On October 21, the PHP project released a fix for two critical security flaws, the kind that let a stranger run their own code on your web server without logging in. The pair has been nicknamed PHP2Shell. Banks and airlines made the news. Small business websites didn’t, and they are the ones most likely to still be unpatched a month from now.
If your website runs on WordPress, it runs on PHP. Here is what happened, what to do about it today, and what we tell people who ask why a Surmado Site had nothing to update.
What happened, in plain terms
PHP is the programming language WordPress is written in. Every time someone visits a WordPress page, a PHP program runs on the server, pulls your content from a database, and assembles the page on the spot. Two bugs in that program, CVE-2026-109618 and CVE-2026-109619, let an attacker send one crafted request and run their own code on the server. No password needed. The PHP project rates both at 9.2 out of 10.
A few things worth knowing:
- This is not a WordPress bug. It affects any site built on PHP: WordPress, Drupal, Joomla, Magento, and countless custom sites. WordPress.org says no WordPress update is required or planned. The fix is in PHP itself.
- The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no fix from the PHP project. If your site is on one of those, the fix is a bigger upgrade, not a patch.
- Attackers were already trying before the news broke. Amazon’s honeypot network recorded an exploitation attempt on October 17, four days before the public disclosure, and public proof-of-concept code is now circulating.
- There is no safe workaround. The PHP project’s own words: updating is the only safe choice.
What to do today
1. Find out which PHP version your site runs. In your WordPress admin, go to Tools, then Site Health, then the Info tab, then Server. The PHP version is listed there. Most hosting control panels show it too.
2. If the version is 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer, you’re done. One caveat: some hosts apply the fix without changing the version number on screen. If your host has emailed or posted that they patched PHP2Shell, trust the notice over the number.
3. If it’s lower, check your host first. Many hosts started updating PHP and adding firewall rules as soon as the fix was out. Look for a status page, an email, or a banner in your hosting account. If there’s nothing, open a ticket and ask directly: “Has PHP been patched for CVE-2026-109618 and CVE-2026-109619 on my account?”
4. If you’re on PHP 8.1 or older, you have a project, not a patch. Your site needs to move to a supported branch, and a move like that can break an old theme or plugin. WordPress.org’s advice for people who manage their own server on an old version is to consider taking the site offline while you upgrade. If someone else manages it for you, this is the call to make today.
5. Don’t count on a security plugin to cover this. A WordPress plugin runs inside PHP, so it can’t fix a flaw in PHP itself. The attack can trigger before any WordPress code runs at all. A firewall at your host or in front of your site can block known attack patterns, which is what many hosts did first.
6. Put a note in your calendar for December. PHP 8.2 reaches end of life on December 31, 2026. After that it gets no security fixes either, and the next PHP2Shell will land on it with no patch coming.
Why this keeps happening
None of the above is a knock on WordPress. It is good software, and it runs a huge share of the small business web for good reasons. But it is worth understanding what you signed up for when you bought a WordPress site, because nobody explains it at the time.
A WordPress site is a program that runs every time someone visits. That is the source of its flexibility: a plugin can do almost anything, because there is a program sitting there, ready to do it. It is also why the patch list never reaches zero. PHP, WordPress core, the theme, and every plugin are all running code, and every one of them needs updates forever. Website maintenance is mostly the job of keeping that list current, and the sites that fall behind are the ones that end up with spam links quietly injected into them.
PHP2Shell is unusual only in how deep it sits. Most years the scary bug is in a plugin. This one is in the language underneath everything.
What “static” means, and why Surmado Sites are built that way
Surmado Sites take the opposite approach. We don’t run your website as a program. We build the finished pages ahead of time, whenever something on the site changes, and serve those finished files to visitors. When someone opens your homepage, there is no PHP running, no database being queried, no plugin code executing. It is a file, delivered from a network of servers close to the visitor.
That is what “static” means. It isn’t a design choice you can see. It is a decision about how much running code sits between the public internet and your business.
Here is the honest version of what that does and doesn’t buy you:
- A flaw like PHP2Shell has nothing to reach. There is no PHP on your site to exploit. On October 21, the number of things our customers had to do about this was zero. Not because we patched fast. Because there was nothing to patch.
- The patch list still exists. It’s just ours, and it’s short. A Surmado Site does take input in two places: the contact form and, on sites that have one, the chat window. Those run as separate services that we maintain and update, away from your pages. The domain and the certificate still need looking after, and that’s part of the membership. What changes is the amount of code exposed to the public and whose job it is.
- Nothing is unhackable. Anyone who tells you otherwise is selling something. A static site shrinks the target to the point where most of what attacks WordPress sites has nothing to attack, which is a different claim, and the one we’re comfortable making.
Who should stay on WordPress
Static pages can’t do everything, and we’d rather say so than have you find out later.
- You sell online. A store has to calculate carts, take payments, and check inventory for each customer. That needs a program. Surmado Sites doesn’t do online stores; if you sell through a shop platform, we link to it from your site.
- Your business runs on a plugin. A booking engine, a members area, a customer portal. If a visitor logs in and the site computes something just for them, WordPress or something like it is the right tool, and the maintenance that comes with it is the price of that capability.
- You’re on a managed WordPress host that patched this before you’d heard about it, and you’re happy paying for that. That is exactly what managed hosting is for. If you got the email on October 21 and had nothing to do, your setup is working.
For everyone else, which is most small businesses, the site is a set of pages: what you do, where you are, when you’re open, how to get in touch, and a blog. For that site, WordPress’s flexibility is capacity you pay for in maintenance you never use. And on days like October 21, it is the reason you have homework.
Common questions
My site isn’t WordPress. Does this affect me?
If it’s built on PHP, yes. Drupal, Joomla, Magento, and most custom-built sites from a web agency run PHP. If your site lives on a hosted builder like Wix, Squarespace or Shopify, the company runs the servers, and there’s nothing for you to install. If you don’t know, ask whoever built it.
Can Surmado move my WordPress site?
Yes. Send us the address and we rebuild it free: same content, photos, page structure and URLs, with redirects and metadata carried over and the old code left behind. A human checks it against a 42-point QA list, you get a preview, and you pay nothing unless you approve it. Most rebuilds are ready within 24 hours.
Do I lose my blog?
No. Blogs are standard on a Surmado Site, and on the Pro+ plan we write weekly posts for you.
Will a static site hurt my search ranking?
The opposite, usually. Pages built ahead of time load faster than pages assembled per visit, and speed is a ranking factor. Everything search engines and AI assistants need to read your site is in the finished files.
The bottom line
If you own a WordPress site, check the PHP version today, confirm your host has patched, and put December 31 on the calendar. That’s the whole job, and it’s worth an hour.
If you’d rather this be the last time you have homework because of a bug in a language you’ve never heard of, see what a Surmado Site includes and the current pricing. The rebuild is free, and you only pay if you like it.