.
- PHP 8.1 and older get no official release. The security team published minimal source backports for 7.4, 8.0 and 8.1, and some distributions and LTS vendors ship their own backports.
- Cloudflare said it was already seeing early attack attempts before the release (reported by BleepingComputer).
Sources: the php.net advisory and BleepingComputer's write-up.
2. Make a list of every site you touch (10 minutes)
Open a spreadsheet with one row per client site and these columns:
| Site | Host type | PHP version | Who controls updates | Status |
|---|
"Host type" is the column that decides your day:
- Managed WordPress hosts usually patch PHP for the customer. Your job is to confirm, not to patch.
- Shared hosting with a PHP version picker (cPanel "MultiPHP", Plesk and similar) usually means the host updates the minor version, but the site stays on whatever branch was picked. A site pinned to 7.4 or 8.0 is the one to worry about.
- A VPS you set up is yours to patch, today.
3. Find the PHP version for each site (10 minutes)
For sites you manage, use access you already have:
- WordPress: Tools → Site Health → Info → Server shows the PHP version.
- cPanel: MultiPHP Manager shows the branch per domain.
- A server you run:
php -v, plus the version your web server actually loads (FPM can differ from the CLI).
Only check sites you look after or have permission to test. This is a client service, not a reason to poke at strangers' servers.
4. Sort and act (10 minutes)
- 8.2 to 8.5 on a host that patches: ask the host to confirm the fixed build, note the date, done.
- 8.2 to 8.5 on your own server: update packages now and restart PHP-FPM or Apache.
- 8.1 or older: this is the real conversation. Either the host has a backport, or the site needs a version upgrade, which means testing plugins and themes. Quote it as a small project.
- You can't tell who controls it: that's the row to call the client about first.
5. The note to send clients (copy and edit)
Hi [name], a serious security issue in PHP, the software your website runs on, was fixed this morning. I've checked your site: it's on [version] with [host]. [It's already patched / I've applied the update / It needs an upgrade, which I can do this week for (price)]. No action is needed from you unless I say otherwise. I'll confirm when it's done.
Short, specific, no scare words. Owners remember who told them first and calmly.
6. What this week means for your pipeline
Every small business with an old PHP site has the same problem this week, and many have no one to call. If you sell care plans, a clear "here's what we check every month" page plus this kind of note is about as good a reason to talk as you'll get all year.
The hard part is the list of businesses to talk to. You can build it by hand: pick one city and one trade, search Google Maps, open each listing's site, and note which ones look abandoned (old copyright year, no HTTPS, broken mobile layout). Plan on about an hour per 25 businesses if you do it carefully.
Disclosure: we're The Prospect Signal Team. We sell researched lists of local businesses for web designers and agencies, starting at 250 researched prospects for $59 (500 for $99, 1,000 for $179). Everything above works without us.
Top comments (0)