PHP Is Famous Now, Here’s What It Means For Your Website
Published 28.10.26
28th October 2026
PHP has gone mainstream after the PHP2Shell vulnerabilities were a worldwide news story last week. Here’s what you should know.
Last Week PHP Was A Developer Word
This week and last, it’s been on the news. On 21 October 2026, PHP released emergency fixes for two critical flaws, nicknamed PHP2Shell. We covered the details as they broke, so we won’t repeat them here.
Suddenly everyone wants to know what PHP is. Even the BBC has been explaining it to a general audience (and apparently their cyber corespondent only just learned about it himself).
If you manage a WordPress website (or Drupal, Magento, Joomla, ExpressionEngine, Craft CMS, TYPO3 websites among others), or work with an agency that does, here’s what you actually need to know. As a WordPress Agency we are focusing on WordPress, but it is important to understand that this wasn’t a WordPress issue, or any other CMS issue. It was a server level issue.
A Quick Word On Version Numbers
If you’re new to PHP, start with our overview for WordPress site owners. The short version is it’s the language that WordPress and much of the web runs on, and it’s updated regularly for security and performance.
What matters now is how to read a version number. In 8.2.35, the 8.2 is the branch, and the 35 means it’s the 35th patch release for that branch. Most of those small updates fix bugs and security holes.
They come often. PHP 8.5 only launched on 20 November 2025, and it has already had twelve patch releases. Each branch gets two years of full support, then two years of security fixes only, then nothing. Our PHP2Shell article lists the fixed version for each branch.
Level One – PHP On The Server (Your Host’s Job)
Your website lives on a server, and PHP is installed on that server. When PHP releases a patch release, such as 8.2.34 to 8.2.35, someone has to install it and restart PHP so the patched version actually loads.
That someone is usually your hosting provider. This is the level PHP2Shell hit hardest. The flaws sit in PHP itself, so a site can be at risk even if its own code is perfect.
It’s also why updating WordPress, your theme or your plugins doesn’t fix it. Those updates change your website’s code, not the PHP engine underneath.
Level Two – PHP On Your Website (Your Agency’s Job)
A server usually offers several PHP branches, and each website is set to run on one of them. Choosing that branch, and moving up to a newer one, is a website job.
You can’t just flip the switch. A newer branch can break older plugins or theme code (here’s why), so the site needs testing on a staging copy, fixing where needed, and then switching live.
This is where PHP2Shell gets tricky. Official fixes only came for 8.2 to 8.5. Older branches got a source code fix at most, which hosts would have to build themselves, and most won’t. That’s a big group: CybelAngel estimates that 59% of the 2.24 million internet-facing PHP hosts are on versions with no official fix coming.
The clock is ticking for 8.2 too. It stops receiving security fixes on 31 December 2026, so if your site is on 8.2, that’s about two months away.
How The Two Levels Fit Together
Think of the server as a garage and your website as your car. The garage services the engine every few weeks. But if your car is a model so old that parts are no longer made, no amount of servicing will fix it.
| Server level | Website level | |
|---|---|---|
| What changes | Patch releases within a branch (8.2.34 to 8.2.35) | The branch itself (8.2 to 8.4) |
| Who does it | Your host | Your agency or developer |
| How often | Every few weeks, as PHP releases them | Before each branch’s security updates end |
| What it needs | Install and restart | Test, fix, then switch |
You need both. A patched server can’t protect a site on an unsupported version, and an up-to-date site still needs its host to install the patches.
How We Handled PHP2Shell
Every client site we host on a supported PHP branch was patched on the day the fix was released.
We’re Cloudways Platinum partners, and we work closely with them. Good communication and a strong relationship with your host are what keep you ahead of issues like this, rather than catching up. Every site we manage also sits behind Cloudflare, which deployed firewall rules for the known attack routes, as we explained on the day.
On the website side, our Pro:Act plans actively move client sites up to newer PHP branches while they’re still supported, alongside database upgrades. Keeping sites on a supported branch is what made the difference this time, because the patch only reached supported branches. That’s exactly what Pro:Act is for.
The One Question To Ask This Week
Who looks after PHP on your website, at both levels? If you know the answer for your host and for your website, you’re in good shape. If you’re not sure, it’s worth finding out before the next PHP2Shell, not after.
Want a second pair of eyes on it? Our WordPress Health Check looks at your PHP version, hosting set-up and compatibility. Or simply get in touch and we’ll tell you where your site stands.
If you’d like to learn more about our WordPress & WooCommerce Support & Maintenance plans, drop us an email or give James a call.
Our plans provide a holistic solution to your website’s performance, reliability and security, and are inclusive of premium tools and services.
