On 21 October 2026, a critical security flaw called PHP2Shell was discovered in PHP, the technology that powers most websites, including WordPress and Kirby sites. You may have heard about it, or maybe not. Here’s what it means for your website in plain English, how it went for my clients, and the 3 questions you should ask yourself today.
PHP2Shell in a nutshell
PHP2Shell is a security flaw that lets an attacker take control of a web server remotely, without a password. It sits in PHP, the invisible “engine” that runs your website, a bit like a car engine you never see but without which nothing moves.
To give you an idea of how serious it is, experts rated it 9.2 out of 10. And it wasn’t a theoretical threat. Attack attempts were spotted on the very day it was announced, and even a few days before.
The catch is that the problem doesn’t come from your website itself. You can have a perfectly up-to-date, well-built WordPress or Kirby site with very few plugins, and it’s still exposed until the server hosting it has been patched.
WordPress or Kirby, same story
WordPress and Kirby, the 2 CMSs I work with, are both written in PHP. Kirby has the advantage of running without a database, which shuts the door on a whole family of attacks. But against PHP2Shell, that changes nothing. The flaw is in PHP itself, so a Kirby site is affected exactly like a WordPress site, and it gets fixed the same way, on the server.
What’s the actual risk?
If your website’s server isn’t updated, an attacker could, in theory,
- modify or deface your website,
- hide fraudulent links or pages on it (which can hurt your Google rankings),
- steal sensitive information stored on the server, such as passwords or contact form submissions,
- use your website to send spam or attack other sites.
No need to panic though. The fix has been available since 21 October. The only question is whether someone has applied it to your website.
What I did for my clients (spoiler, nothing very technical)
I’ll be honest, I didn’t spend the night on servers. The websites I maintain are hosted with Combell and Infomaniak, 2 reliable European hosting providers. They took care of the PHP update across all their servers. My job was elsewhere.
1. Let my clients know before they started worrying
The day after the announcement, all my maintenance clients received a short email. A critical flaw has been found in PHP, I’m keeping an eye on the situation for your website, and there’s nothing you need to do. No jargon, no drama.
The result was zero panic. One client forwarded my message to his colleagues to reassure them. Others asked me a specific question, along the lines of “should we move to the very latest version of PHP?”. The answer was no. A patched version that’s still supported is enough, no need to turn everything upside down.
2. Let the hosting providers do their job
Then I simply waited for Combell and Infomaniak to roll out the fixes on their servers. Nothing more.
That may be the most useful lesson of the week. Your choice of hosting provider does a huge part of the security work. With a reliable host, a flaw like this one gets fixed without you lifting a finger. With bargain-bin hosting or a server nobody watches anymore, it’s another story.
3. Answer the unrelated questions too
My favourite story of the week. One client replied “is this related to the fact that the WordPress interface has changed?”. No, nothing to do with it. But he had a point. The latest version of WordPress changed the editor, and his site’s admin had become less intuitive. A small temporary fix, then a theme update scheduled so he can find his way around again.
What I take away from it is that a security alert brings all the small, dormant worries back to the surface. It’s the right moment to address them.
3 questions to ask yourself today
You don’t need to be technical to know whether your website is in good hands. Just ask yourself these 3 questions.
Who looks after my website’s security?
If the answer is “nobody”, “the developer who built it 4 years ago” or “I don’t know”, that’s a red flag. A website isn’t a printed brochure, it needs regular maintenance, just like a car or a boiler.
Did anyone warn me this week?
A flaw like PHP2Shell doesn’t go unnoticed among web professionals. If nobody contacted you, it doesn’t mean your website is at risk. But it does mean you don’t know whether it is.
Has my hosting provider applied the fix?
Most reliable hosting providers have communicated about it. Have a look at your emails or their news page. If in doubt, simply ask them “Are your servers patched against the PHP2Shell flaw of 21 October?”.
If you’d like to check yourself, WordPress shows the PHP version under Tools, then Site Health, Info tab, Server section. In Kirby, you’ll find it in the System view of the Panel. The patched versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12 (or newer). Version 8.1 or older is no longer maintained at all, which is a problem in itself.
Website security isn’t just about CMS updates
PHP2Shell is a reminder of something that’s easy to forget. Website security isn’t just about clicking “update” in WordPress. There’s also everything running underneath, the server, PHP, the database. Things you never see, but that matter a lot.
When a flaw like this one hits, 3 things make the difference.
- A reliable hosting provider that applies fixes quickly and on all its servers.
- Someone who looks after your website, and knows where it’s hosted and which version it runs on.
- Clear communication, so you hear about it before reading it in the news.
That’s also why I build lean websites with few plugins. Fewer components mean fewer ways in for attackers and simpler updates. A principle that also fits my eco-design approach.
FAQ
Is my WordPress or Kirby website affected by PHP2Shell?
Probably, if its server hasn’t been updated since 21 October 2026. The flaw affects PHP, not WordPress or Kirby themselves, so almost every website built with these CMSs is potentially affected.
Is a Kirby website better protected than a WordPress website?
Not against this flaw. Kirby runs without a database and usually relies on fewer plugins, which reduces everyday risks. But PHP2Shell targets the server’s PHP engine, which both CMSs share.
Do I need to do anything myself?
If someone maintains your website, normally not. Otherwise, contact your hosting provider or a professional to have your server’s PHP version checked.
Is updating WordPress, Kirby and plugins enough?
No. Those updates still matter, but this flaw is fixed at server level, usually by the hosting provider or the maintenance provider.
How can I tell if my website has been hacked?
Possible signs are pages you didn’t create, redirects to other websites, warnings from Google or a site that suddenly becomes very slow. If in any doubt, call in a professional.
Is your website looked after?
If you don’t know who’s watching over your website, now is a good time to sort it out. I offer website maintenance, for WordPress and Kirby alike, with European hosting at Infomaniak or Combell, covering updates, monitoring and security flaw follow-up. I work with WordPress and Kirby, and I’m a Certified Kirby Partner. I mostly work with SMEs and freelancers and nonprofits. The easiest way is to get in touch so we can review your website together.
Sources: Help Net Security, The Hacker News, Datadog Security Labs.