If your business website runs on WordPress, Divi, or another PHP-based system, there’s an important security issue you need to know about right away.

On October 21, 2026, the developers behind PHP released emergency security updates for two critical vulnerabilities known collectively as PHP2Shell.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, received critical severity ratings of 9.2 out of 10.

Attackers may be able to exploit vulnerable websites without knowing a password or accessing the website’s administrative dashboard, which makes this especially concerning.

For businesses that depend on their websites to generate leads, communicate with customers, or process transactions, this needs immediate attention.

What Is PHP2Shell?

PHP is a programming language that operates behind the scenes on millions of websites. It handles tasks such as displaying content, processing forms, communicating with databases, and managing website functionality.

PHP2Shell refers to two newly disclosed security flaws within that underlying technology.

Under certain conditions, these vulnerabilities can allow an unauthorized person to execute malicious instructions on the server hosting a website.

In everyday terms, an attacker could gain access to information or functionality they were never supposed to control.

A website can appear completely normal to visitors while its underlying server remains vulnerable.

Which Websites Could Be Affected?

PHP2Shell is not exclusive to WordPress.

Any website using a vulnerable PHP installation could potentially be affected, including websites built with:

  • WordPress
  • Drupal
  • Joomla
  • Magento and Adobe Commerce
  • PrestaShop
  • OpenCart
  • Craft CMS
  • Other PHP-based website platforms and custom applications

For WordPress websites, this includes sites built using popular themes and page builders such as Divi, Elementor, Beaver Builder, and WPBakery.

It’s important to clarify that Divi and these other page builders are not the cause of PHP2Shell. The vulnerability exists in the PHP software running underneath them.

Keeping WordPress, themes, and plugins updated does not necessarily resolve this issue. The WordPress organization has confirmed that PHP2Shell requires an update to the underlying PHP environment, not WordPress itself.

What Are the Risks to Your Business?

A successful PHP2Shell attack could potentially allow someone to:

  • Access sensitive information. Customer records, submitted forms, database information, and other confidential data accessible to the affected server could be exposed.
  • Modify your website. Attackers could insert unwanted content, change pages, redirect visitors, or add malicious code.
  • Interfere with leads and customer inquiries. A compromised website could expose submitted contact information or interfere with how forms process inquiries.
  • Disrupt business operations. An attack could affect your website’s availability or create problems requiring significant recovery work.
  • Compromise other connected resources. Depending on how the hosting environment is configured, an attacker could access additional information, credentials, or websites connected to the same account.

These are possible outcomes, not a statement that every website running PHP has been compromised.

However, the risk is significant enough that businesses should confirm their hosting environments have received the necessary security fixes.

Why This Matters to Businesses in Tyler and East Texas

At Bailes + Zindler, we’ve worked with websites throughout Tyler and East Texas for the past decade.

One thing I’ve noticed over the years is how frequently local business websites rely on WordPress. Many use Divi, one of the most recognizable WordPress themes and website builders.

There’s nothing inherently wrong with choosing WordPress or Divi. Both have helped countless businesses establish an online presence.

The problem arises when a website is built, launched, and then receives little attention beyond occasional content changes.

A website may have been built several years ago and still look perfectly acceptable today. But what about the technology running behind it?

Is its hosting environment properly maintained? Is the underlying software supported? Who is responsible for applying critical security updates?

Those questions matter just as much as how the website looks.

PHP2Shell is a timely reminder that website security extends far beyond updating a few plugins.

What Should WordPress Website Owners Do Right Now?

If your website runs on WordPress, don’t panic. But do take this warning seriously and act now.

Take these five steps immediately.

  1. Find out which version of PHP your website uses. WordPress administrators can check this under Tools → Site Health → Info → Server, then look for the PHP version.
  2. Contact your website hosting company now. Ask whether the PHP installation serving your website has been updated to address CVE-2026-109618 and CVE-2026-109619. Your provider may already have applied the appropriate fixes.
  3. Confirm that the necessary security fixes are installed. The PHP development team released fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. If your website uses an older version, ask your hosting provider to verify that both vulnerabilities have been addressed. Don’t assume that PHP 8 means you’re protected.
  4. Don’t rely exclusively on a WordPress security plugin. Security plugins and web application firewalls provide valuable protection, but they cannot replace the updates required to correct these PHP vulnerabilities.
  5. Review your website’s maintenance and security responsibilities now. Find out who handles server updates, website backups, security monitoring, and recovery if something goes wrong. If your provider cannot confirm the vulnerabilities have been fixed, escalate the issue immediately.

Have Attackers Already Started Exploiting PHP2Shell?

Yes. Security researchers have documented exploitation attempts.

Amazon’s threat intelligence team reported an attempted attack dating back to October 17, 2026, several days before the public disclosure and release of security updates.

Cloudflare has also reported attempts against its customers and has deployed additional protections.

These findings are why website owners should treat the issue as urgent.

How Our Approach to Website Development Has Changed Since 2016

Protecting the website you already have comes first. But PHP2Shell is also a good moment to explain why the way we build new websites has changed.

When we started Bailes + Zindler in 2016, WordPress and other PHP-based content management systems were an important part of how we built websites. They were practical, widely supported, and gave businesses the ability to manage website content without needing extensive technical knowledge.

Over the past ten years, website development has changed considerably. So has our approach.

Today, we no longer rely on traditional PHP-based content management systems. Instead, our website design and development uses modern technologies such as Astro, Next.js, Nuxt, and React, choosing the right combination for each project — an approach we explain in more depth in why we choose modern frameworks.

If your site has outgrown WordPress, moving it to a modern architecture — while preserving your content, URLs, and search visibility — is exactly what our WordPress website redesign and migration service handles.

These technologies allow us to build websites with greater control over performance, functionality, and the systems required to operate them. In some cases, we can deliver much of a website as prebuilt pages without requiring a traditional PHP-powered content management system to process every visitor’s request.

That distinction is particularly relevant to PHP2Shell. A website that doesn’t run PHP is not directly exposed to these particular PHP vulnerabilities through its website-serving environment.

Of course, no programming language or website framework is completely immune to security problems. Modern websites still require responsible development, maintenance, and monitoring.

Our philosophy is simple: the technology behind a website should be selected based on what the business actually needs, not simply because it’s what we’ve always used. The goal isn’t just to build an attractive website. It’s to build something that performs well, supports the business, and can be properly maintained for years to come.

Your Website Is an Investment. Make Sure It’s Protected.

For many businesses, a website is one of their most important assets. It introduces customers to their services, generates inquiries, supports marketing campaigns, and helps build credibility.

Protecting that investment requires more than an attractive design and occasional content updates. It requires understanding the technology supporting the website and making sure someone is responsible for maintaining it.

At Bailes + Zindler, our approach to website development has evolved considerably since 2016. One principle remains the same: businesses deserve websites built to serve their long-term interests.

If you’re unsure what technology your website uses, whether your hosting environment is protected against PHP2Shell, or whether it’s time to consider a more modern website architecture, contact us today so we can help you evaluate your options.

Sources and Further Reading

Information current as of October 22, 2026.