Critical PHP Vulnerability: What Philadelphia Business Owners Need to Know About Their Website
Short answer: Two critical PHP flaws can let attackers run code on a website’s server without logging in, putting WordPress and other PHP-based sites at risk. Philadelphia-area business owners should ask their hosting provider today to confirm PHP has been updated to 8.2.35, 8.3.36, 8.4.27 or 8.5.12. Updating WordPress alone won’t fix it.
If you own a business in Philadelphia, your website is working for you around the clock. But this week, a security flaw in PHP, the programming language behind a huge share of the web, put a lot of those websites at risk. The good news? A fix is available. The not-so-good news? For most small businesses, it won’t install itself. Here’s what happened, what it means for your business and what to do about it today.
At POP THE PIXEL, we’ve spent more than 15 years designing, optimizing and supporting websites for Philadelphia-area businesses, so we put together this plain-English guide for local business owners.
What Is the PHP Vulnerability?
On October 21, 2026, the PHP project released emergency security updates for two critical flaws, tracked as CVE-2026-109618 and CVE-2026-109619 (nicknamed “PHP2Shell” by researchers). Both are rated 9.2 out of 10 for severity, and both can allow an attacker to run malicious code on a web server without needing a username or password.
In plain English: a hacker doesn’t have to break into your website’s login page. They can go straight to the engine running underneath it.
The PHP project has released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Security researchers have also reported attack attempts in the wild, so this is not one to put on next month’s to-do list.
Is My Website at Risk From the PHP Vulnerability?
PHP powers a large portion of the internet, including popular content management systems like WordPress, Drupal, Joomla and Magento. So whether you run a yoga studio in Flourtown, a therapy office in Center City, a PR firm on the Main Line, or a contracting company in Bucks County, there’s a good chance your website runs on PHP.
Pro Tip: Not sure what your site is built on? If you log in to a dashboard with “wp-admin” in the web address, you’re on WordPress, which runs on PHP. If you’re not sure, ask whoever built or hosts your website.
Websites on fully hosted platforms like Shopify, Wix and Squarespace are managed on the platform’s own servers, so patching isn’t on your plate. If your site is a custom build, a WordPress site or an older website that’s been around for years, keep reading.
Will Updating WordPress Fix the PHP Vulnerability?
Here’s the part many “patch now” headlines skip. This flaw lives in PHP itself, which sits underneath WordPress, its themes and its plugins. Clicking “Update” in your WordPress dashboard will not fix it.
The patched version of PHP has to be installed on the server by whoever manages it, usually your web hosting company. After that, the server needs to be restarted so the new version actually loads. If you’re on shared hosting, the fix may be as simple (and as important) as a support request.
What Should Philadelphia Business Owners Do Today to Protect Their Website?
1. Find Out Who Hosts Your Website
Check your invoices or ask your web designer. Your host is the one who controls the PHP version your site runs on.
2. Ask Your Hosting Provider to Confirm the Patch
Send a quick message asking whether they’ve applied the PHP security updates for CVE-2026-109618 and CVE-2026-109619, and whether your site is running a fixed version.
Pro Tip: Many hosts are working through this right now, so don’t assume silence means it’s done. Get the confirmation in writing.
3. Check Your PHP Version
In most WordPress dashboards, you can find this under Tools > Site Health > Info > Server. If your site is on PHP 8.1 or older, it’s no longer supported by the PHP project and needs a bigger conversation (more on that below).
4. Keep an Eye Out for Anything Unusual
Watch for unfamiliar admin users, strange files, unexpected redirects, sudden slowdowns or warning messages from Google. These can be signs that something got in.
5. Make Sure You Have a Recent Backup
If something does go wrong, a clean backup is the fastest way back to normal. Confirm your host or your web designer is keeping one.
What If My Website Runs an Old Version of PHP?
This is more common than you’d think. According to WordPress.org statistics, roughly one in three WordPress websites runs a version of PHP that’s no longer supported. Older versions like PHP 7.4 and 8.0 don’t get regular security updates, which makes them an easy target.
If that’s you, the fix usually involves moving to a supported PHP version (and making sure your theme and plugins are compatible with it). Sometimes that’s a quick change. Other times, it’s a sign your website is overdue for an update altogether.
When it’s the latter, a WordPress web design update from a Philadelphia web design team can move you to a modern, secure setup that’s faster, easier to manage and better for search.
Pro Tip: Even supported versions have an expiration date. PHP 8.2, for example, is scheduled to lose security support at the end of 2026, so ask your web designer about upgrading to PHP 8.3 or newer.
How Does a Website Security Problem Affect My Local SEO and Google Rankings?
A hacked website isn’t just a tech headache. It can hurt the very things you’ve worked hard to build:
- Customer trust: Visitors who land on a hacked or redirected site rarely come back.
- Google rankings: Search engines can flag or demote compromised sites, which hurts your local SEO and your chances of showing up when Philly customers search nearby.
- Lost leads and sales: If your site is down or warning visitors away, your competitors get the call instead.
A secure, well-maintained website is one of the simplest ways to protect your online reputation and your bottom line.
Search engines and AI-powered answer tools tend to surface websites they can trust, which is why website security, fresh content and AI SEO work hand in hand to help Philadelphia customers find you.
Frequently Asked Questions About the PHP Vulnerability
What is the PHP2Shell vulnerability?
PHP2Shell is the nickname for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, that can let an attacker run code on a web server without logging in. Both are rated 9.2 out of 10 for severity, and fixes were released on October 21, 2026.
Is my WordPress website affected by the PHP vulnerability?
It can be, if your host hasn’t updated PHP yet. WordPress runs on PHP, so a WordPress site on an unpatched PHP version is exposed. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Will updating WordPress or my plugins fix it?
No. The flaw is in PHP itself, not in WordPress. Your hosting provider (or whoever manages your server) needs to install the patched PHP version and restart the server.
How do I find out which PHP version my website uses?
In most WordPress dashboards, go to Tools > Site Health > Info > Server. You can also ask your hosting provider or web designer to confirm it.
Does the PHP vulnerability affect Shopify, Wix or Squarespace websites?
Those platforms manage their own servers, so you aren’t responsible for installing the patch. Custom websites, WordPress sites and older sites on shared hosting are the ones to check first.
What should I do if my host hasn’t patched PHP yet?
Contact them today and ask for a timeline in writing. Ask whether a web application firewall can reduce risk until the patch is in place, and make sure you have a recent backup.
Can a hacked website hurt my Google rankings?
Yes. Search engines can flag or demote compromised sites, and visitors who hit warnings or redirects rarely return, which can hurt your local search visibility and your leads.
The Bottom Line for Philadelphia Business Owners
This PHP vulnerability is serious, but it’s also fixable. The most important step is to find out where your website stands and get your hosting provider or web designer to confirm it’s protected. And if this scare has you wondering whether your website is due for an upgrade, you’re not alone.
POP THE PIXEL is a Philadelphia web design, SEO and digital marketing studio with more than 15 years in business and 200+ businesses helped, recognized for Best Web Design Services by the Philadelphia Inquirer, Philly Happening and Metro Philly’s Best.
Need help figuring out whether your website is affected? Partner with us, a local web designer in Philadelphia who understands the needs of area businesses. Contact us online or call 215-850-7505, and let’s make sure your website is safe, fast and ready to help you build and grow your online presence.
Helpful resources:
- CISA: Critical Vulnerabilities in PHP Require Immediate Patching
- NSA: Critical Patches Recommended for PHP Vulnerabilities
- PHP: Official security advisory
- WordPress.org: Critical PHP security release
- CISA: Cyber Guidance for Small Businesses
Sources: PHP Security Team advisory, BleepingComputer, ITdaily and CybelAngel’s PHP2Shell analysis, which cites WordPress.org PHP usage statistics.