Updated 21 October 2026. Two critical vulnerabilities in PHP, the language behind WordPress and most hospitality websites, were disclosed this week. Here is what has happened, who is affected, and what we are doing about it.
What has happened
On 20 October, details of two flaws in the PHP interpreter itself leaked online ahead of a planned coordinated disclosure. They are tracked as CVE-2026-109618 and CVE-2026-109619, and have been nicknamed “PHP2Shell”. The PHP security team has rated both Critical, 9.2 out of 10 on CVSS v4.0.
Because the flaws are in PHP rather than in any one plugin or theme, any website running a vulnerable PHP version is exposed. That includes WordPress, WooCommerce, Elementor, Laravel, Magento and Drupal sites. Security firms including Cloudflare and Patchstack reported active exploitation attempts before the patch was even released.
Why it matters
These are remote code execution flaws. If exploited, an attacker can run their own code on your web server without logging in. In practice that can mean a defaced site, stolen guest data, injected spam or malware, or your booking and loyalty journeys going offline during service.
Who is affected
PHP released emergency patches on 21 October for its supported branches: 8.2, 8.3, 8.4 and 8.5. Sites running PHP 8.1 or older will not receive a fix at all, because those versions are end of life. The only remedy for them is upgrading to a supported version.
One thing that often gets missed: PHP is not only in your website. It also runs inside hosting control panels such as cPanel and Plesk, and inside some vendor appliances and business applications. If you manage your own server, those need patching too.
Why this one is harder than usual
The details leaked before the fix existed, so site owners had less than a day to prepare and attackers knew exactly when to start looking. Once a patch is published, it also shows skilled attackers where the flaw is, and they can build an exploit by comparing old and new code. A previous PHP flaw, CVE-2024-4577, saw exploit attempts within a day of going public. And because the flaws reach back to older PHP versions that will never be fixed, anything left on PHP 8.1 or earlier stays exposed until it is upgraded or taken off the internet.
If you host with us
All of our dedicated and shared hosting environments run on cPanel with Imunify360 and CloudLinux, which add a layer of protection on top of the PHP patch itself: web application firewall rules, malware scanning and process isolation between accounts. We are applying the patched PHP releases across our estate.
If you are a managed customer on a retainer, you do not need to do anything. We are taking care of this for you and will confirm once your site is patched.
If you host elsewhere, or it has been a while
If your site has not been checked for a while, this is a good moment for a health check to make sure everything is up to date. In order:
- Find every PHP installation. Your website, but also any control panel, staging site or old microsite that is still online.
- Patch as soon as your host makes the fix available. Internet-facing systems first. Linux distribution and hosting packages can lag PHP’s own release by a few hours. On cPanel and WHM the patched PHP arrives through the normal update channel (EasyApache), so check that automatic updates are not disabled or pinned to a version.
- Restart PHP-FPM or the web server afterwards, so the patched version is actually the one running.
- Upgrade anything on PHP 8.1 or older to a supported version. If you cannot do that straight away, put it behind a web application firewall or take it offline until you can.
- Check plugins and themes are compatible with the upgrade before you flip the switch.
- Look for signs of compromise since 20 October. Patching does not remove an attacker who is already in. Check for unfamiliar files in the web root, new admin users, new cron jobs or scheduled tasks, and keep your web server and PHP logs.
A note on web application firewalls
A web application firewall sits in front of your site and blocks exploit attempts like this one before they ever reach PHP. It will not replace patching, but it buys you time when a fix is not out yet, and it catches the next one too. We are a reseller for Sucuri, one of the best firewalls available, and can set it up in front of any site, whether or not we host it. If you would like to look at that option, get in touch.
How we can help
Whether or not you host with us, we are happy to take a look. Send us your website address and we will check which PHP version it runs, whether it is patched, and what, if anything, needs doing. There is no charge for the check and no obligation.
If something does need doing, there are two ways we can cover it.
Security Sprint. A one-off audit and patch. We check your PHP version, hosting, plugins and themes, apply updates, test the site end to end and send you a written report.
Care Retainer. Ongoing monthly cover. Proactive patching when issues like this land, uptime and security monitoring, backups and a set number of support hours each month.
Not hosted with us, or no longer have a provider?
That is fine too. If your site is hosted elsewhere, is a few years old, or the people who built it are no longer around, we can move it onto our secure hosting environment using our migration tools, patch it as part of the move, and bring it up to a supported PHP version. It is often quicker than trying to patch an old server in place. Tell us where things stand and we will suggest the simplest route.
You can use the security check form, or email sales@theloyaltyco.app with your website address, and we will take it from there.