PHP2Shell for Contractors and Home Service Businesses

As of 23 October 2026, the PHP2Shell flaws are fixed, exploitation attempts against websites are widely reported, and no public source has documented a confirmed successful compromise. PHP2Shell is the name for two critical flaws in PHP, CVE-2026-109618 and CVE-2026-109619, fixed by the PHP project on 21 October 2026. PHP runs on the server behind most WordPress sites, which is how a large share of roofers, plumbers, HVAC companies, remodelers, landscapers and cleaning services get their leads online.

The direct answer for a contractor: get your host or web company to confirm in writing that every site you own, including old service-area and ad landing pages, runs a fixed PHP build and that PHP was restarted. Then make sure your quote form still delivers leads to the right inbox, with photo uploads working. Your lead flow is the thing most at risk, both from an attack and from a rushed fix.

If you need the general background first, see PHP2Shell for small business owners. This page covers what is different for home service companies.

How a Typical Contractor Website Is Set Up

Most home service sites look simple from the outside and are more complicated underneath. A typical setup has:

• A WordPress site built by a marketing agency or freelancer, often with a page builder and a form plugin.
• A quote or estimate form that emails the office, sometimes with photo uploads.
• Service-area or city pages, sometimes on the main site and sometimes on extra domains.
• Landing pages for paid ads, occasionally on a separate host the ad agency controls.
• Links or embeds for scheduling, reviews, call tracking and financing.
• A payment link or invoice page from a payment processor.

For PHP2Shell, the question for each piece is the same: does it run PHP on a server, and who updates that server? A WordPress site on shared hosting runs PHP, and the host patches it. A booking or field service tool hosted by its vendor runs on that vendor's servers, so the vendor handles it. Ask them if you're unsure. A landing page builder hosted by its vendor is the vendor's job too. A WordPress landing page an agency set up on its own server is the agency's job, and you should ask.

What Is at Stake: Your Leads

For a contractor, the website is a lead machine. PHP says a successful attack on an unpatched server can mean "unauthenticated remote code execution," which lets an outsider run commands with the permissions of the web server account. On a contractor site, that account can usually change pages, plugin settings and form settings. Three outcomes matter most:

• Diverted leads. A changed form recipient, a swapped phone number or a redirect on your quote page can quietly send customers to someone else. The site still looks fine to you.
• Customer details. Quote forms collect names, home addresses, phone numbers and photos of the inside of people's homes. Stored entries and uploads sit on the server.
• Search visibility. Hacked sites are often used to host spam pages, which can take a long time to clean out of search results. If that happens, our guide to recovering rankings after a hack explains the cleanup.

Verizon's 2026 Data Breach Investigations Report shows the construction industry is a real target. Its construction row lists 843 incidents, 828 with confirmed data disclosure, with System Intrusion, Social Engineering and Basic Web Application Attacks making up "95% of breaches." Credentials were among the data compromised in 34% of those breaches. Verizon's data runs from October 2024 to November 2025, so it predates PHP2Shell. It shows contractors are targeted, not that PHP2Shell has hit any.

What to Do This Week

1. Pull the full list of domains. Log in to your domain registrar and list every domain, including ones bought for cities, ads or old company names. Note which ones still show a website.
2. Ask each host or vendor in writing. Name both CVE numbers and ask which PHP build serves each site and whether PHP was restarted. Use our copy-and-paste message for your web host.
3. Check the answer is specific. A good reply names a version, a build date or a changelog entry. Patched builds can keep an older-looking version number, so a number alone proves nothing either way.
4. Test your quote form end to end. Submit a test request with a photo from a phone. Confirm it arrives in the right inbox and that the attachment opens.
5. Check the form settings themselves. In your form plugin, confirm the notification email addresses, any redirect after submission and the phone numbers on your contact and quote pages.
6. Look for signs of trouble from 17 October. Unknown admin users, new plugins and pages you didn't create are the main warning signs. Was my site hacked through PHP2Shell? lists more.
7. Remove old logins. Former employees, past agencies and old subcontractors should not still have admin access to your site, host or registrar.

Photo Uploads and the Temporary Settings

This is the part most specific to home services. PHP published temporary settings for servers that can't be updated right away. One of them limits how much data a single form submission can send. PHP's wording: "For applications that don't require file uploads, set post_max_size = 8M. If file uploads are necessary, set post_max_size = 32M."

Several photos from a modern phone can add up quickly. If your host or developer applies these limits, a homeowner sending pictures of hail damage or a burst pipe may hit an error and give up. Fastly's advice applies directly: "Test against any workflow that accepts file uploads or large form submissions." If uploads fail, ask whoever made the change to adjust it rather than turning off uploads on your form.

Another setting turns off a PHP feature called session upload progress. Fastly says that change only affects apps that show progress bars "using PHP's built-in session mechanism," and that most upload progress bars use JavaScript instead. PHP advised on 23 October 2026 to keep it off until its next regular release. So it is unlikely to affect your quote form, but test anyway.

These settings reduce exposure. They do not fix the flaw. PHP says they "do not make an installation safe," and only the PHP update does. Our guide to PHP2Shell interim mitigations explains each one for whoever manages your server.

If You Have to Take the Site Down

CISA advises organizations that can't update right away, or that run PHP 8.1 or older, to "take PHP-based systems offline until they can be patched or updated." For a contractor, a dark website during storm season or a heat wave costs real calls. A few ways to soften it:

• Ask the host for a simple maintenance page that shows your phone number and service area. Beazley Security advises a maintenance response or network restriction "rather than disabling the PHP handler, which can expose application source code and credentials."
• Make sure your Google Business Profile and other listings show a working phone number, so calls still reach you.
• Pause paid ads that point to the affected site, so you aren't paying for clicks to a page that is down.
• Set a date to move off old PHP. Running PHP 8.1 or older is what puts a site in CISA's take-it-offline group. If your site runs WordPress, see what PHP2Shell means for WordPress sites.

Rules That Can Apply to a Home Service Business

Most contractors aren't covered by an industry security rule the way clinics and financial firms are. Three things still reach many of them. This is general information, not legal advice.

• Card payments. If you take cards, PCI DSS applies through your processor. Taking payments through your processor's hosted page or payment link keeps card entry off your own server. Our PCI DSS 4.0 website guide explains what still applies to the page that links to checkout.
• In-house financing. The FTC Safeguards Rule covers "financial institutions" under FTC jurisdiction, which is wider than banks. Its own examples include "A retailer that extends credit by issuing its own credit card directly to consumers." If you extend credit to customers yourself rather than referring them to a lender, ask counsel whether the rule reaches you.
• State breach laws. According to the National Conference of State Legislatures, every state has a breach notification law. The summary was last updated in January 2022, so check your state's current statute.

For a wider security baseline for trade businesses, see website security for service businesses.

Contractor Checklist

Conclusion

For a home service business, PHP2Shell comes down to two things: a written confirmation that every site you own runs fixed PHP, and proof that your leads still reach you. List every domain, ask each host, test the quote form with real photos and check where form messages go. If an old landing page sits on a server nobody manages, or uploads break after a change, our emergency PHP patching service can confirm the fix without taking your lead flow down. Every PHP2Shell guide is in our PHP2Shell Resource Center.

Frequently Asked Questions