If your business runs on WordPress, WooCommerce or another PHP-based platform, the PHP2Shell security alert deserves your attention. The next steps are straightforward: have your hosting provider or developer update PHP, then check that your website still works as expected.
Here are the answers to the questions business owners are asking.
01What is PHP2Shell?
PHP2Shell is the name given to two critical security vulnerabilities in PHP, the software that runs behind many websites and online stores.
These vulnerabilities can allow an attacker to run unauthorized code on an affected server without logging in. PHP released security updates on October 21, 2026. [1]
For business owners, the immediate priority is to confirm that your website’s hosting environment has received the update.
02Is my WordPress or WooCommerce website affected?
Your website may be affected if it runs on an unpatched version of PHP. This includes WordPress, WooCommerce, Magento, Drupal, Joomla and custom PHP applications. [2]
Using one of these platforms does not mean your website has been hacked. It means your hosting provider or developer needs to verify its patch status.
Remember to include older websites, campaign landing pages and staging sites—not just your main domain.
03Does updating WordPress or my plugins fix PHP2Shell?
No. PHP itself needs to be updated on the server. Updating WordPress, Elementor, themes or plugins does not replace that step.
PHP runs underneath your website. Some attack paths can trigger before the application’s own code starts, so a security plugin should not be treated as a substitute for the server update. [3]
Keep your website software current, but ask specifically whether the PHP security update has been applied.
04Which PHP versions contain the fix?
The security releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Your provider should install the appropriate fixed release, or a later supported release containing the fixes. [1]
Some hosting and operating-system vendors apply the same fixes to older packages. In those cases, the PHP version displayed in your dashboard may still look older. Ask your provider to confirm the exact patched package rather than relying on the version number alone. [2]
05Who should update PHP for my website?
Start with your hosting provider or the developer who maintains your site. Ask them to confirm whether the fix is already installed and handle the update if it is still needed.
You can send this message:
Please confirm that our website’s PHP installation is patched against PHP2Shell. If an update is needed, please back up the site, apply the appropriate update and check that the website works correctly afterward.
06Can a PHP update break Elementor or WordPress plugins?
It can cause compatibility issues, especially when moving to a newer PHP branch while using older plugins, themes or custom code. That is why checking your site after the update matters. [5]
A page may look different, an Elementor widget may stop working, or a form may fail to submit. These are examples of issues to check for, not problems every update will cause.
Ask your developer to choose a patched PHP version that works with your site. If something breaks, have them resolve the compatibility issue while keeping the security fix in place.
07What should I do now?
Keep it simple: update PHP, then check your website.
- Have your host or developer update PHP. Confirm there is a recent backup before making changes.
- Check your key pages and functions. Review Elementor layouts, menus and mobile pages. Test contact forms, logins and any important plugin features. If you sell online, test the cart and checkout through your normal testing process.
- Get help with any errors. Look for blank pages, broken layouts, error messages or features that no longer work.
Do not assume the update is complete just because your homepage loads. Walk through the actions that matter to your customers, from submitting an inquiry to placing an order.
08Does being affected mean my website was hacked?
No. A vulnerable installation and a confirmed compromise are different things. Exploitability depends on the server and application environment; security research has identified conditions that affect whether public exploits work. Updating remains the recommended action. [4]
If you notice unfamiliar users, unexpected redirects or other suspicious changes, ask for a security review. A PHP update fixes the vulnerability but does not, by itself, establish whether anything happened before the update.
09Do I need to rebuild or move my website?
Yes—if your hosting provider cannot confirm that PHP is patched, this is a good time to consider moving. Whether you use Bluehost, a host with cPanel or another provider, the deciding factor is how reliably your site is maintained. Using cPanel alone does not mean your website is outdated or insecure.
For businesses doing significant B2C ecommerce, Shopify—including Shopify Plus for enterprise requirements—or a custom React storefront connected to a managed commerce platform are worth evaluating. A move can be an opportunity to improve the shopping experience, simplify integrations and reduce some of the maintenance your team handles.
It can also help prepare your business for agentic shopping, where customers use AI assistants to discover and buy products. Shopify offers Agentic Storefronts for supported AI channels, subject to eligibility and setup requirements. A custom React storefront needs the appropriate product data, commerce backend and integrations; React alone does not provide security or agentic shopping readiness. [6]
If you run WordPress, WooCommerce, Magento, Drupal, Joomla or a custom PHP application, compare the cost of migration with the ongoing cost of maintaining your current site. When substantial repairs or upgrades are already needed, that investment may be better directed toward a new platform. The effort varies with your content, product catalog, SEO requirements and integrations, so migration should be scoped before assuming it costs the same.
Address the immediate PHP issue while you evaluate the longer-term move.
Contact Intense City Media for an immediate audit, fix or migration assessment →
10Can Intense City Media help?
Yes. Contact Intense City Media for an immediate website audit or help with a fix.
Whether you need to confirm your PHP update, troubleshoot an Elementor or WordPress plugin issue, or investigate an unexpected error, we can help you identify the next step and get it addressed.
Contact Intense City Media for an immediate audit or fix →
Sources
- PHP: October 21, 2026 security advisory and releases
- Ubuntu: PHP2Shell fixes and patched vendor packages
- Sophos: PHP2Shell security advisory
- Sansec: PHP2Shell research and October 22 update
Security information reviewed October 22, 2026. Confirm the current patch status with your hosting provider.