Google Partner Check my website for free

Security alert · Updated Oct 22, 2026

PHP2Shell: Is your website at risk?

A critical flaw lets attackers break into unpatched websites. Find out if yours is one of them.

Check my website for free → 2 minutes. We send you a free audit.
yourbusiness.com
Website checkExample result
  • Built onWordPress
  • PHP version8.1 · no fix available
  • Patched for PHP2ShellNot yet
  • Takes paymentsYes · fix first
At risk. We'd send the fix steps in your audit.
9.2/10Critical severity
70%of websites run PHP
No fixfor PHP 8.1 and older

What PHP2Shell means for your website

On an unpatched site, an attacker can get in without a password. Then they can:

See your customer data
Steal passwords and payment keys
Install malware
Change your pages or send visitors to scams
Use your site to attack others
Take your site offline

Vulnerable doesn't mean hacked. It means the door is unlocked until PHP is updated.

Is my website affected?

It depends on what your site is built on, not how big it is.

At risk

WordPress, WooCommerce, Drupal, Joomla, Magento or custom PHP sites, until the server's PHP is updated.

Not affected

Webflow, Shopify, Squarespace and Wix. They don't run PHP for your site.

How to fix PHP2Shell

Updating WordPress or your plugins won't fix it. PHP itself needs the update.

  1. Check your PHP versionIn WordPress: Tools → Site Health → Info → Server.
  2. Update PHPTo 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or ask your host.
  3. Can't update? Go offlineSecurity agencies advise it until you can patch.
  4. Change passwords and keysAfter patching, in case anything leaked.

Who's behind the free check

A Vancouver team that builds and looks after websites

We're Brandcamp Digital. We build, maintain and market websites for businesses across Canada and the US. When a flaw like PHP2Shell comes out, we'd rather you hear it from us than from a customer. Send us your site and someone on our team will look at it and tell you plainly what needs fixing. We're glad to help, whether or not you ever work with us.

5.0150+ Google reviews
Google Partner Meta Business Partner Shopify Partners
Jordan Kipnes, CEO of Student Works Painting
"We have had the pleasure of working with Brandcamp for several years now and it has been nothing short of fantastic! We use them to develop and maintain multiple websites, run our SEO and Google Ads, along with blog and newsletter creation. Compared to the previous team that was running things, it is night and day. Brandcamp has been incredibly open and honest about everything, and as a business owner it is very refreshing."
Jordan Kipnes, CEOStudent Works PaintingNorth Vancouver, BC★★★★★Student Works Painting logo
Alex Camargo, Owner and CEO of Insight Service Solutions
"I was referred to Reza and Brandcamp and it's been such a great experience working with a company that cares so much. We started with a branding refresh, and I've loved working with them so much that we signed on for online advertising, SEO, and two new websites. It's clear they have passionate people on their team who know what they're doing."
Alex Camargo, Owner & CEOInsight Service SolutionsWinnipeg, MB★★★★★Insight Service Solutions logo
Ranko Vukovic, Founder and CEO of VanCity Physio
"After working with another digital marketing agency for many years, we started working with Brandcamp for SEO and PPC advertising. In 4 months, we're getting 20% more organic traffic and our Google Ads cost per lead is down from $40 to $8. We've just signed them to build a new website to further improve our conversion rates. We are VERY happy!"
Ranko Vukovic, Founder & CEOVanCity PhysioVancouver, BC★★★★★VanCity Physio logo

Free website check

Not sure? We'll check for you

Answer a few quick questions. We'll look at your site and email you a free audit.

What's in your audit

  • Your PHP version and whether it's patched
  • Signs your site may already be hacked
  • Step-by-step fixes for your host or developer
  • Anything urgent if you take payments
Reply within 1 business day
Reza Askari, Partner at Brandcamp Digital

Your check is done by Reza Askari, Partner at Brandcamp.

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

PHP2Shell questions

What is PHP2Shell?

PHP2Shell is the name for two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, patched on October 21, 2026. They let an attacker run code on an unpatched server and read memory that can hold passwords and API keys, without logging in.

Which PHP versions are affected?

PHP 5.4 through 8.5.11. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older won't get an official fix.

Does PHP2Shell affect WordPress?

Yes, if the server running your WordPress site hasn't updated PHP. Sites on WordPress.com, WordPress VIP and Pressable are already protected.

Will updating WordPress or my plugins fix it?

No. The flaw is in PHP, not WordPress. Your host or developer needs to update PHP on the server.

Is my Webflow, Shopify, Squarespace or Wix site affected?

No. These platforms don't run PHP for your site.

How do I know if my site was hacked?

Look for admin users you don't recognize, new files, or pages redirecting somewhere odd. See 8 warning signs of a PHP2Shell hack, with examples. If you're unsure, our free check can look for you.

Sources: PHP downloads and fixed releases, The Verge, Newsweek, Computing, USA Today.