Your website went dark? Get it back.

PHP2Shell, 21 October 2026 · the solve for people who run a business, not a server

Two serious bugs in PHP, the language behind about seven in ten websites (every WordPress, Drupal, Joomla and Magento site), were disclosed on 21 October. An attacker can run their own code on an unpatched server without logging in. Some hosts and owners switched sites off, and the UK’s cyber security centre told people to take any system they could not fix offline. The only fix is a newer PHP on your server. Updating WordPress or its plugins does not do it. Four steps, the safe numbers, and the email to send your host. No sign-up.

Download the checklistOne page · tick it off, fill in the answers, print it · the email is inside Paste your host’s reply to BeepHe scores whether it actually answers

Before you start

You may already be fixed. The big managed hosts patched every site they run (SiteGround said so publicly on 21 October). Look for an email from your host first; then still do Step 1, because a number is the only proof. Is it really PHP? Your host’s email or status page says why the site is off. A site that is down for another reason will not come back from this list. Have a web person or agency? Send them this page; the email below is theirs to send too.

The four steps, then two checks

Step 1

Find your PHP version

WordPress: log in, then Tools → Site Health → Info → Server; the line reads PHP version. Not WordPress, or locked out: log in to your hosting account (where you pay for the site) and look for PHP, MultiPHP Manager, Select PHP Version or PHP Settings. Cannot find it? Step 3 asks your host.

Step 2

Compare it with the safe numbers

8.5.12 8.4.27 8.3.36 8.2.35 One of these, or higher in the same line (8.3.37 counts, 8.3.35 does not): you are fixed for this problem; go to Step 5. Same line but a lower last number: your host has not installed the fix; Step 3. Starts 8.1, 8.0, 7 or 5: out of support, so the PHP project itself ships no fix for that line. Some hosts and Linux distributions patch the old version themselves: if yours says so, ask for it in writing (the email does). Otherwise you must move to 8.3 or 8.4; Steps 3 and 4.

Step 3

Switch it, or ask your host

If your hosting panel has a PHP version chooser: update every plugin and your theme first, choose 8.3 (or 8.4), save, open your site. If it shows an error or a white page, switch back and go to Step 4. If your host switched the site off, only they can switch it back on. No chooser, unsure, or switched off: send the email below to your host’s support, as it is.

Subject: PHP2Shell (CVE-2026-109618 / 109619): my site's PHP version

Hello,

My website is [your domain]. Please tell me:

1. The exact PHP version my site is running right now (all three numbers, for example 8.3.36).
2. Whether that is one of the fixed releases for PHP2Shell (8.5.12, 8.4.27, 8.3.36 or 8.2.35, or higher), or whether you have applied the fix for these two CVEs to the version I am on. Please confirm in writing.
3. If it is not, the date and time you will move my site to a fixed release, and whether you will do it or I must.
4. If my site is currently switched off, when it will be back online once fixed.
5. If my site is on PHP 8.1 or older: which supported version you recommend I move to, and whether you can test it with me.

Thank you,
[your name]
[your phone]

Step 4

Read their answer properly

A reply that says “all patched” without a three-part version number is not an answer; ask again for the number. Number given and it is one of the four or higher: done. Not sure what the reply means? Paste it to Beep and press Make it prove itself. Moving up from 8.1 and something breaks: it is almost always one plugin or an old theme; update them all, then turn off the one that complains. A web person does this in an hour.

Step 5

Were you hit? Do these anyway if your site was off

Change the passwords for hosting, WordPress admin and FTP or database; turn on two-step sign-in. Run your host’s malware scan and look for users, plugins or files you did not add. Anything wrong: restore a backup from before 17 October 2026 (the first attack attempts seen; earlier if your host says so) and move to a fixed PHP before the site goes back on. If customer data may have been exposed you may have a legal duty to tell people and a regulator within days: ask a professional now. Behind Cloudflare? Their firewall rules help; they are not the fix.

Step 6

The scam wave: do not click a “patch now” email

This week every website owner will get emails and calls saying “your site is vulnerable, click here to patch” or “pay now or lose your site”. Some are from your real host; many are not. Never click a patch link or pay from an email. Open your host’s website yourself and log in there. Unsure about one? Paste it to Beep and press Is this a scam?

Honest limits. This is a plain-English checklist, not security advice for your exact setup; the authoritative word is php.net, your host, and CISA’s alert of 21 October 2026. Beep cannot see your server; he reads only what you paste. We have no connection to the PHP project or any host. If your business depends on the site, pay a web professional for the hour.

Free to copy, print and pass on. Questions to John. The rest of the book is about putting AI to work on days like this: chapter 4 is where to start.