Is WordPress Safe After PHP2Shell?

What Is PHP2Shell?

PHP is the programming language that powers a large share of the web, including WordPress, Joomla, Drupal and Magento. PHP2Shell is the name given to two linked flaws in PHP itself, not in any one website or plugin.

Under certain conditions, the flaws can let an attacker run commands on a web server without logging in. The PHP security team rates both flaws 9.2 out of 10 for severity. According to the NCSC, every version of PHP is affected.

PHP released fixed versions on 21 October 2026:

• PHP 8.5: Fixed in 8.5.12
• PHP 8.4: Fixed in 8.4.27
• PHP 8.3: Fixed in 8.3.36
• PHP 8.2: Fixed in 8.2.35
• PHP 8.1, 8.0 and 7.4: These are past end of life. PHP published only minimal source patches for them, and some hosts and support vendors provide fixed builds, so ask your provider

PHP says a working exploit has been demonstrated, and it considers the risk highest for sites running PHP as an Apache module (mod_php). It is sensible to treat this as urgent.

What the NCSC Is Asking Businesses to Do

The NCSC's advice is aimed at anyone who runs systems using PHP. In short, it recommends that you:

• Find your PHP systems: Identify everything running PHP, starting with anything that faces the internet
• Update: Move to the latest version of PHP and keep watching for further updates
• Use temporary mitigations: Apply them if you cannot update straight away, bearing in mind PHP's warning that they do not make a site safe and updating is the only safe fix
• Consider going offline: Take a system offline if you cannot apply the mitigations, or they would take too long
• Check for compromise: Look for signs of an attack or backdoors before you update or apply mitigations

Most small businesses do not manage their own servers, so in practice this means making sure your web host or agency has done these things for you.

Is My Website Affected?

If your website runs on PHP, it is in scope. That includes every WordPress site, as well as many sites built on other content management systems or older custom code.

Sites on hosted platforms such as Wix, Squarespace or Shopify run on infrastructure the platform manages. If you use one of these, check the platform's status or security page rather than trying to update anything yourself.

How to Check If Your Website Runs on PHP

There are three quick ways to find out:

• WordPress dashboard: Go to Tools, then Site Health, then Info, and open the Server section to see your PHP version
• Hosting control panel: Most hosting panels, such as cPanel or Plesk, show the PHP version for each site
• Ask your provider: Your web host or agency can tell you in one email

If your version number is below the fixed versions listed above, your site needs updating.

Does Updating WordPress Fix It?

No. This is one of the most common misunderstandings. The flaws sit in PHP, the software running on the server underneath WordPress. Updating WordPress, your theme or your plugins does not change the PHP version.

Keeping WordPress up to date is still good practice. However, for PHP2Shell, the fix has to come from whoever manages your hosting.

Is WordPress Still Safe to Use?

Yes, a well-maintained WordPress site on a well-run host is still a reasonable choice. PHP2Shell is not a WordPress bug, and the fix is already available.

The real question is upkeep. A WordPress site depends on several layers that all need regular updates:

• The server: The operating system and PHP version
• WordPress core: The main software
• Plugins and themes: Often from many different developers

Each layer is something that can fall behind. Many small business sites run on old PHP versions because nobody is responsible for moving them on. Those are the sites most exposed this week, because end-of-life versions only received minimal source patches from PHP. You can see which versions are still supported on the official PHP supported versions page.

If your site is several years old, built on a version nobody wants to touch, or slow and hard to update, it may be time to look at the bigger picture. Our guide to the seven signs your website needs a redesign is a good place to start.

Why Static Websites Avoid This Kind of Issue

A traditional WordPress site builds each page on the server every time someone visits. That means PHP is running and reachable from the internet all the time.

A static website works differently. Every page is built in advance and published as ready-made files, which are then served from a global content delivery network. When someone visits, no PHP code runs, so a flaw like PHP2Shell has nothing to attack.

Modern static sites are not basic or limited. Frameworks such as Next.js let you build fast, fully designed websites with blogs, landing pages and enquiry forms. They also bring other benefits:

• Speed: Pre-built pages load quickly, which helps both visitors and search rankings
• Less maintenance: There is no server software or plugin stack to keep patching
• Resilience: Content delivery networks handle traffic spikes well

No website is free of all risk. Forms, logins and third-party tools still need care, and good basic security still matters. The NCSC Small Business Guide covers the essentials. However, a static site removes a whole category of server-side risk, including the one behind this week's alert.

This is why Digital Five builds new websites in Next.js and publishes them as static files.

Fun Fact: PHP Started as a Personal Project

PHP began in 1994 as a small set of tools its creator called Personal Home Page Tools, written to track visits to his online CV. Three decades later, it is the most used server-side language on the web, according to W3Techs. That reach is exactly why a single flaw in PHP makes national headlines.

Patch Now, Then Plan Ahead

Your first job this week is simple. Find out which PHP version your site runs on, and make sure your provider has updated or patched it.

Once that is done, it is worth asking whether you want to keep managing a PHP site long term. If the answer is no, moving to a modern static site can be quicker and more affordable than most people expect.

Our Rapid Build website is a fixed-price, four to five page site with SEO basics and an enquiry form, live in two weeks. For larger sites, our Growth Site gives you a custom design with as many pages as you need. We carry across your existing pages, titles and redirects so you keep the search visibility you have built up, as explained in our guide to technical SEO.

From now until the end of November, every new website we build in Next.js is 20% off, so moving away from PHP costs less this autumn.

Not sure where your website stands? Claim your free check and we will tell you what your site runs on and what we would recommend.