Most businesses accept that laptops, servers and email need to be managed. Updates are applied, backups are taken and someone is responsible when something goes wrong. The company website is often treated differently. It is built, launched and then left alone.
This week showed why that approach is risky.
What is PHP?
PHP is a programming language used to build websites. Many websites use it without visitors knowing. WordPress, which powers a large share of business websites, runs on PHP. Examples of sites that commonly use it include:
- Business websites and blogs
- Online shops
- Booking and appointment pages
- Contact forms
- School, church and club websites
- Membership sites and customer portals
If a website has a login page, a shopping basket, a contact form or pages that change based on what is clicked, it may use PHP.
What happened
On 21 October 2026, emergency security updates were released by the PHP development team. They fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, together known as PHP2Shell. Both are rated 9.2 under CVSS v4.0.
Both flaws could allow an attacker to run code on a web server without a username or password. The name PHP2Shell refers to this: an attacker may be able to place harmful software on the server and control it.
The timing made it worse. Details of the flaws began circulating online on 20 October, a day before the planned release. Early attacks were reported on the morning of 21 October, before the fix was available.
Why this is serious
If a website is not updated, criminals may be able to:
- Take control of the website
- Change pages or add false information
- Steal customer or business information
- Install harmful software
- Send spam or scam messages from the website
- Make the website stop working
- Use the website to attack other people
This does not mean every PHP website has been attacked. It means every website owner should act quickly.
Why a security plugin was not enough
Many site owners rely on a security plugin and automatic WordPress updates. Both are valuable. Neither could fix this issue. The flaws sit in PHP itself, on the hosting server, below WordPress, plugins and themes. Only the PHP update fixes them.
This is the gap that is often missed. A website is not one system. It is several layers:
- WordPress core, plugins and themes
- PHP and the web server
- The hosting account, DNS and email
- Backups and the ability to restore them
Each layer needs an owner. When nobody is assigned, each party assumes another is responsible. The host may assume the client will request the upgrade. The client may assume the host has it covered.
How we handled our own site
Within a day of the release, our own website was checked, our hosting provider was engaged and the patched PHP version was confirmed. The same checks were carried out across the websites we manage.
This was possible because our sites are monitored. Security advisories are followed, versions are checked and hosts are contacted directly. Without that routine, a gap like this could stay open for weeks.
Who needs to take action?
Action is needed by anyone who owns or looks after a website, including:
- Small business owners with a company website
- Online shop owners
- Blog and news site managers
- Schools, churches, sports clubs and community groups
- Anyone whose website was built by a developer and then handed over
- Anyone running an online booking system or customer portal
People who only visit websites usually do not need to update anything themselves.
What website owners should do
- Check your PHP version. In WordPress, this is found under Tools, then Site Health, then Info, then Server. Alternatively, ask your developer or hosting company: “Which PHP version does my website use?”
- Update PHP. Ask for one of these fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. The right one depends on how the website was built, and a developer or host can choose it.
- Update public websites first. If you have more than one site, start with those visible on the internet, such as your main website, online shop and customer login pages.
- Move off old PHP versions. PHP 8.1 and earlier no longer receive security fixes. A website on an old version stays exposed until it is upgraded. A backup should be taken first, and the site should be tested after the change, as older plugins and themes can break.
- Use trusted sources only. Updates should come only from your developer, your hosting company, the official PHP website or your website software provider. Unexpected emails or messages claiming your website has a security problem should not be trusted. Criminals often use security warnings like this one as bait.
What everyday internet users should do
No technical action is needed. Good habits still help:
- Keep your phone, computer and apps updated
- Use strong, unique passwords for important accounts
- Turn on two-step login where it is offered
- Be careful with unexpected emails, text messages and links
- If a service you use reports a security problem, follow only the instructions on its official website or app
What managed services provide
A managed website service treats the website as a business system, not a once-off project. In practice, this means:
- Monitoring. Security advisories for WordPress, plugins and server software are tracked daily.
- Patching. Updates are applied and tested, including server-level updates coordinated with the host.
- Backups. Backups are taken before every change, and restores are tested.
- Accountability. One party is responsible for every layer, so nothing falls in between.
- Records. Each change is logged, so the history of the site is always known.
The cost of this service is small when compared with the cost of a compromised website, lost leads or a damaged reputation.
How Iteb Co can help
Iteb Co provides managed IT services, website maintenance and cybersecurity services for businesses in South Africa and Zimbabwe. Websites are monitored, patched and backed up as part of a managed plan, alongside the rest of your IT. If you are unsure whether your website is affected, we can check it for you.
Book a 30 minute meeting or request a Free Cybersecurity Assessment.