PHP2Shell for Small Business Owners: What to Do This Week

As of 23 October 2026, the PHP project has fixed PHP2Shell, attackers are widely reported to be trying it against websites, and no public source has documented a confirmed successful break-in. The flaws are not on CISA's Known Exploited Vulnerabilities list as of that date, but that status can change at any time. PHP2Shell is the name for two critical flaws in PHP, CVE-2026-109618 and CVE-2026-109619, fixed on 21 October 2026. PHP is the software on the web server behind most WordPress sites and many other small business websites.

For most small business owners, this week's job is not technical. Find out whether your website runs on PHP. Find out who is responsible for updating it. Then get that person or company to confirm in writing that your site runs a fixed build and that PHP was restarted. If you are on ordinary shared or managed hosting, your host is almost certainly doing the patching. Your job is to confirm it, not to assume it.

Below: a five-day plan, what is at stake and where to get free help. For background, see what PHP2Shell is, in plain English.

Does PHP2Shell Affect Your Website?

PHP's advisory says the risk covers "all PHP installations serving web requests." Your type of business doesn't change that. What matters is how your site is built and who runs the server. Find your setup below.

Many small businesses have more than one site. Old landing pages, a booking tool, webmail and a past campaign microsite can each run PHP. CISA's 21 October alert warns that "PHP is often a component of other software and prevalence may not be directly observable."

What Is at Stake for a Small Business

If an attack works on an unpatched server, PHP says the result can be "unauthenticated remote code execution." In plain terms, someone who never logs in can run their own commands with the permissions of the web server account. For a small business, that usually puts three things at risk:

• Your customers' information. Contact form entries, quote requests, order details and anything else the site stores. Wiz, one of the research teams, says leaked server memory "may contain passwords, authentication tokens, API keys and certificates belonging to other requests or the server itself."
• Your connected accounts. Sites often hold keys to email, payment and booking tools. If those leak, the problem spreads past the website.
• Your reputation and traffic. A compromised site can host hidden pages or send visitors elsewhere.

The data gives a sense of scale, with caveats. Verizon's 2026 Data Breach Investigations Report covers incidents from October 2024 to November 2025. In its small and midsize business section, "Exploitation of vulnerabilities (26%)" leads the initial access vectors, and third parties were involved in 55% of breaches. Verizon's separate 2026 Breach Impact Study, based on about 70,000 cyber insurance claims, puts the median impact for businesses under $25 million in revenue at "a modest $38,000." In the worst 2.5% of cases, it was over 7% of revenue. Those are insured-claim medians, not a PHP2Shell price, but they show why a written answer from your host is worth an afternoon.

The Center for Internet Security's MS-ISAC advisory on these flaws rates the risk "MEDIUM" for small business entities and "HIGH" for large and medium ones. Medium is still a reason to act this week.

Your Plan for This Week, Day by Day

None of this needs a developer unless you manage your own server.

1. Day 1: List everything. Write down every domain you own, who hosts it, who built it and who has logins. Include landing pages, booking tools and old campaign sites. Registrar and hosting invoices are the fastest way to find them.
2. Day 2: Ask your host in writing. Open a support ticket that names both CVE numbers and lists every domain. Ask which PHP build serves each site, whether it includes the fix and whether PHP was restarted. Our copy-and-paste message for your web host has the exact wording.
3. Day 3: Check the answer. A useful reply names a version, a build date or a changelog entry. Some shared hosts, such as GoDaddy and Hostinger, tell customers to look for a build date of 21 October 2026 or later, because patched builds can keep an older-looking version number. How to check your PHP version shows where to look. If you are on PHP 8.1 or older, ask what the host installed and when you can move to 8.3 or newer.
4. Day 4: Look for signs of trouble. Starting from 17 October, look for admin users you don't recognize, new plugins or files, pages you didn't create and changes to where your contact forms send their messages. Was my site hacked through PHP2Shell? lists what investigators check.
5. Day 5: Close the doors that stay open. Turn on two-factor sign-in for your host, registrar, website admin and email accounts. Remove old staff and vendor logins. Confirm you have a recent backup stored away from the server, and that someone knows how to restore it. Our backup and recovery guide explains what a usable backup looks like.

If your host says the server is yours to manage, which is common on a VPS, Day 2 becomes "get it patched today." CISA's advice for organizations that can't update right away, or that run PHP 8.1 or earlier, is to "take PHP-based systems offline until they can be patched or updated."

If You Don't Have a Web Person Anymore

Many small business sites were built by a freelancer or agency that has since moved on. That can be fixed.

• Start with the hosting account. Whoever pays the bill can usually open a ticket. If the account is in a former vendor's name, ask the host how to move it into yours.
• Recover the domain registrar login. The registrar controls where your domain points. Lose it and you can lose the site and your email.
• Get an admin account in your own name, then remove accounts you don't recognize.
• Treat an unreachable server as unpatched. If nobody can log in to the server your site runs on, assume it has not been updated until someone proves otherwise.

Our guide to access control and two-factor sign-in explains how to take back ownership of your accounts without breaking the site.

What Not to Do

• Don't treat a WordPress or plugin update as the fix. WordPress.org says "No WordPress update is required or planned for these issues."
• Don't judge by the version number. Linux vendors often patch the version they already ship. AlmaLinux puts it plainly: "Don't rely on php -v: our fixes are backported, so the upstream PHP version number doesn't change."
• Don't download "test" tools from GitHub. Bitdefender says some claimed exploits are pranks: "Treat every unofficial PoC as untrusted code."
• Don't rely on a plugin or a .user.ini file to change PHP settings. PHP's own temporary guidance says "Do not rely on ini_set() or FPM .user.ini" for its main setting. They only reduce exposure anyway.
• Don't switch PHP off to take the site down. Beazley Security advises a maintenance page or network restriction "rather than disabling the PHP handler, which can expose application source code and credentials."

Free Help, and Where to Report

CISA's small and medium business page says CISA "offers free information and tools to help small businesses protect their people, customers, intellectual property, and other sensitive data." The SBA's cybersecurity guide notes that "Small businesses in particular may lack the means to protect their digital systems".

If you find evidence of an attack, CISA asks organizations to report cyber incidents 24/7 to report@cisa.gov or 1-844-Say-CISA. The FBI's Internet Crime Complaint Center (IC3) takes reports of cyber-enabled crime.

If customer information was taken, you may have to notify people. According to the National Conference of State Legislatures, all 50 states, the District of Columbia, Guam, Puerto Rico and the Virgin Islands have breach notification laws. That summary was last updated in January 2022, so check your own state's current statute with your attorney. This is general information, not legal advice. Businesses that take card payments, handle health information or offer financial services carry extra rules, covered in website security for service businesses.

Your One-Page Checklist

Conclusion

For most small businesses the PHP2Shell fix is in someone else's hands, and your part is to make them prove it. List your sites, ask your host in writing, check the build and the restart, look back to 17 October, then lock down your accounts and backups. If your site runs on a server nobody is managing, or your host's answer doesn't add up, our emergency PHP patching service can confirm the fix and check for signs of compromise. Every PHP2Shell guide is in our PHP2Shell Resource Center.

Frequently Asked Questions