VALUE PHP2Shell · disclosed Oct 21, 2026
Is your website exposed? I'll check it for you.
A serious flaw in PHP, the engine behind most websites and every WordPress site, lets a stranger take over a web server without a password. Leave your website below and I'll check it, plus run a full security check-up and send you a plain-English report. Free.
What happened, in plain English
- The flaw: two bugs in PHP (CVE-2026-109618 and CVE-2026-109619, rated 9.2 out of 10). One crafted web request lets an attacker run their own commands on the server, no login needed.
- What that means: they could change your site, steal customer info, or use your server to attack others.
- Who it hits: sites running on PHP, which includes WordPress. Wix, Squarespace and Shopify sites are patched by the platform.
- Is it being used? Security firms report attacks started within days, and attack code is public.
- The fix: your host or web person updates PHP (8.5.12, 8.4.27, 8.3.36 or 8.2.35). Older PHP 8.1 and below needs an upgrade.
On the house
Want me to check yours?
I'll check your site for PHP2Shell and run a full security check-up, then email you a plain-English report. If anything needs fixing, the report includes a quote so you know what it would take. No pressure, no follow-up calls.