PHP2Shell
In late October 2026, two serious security flaws were found in PHP, the software behind roughly 70% of websites. That includes most sites built on WordPress, Drupal and Statamic (what I tend to use).
The flaws, now known as PHP2Shell, could let an attacker take control of a web server without needing a password. Details leaked online a day before the fix was ready, and attacks were reported soon after. Around the world, businesses and even government websites went offline as a precaution.
How we responded
We heard the morning the fix was due. Before it arrived, we had checked every server we look after, written to every affected client, and put a temporary safeguard in place.
When the fix was released, everyone on the internet was trying to update at the same moment, and the usual download servers and management tools struggled. We switched to another trusted source and had every supported site updated the same afternoon. Most sites carried on as normal with no downtime. A few older sites ran on software too old to ever be fixed, so we took them offline rather than leave them at risk, and have since given them simpler, safer replacements. We kept a written record of what we did and why at each step.
Why it matters for a small business
You probably don’t think of PHP as something your business uses. But if your website runs on it, you rely on it, just as you rely on whoever built and looks after your site. You can hand the work to someone else, but the responsibility for your website stays with you. A few things worth knowing:
Know who looks after your website, and what it runs on. If something like this happened tomorrow, who would act, and how quickly?
Old software is the real risk. Sites on current, supported software got a routine update. Sites left untouched for years had nothing to update to.
Taking a site offline for a day is not a failure. It’s often the sensible choice, and far cheaper than cleaning up after a break-in.
If personal data could be affected, the clock starts. In the UK, a personal data breach that puts people at risk usually has to be reported to the ICO within 72 hours. Your insurer, your customers and your contracts may also have something to say.
This is unlikely to be the last incident like this. The flaws were found with the help of AI, and the same tools that help security researchers can help attackers too. Bugs will be found faster from here on. The best protection isn’t a clever trick. It’s software that’s kept up to date and someone who knows what to do when it matters.