PHP2Shell: What Central Coast Business Owners Need to Know

The short version

• What happened: Two critical security holes were found in PHP, the software most websites run on. Attackers could use them to take over a site without a password.

• Who's affected: WordPress sites, sites built from PHP templates and themes, and anything else running on PHP that hasn't been updated.

• What to do: Ask your hosting company to confirm the fix is installed on your server. Updating WordPress alone doesn't fix it.

If you run a business website anywhere on the Central Coast, from Paso Robles to San Luis Obispo to Santa Barbara, this week was a big one, even if you never heard about it. On October 20, details leaked about two serious security holes in PHP. Think of PHP as the engine under the hood of most websites: you never see it, but the site can't run without it. Fixes came out the next day, and web developers everywhere spent the week patching servers (installing the security fix).

You may have seen headlines calling it "PHP2Shell." Here's what happened in plain English, what it meant for local sites, and how to find out whether yours is safe.

What is PHP2Shell?

PHP2Shell is the nickname for two critical flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619). Both are rated 9.2 out of 10 for severity. They let an attacker run their own code on a web server without logging in, which means they could take over the site and the server behind it.

A few things made this one unusual:

• It's in the engine, not an add-on. Most website hacks go through a bad plugin or a weak password. This one is in PHP, the language underneath the whole site.

• It goes back more than a decade. Every PHP version from 5.4 through 8.5 was affected.

• The details leaked early. Information got out before the fix was ready. Security researchers saw attack attempts even before the official disclosure.

• It's everywhere. PHP runs roughly 70% of all websites. That includes every WordPress site and countless sites built from off-the-shelf PHP themes and templates.

The PHP team released fixed versions (8.5.12, 8.4.27, 8.3.36 and 8.2.35) on October 21. CISA, the federal cybersecurity agency, urged everyone to update immediately.

Why WordPress and template sites were in the line of fire

WordPress is built on PHP. So are the off-the-shelf themes and templates sold for it, and other platforms like Joomla and Drupal. The researchers who found these flaws showed working attacks against WordPress, Drupal and Joomla with no login required.

Here's the part most business owners don't know: updating WordPress or your template doesn't fix this. Neither does a security plugin. The fix has to happen on the server, by updating PHP itself. That's your hosting company's job, or your web developer's, depending on how your site is set up.

That's also why it caused so much confusion. A lot of owners clicked "update" in their WordPress dashboard, saw everything was current, and assumed they were fine.

What it looked like here on the Central Coast

For my clients, it was a quiet week. Their sites stayed up, and none of them had to do a thing.

Other local businesses weren't so lucky. I know a web company in our area that builds only on WordPress. They had a crazy day: calling everyone in, taking client sites offline, and patching holes as fast as they could. That's not a knock on them. When the problem is in the foundation every one of your sites sits on, that's what responsible cleanup looks like.

If your site was offline for part of this week, this may be why.

Custom vs. template: why it mattered this week

Template sites are popular because they're quick to set up. But you're inheriting a lot of someone else's code: the platform, a theme, a stack of plugins, and PHP underneath it all. Every one of those layers has to be kept up to date. When one breaks, every site built on it is in trouble at the same time.

I build custom sites, and I build them lean. Each site gets only what it actually needs, with as little code running on the server as possible. That leaves far less for an attacker to aim at. My hosting provider patched its servers as soon as the fix came out.

Here's something most business owners don't realize: when you build on a popular template, you're joining a very big crowd, and hackers know it. Instead of going after one business at a time, they run automated programs that scan the internet around the clock, testing every WordPress login page and every popular theme and plugin for a known weakness. One hole in a popular plugin can open the door to thousands of sites at once, and attacks often start within hours of a flaw going public.

It's nothing personal. Your bakery or law office isn't being singled out. It's just standing in the biggest line.

A custom site doesn't come with that crowd. There's no shared theme or plugin stack for those programs to test, so there are far fewer doors to try. No website is "unhackable," and I won't pretend otherwise. But fewer moving parts means fewer things that can go wrong on a random Tuesday, and fewer emergency calls for you.

How to check your site today

If your site runs on WordPress, or you're not sure what it runs on, take these steps this week:

When I took on the digital strategy for Avila Beach, the goal wasn't a prettier website. It was to establish the town as a destination. I built a large custom web platform, supported it with original on-location photography, and backed it with targeted marketing. Over 90% of local businesses signed on, and the site now draws around 40,000 monthly visitors and 200,000 monthly pageviews, with over 100,000 in weekly social reach.

Most businesses don't need something that big. But the principle is the same at any size: when the structure, the visuals, and the marketing work together, results follow.

Frequently Asked Questions