Your website went dark? Get it back.

PHP2Shell, 21 October 2026 · a checklist for people who run a business, not a server · from The AI Manager by John Margerison · book.theaimanager.ai/php

What happened. Two serious bugs in PHP, the language behind about seven in ten websites (every WordPress, Drupal, Joomla and Magento site), were disclosed on 21 October 2026. An attacker can run their own code on an unpatched server without logging in. Some hosts and owners switched sites off, and the UK’s cyber security centre told people to take any system they could not fix offline. The only fix is a newer PHP on your server. Updating WordPress or its plugins does not do it.

Before you start. You may already be fixed: the big managed hosts patched every site they run (SiteGround said so publicly on 21 October). Look for an email from your host first; then still do Step 1, because a number is the only proof. Is it really PHP? Your host’s email or status page says why the site is off; a site down for another reason will not come back from this list. Have a web person or agency? Give them this page; the email in Step 3 is theirs to send too.

Step 1 · Find your PHP version

WordPress: log in, then Tools → Site Health → Info → Server. The line reads PHP version. Not WordPress, or locked out: log in to your hosting account (where you pay for the website). Look for PHP, MultiPHP Manager, Select PHP Version or PHP Settings. Cannot find it: skip to Step 3 and ask your host. The email asks for it.

Step 2 · Compare it with the safe numbers

8.5.128.4.278.3.368.2.35

Mine is one of these, or higher in the same line (8.3.37 counts, 8.3.35 does not). You are fixed for this problem. Go to Step 5. Mine starts 8.2, 8.3, 8.4 or 8.5 but the last number is lower. Your host has not installed the fix yet. Step 3. Mine starts 8.1, 8.0, 7 or 5. Out of support: the PHP project ships no fix for that line. Some hosts and Linux distributions patch the old version themselves; if yours says so, ask for it in writing (the email does). Otherwise you must move to 8.3 or 8.4. Step 3 and Step 4.

Step 3 · Switch it, or ask your host

If your hosting panel has a PHP version chooser: first update every plugin and your theme in WordPress, then choose 8.3 (or 8.4), save, and open your site. The number the panel shows must be a safe one above; a bare "8.3" tells you nothing until the host confirms the build. If the site shows an error or a white page after the switch: switch back, and go to Step 4. If your host switched the site off, only they can switch it back on. No chooser, unsure, or switched off: send this email to your host's support. Copy it as it is.

Subject: PHP2Shell (CVE-2026-109618 / 109619): my site's PHP version

Hello,

My website is [your domain]. Please tell me:

1. The exact PHP version my site is running right now (all three numbers, for example 8.3.36).
2. Whether that is one of the fixed releases for PHP2Shell (8.5.12, 8.4.27, 8.3.36 or 8.2.35, or higher), or whether you have applied the fix for these two CVEs to the version I am on. Please confirm in writing.
3. If it is not, the date and time you will move my site to a fixed release, and whether you will do it or I must.
4. If my site is currently switched off, when it will be back online once fixed.
5. If my site is on PHP 8.1 or older: which supported version you recommend I move to, and whether you can test it with me.

Thank you,
[your name]
[your phone]

Step 4 · Read their answer properly

Does the reply give a version number with three parts? "All patched" or "you're protected" without a number is not an answer. Ask again for the number. Is that number one of the four above, or higher? If yes, tick Step 5. If no, ask for the date. Not sure? Paste the reply to Beep at book.theaimanager.ai/look and press Make it prove itself. He scores whether the answer actually says what it needs to. Moving up from 8.1 or older and something breaks: it is almost always one plugin or an old theme. Update them all, then turn off the one that complains. Your host or a web person can do this in an hour; the email above has already told them what you need.

Step 5 · Were you hit? Do these anyway if your site was off

Change the passwords for the hosting account, WordPress admin users, and FTP or database if you have them. Turn on two-step sign-in where offered. Run your host's malware scan (most panels have one) and look for new users, new plugins or files you did not add. If anything looks wrong: ask your host to restore a backup from before 17 October 2026 (the first attack attempts seen; earlier if your host says so), and move to a fixed PHP at once, before the site goes back on. If customer data may have been exposed (orders, names, emails), you may have a legal duty to tell people and a regulator within days. Ask a professional now; the rules depend on where you and your customers are. Behind Cloudflare or a similar service? Their firewall rules give some protection. They are not the fix. Still do Steps 1 to 4.

Step 6 · The scam wave: do not click a “patch now” email

This week every website owner will get emails and calls saying “your site is vulnerable, click here to patch” or “pay now or lose your site”. Some are from your real host; many are not. Never click a patch link or pay from an email. Open your host’s website yourself and log in there. Unsure about one? Paste it to Beep at book.theaimanager.ai/look and press Is this a scam?

Done when: your PHP version is one of the safe numbers or higher, your site opens, and the passwords are new. Write the date here so you have it:

Honest limits. This is a plain-English checklist, not security advice for your exact setup; the authoritative word is php.net, your host, and CISA's alert of 21 October 2026. Beep cannot see your server; he only reads what you paste. We have no connection to the PHP project or any host. If your business depends on the site, pay a web professional for the hour.

Free to print, copy and pass on. © 2026 John Margerison · The AI Manager, the book, free to read online.