A Security Flaw Is Affecting Millions of Websites: What Small Business Owners Need to Do

If your business has a website, there is a 70% chance it is powered by PHP—and a massive security flaw just put it at risk. 

On October 21, 2026, the team that maintains PHP released emergency fixes for two critical security flaws—collectively dubbed “PHP2Shell”—and urged everyone to update their websites immediately. 

The same day, the Cybersecurity and Infrastructure Security Agency (CISA) urged organizations to patch right away, and the National Security Agency (NSA) and the FBI went a step further, advising if you couldn’t update immediately, to take the affected system(s) offline until you can. 

The flaws are serious because they may allow attackers to access the backend of your site, and potentially take it over, without needing a password or login. This could allow them to steal your data, or use your website to attack your customers. And because the problem is in PHP itself, keeping WordPress and your plugins up to date won’t fix it on its own.  

Here’s what small business owners need to know, and the steps to take today. 

[Read more: Top Obstacles to SMB Cybersecurity and How to Overcome Them] 

What is PHP, and what went wrong?  

PHP is a programming language that  helps web sites function and interact with customers, supporting processes like running your shopping cart, loading blog posts, and handling logins.  

The “PHP2Shell” flaws let an attacker send specially crafted web traffic that tricks PHP into running the attacker’s own commands. That’s the “shell” in PHP2Shell: control of the server. According to the NSA, that access could let attackers steal sensitive data, disrupt services, or move deeper into a company’s network.  

Is your business affected? 

If your website runs on WordPress, WooCommerce, Drupal, Joomla, Magento (Adobe Commerce), PrestaShop, or OpenCart, it is probably using PHP. Many large hosting companies spent October 21 and 22 adding temporary protections and rolling out patched versions of PHP. But not every plan is covered automatically, and not every customer has heard from their host. So, don’t assume that yours is being taken care of; confirm with your host or web developer immediately. 

[Read more: 4 Compelling Reasons Prioritizing Cybersecurity Is Good for Business] 

Steps to take right now 

1. Check which version of PHP your site uses 

If you use WordPress, log in and go to Tools > Site Health > Info > Server. Otherwise, look in your hosting control panel or ask your web developer. 

Compare the number to the patched releases: 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and newer. Some hosts install the fix without changing the version number you see, so if yours looks out of date, ask your host to confirm. 

2. Get off unsupported versions of PHP 

PHP 8.1 and older no longer receive official security updates. CISA says organizations still running them should take those systems offline until they’re upgraded. That’s not a small group: The Repository reports that about 35% of WordPress sites run PHP versions that are no longer patched. 

If you need to upgrade, aim for PHP 8.3 or newer, since PHP 8.2 will no longer be supported after December 31, 2026. Older plugins and themes sometimes break on newer PHP, so test on a copy of your site if you can, but don’t let testing become a reason to wait. 

3. Know that updating WordPress isn’t enough 

The WordPress security team has said no WordPress update is needed or planned for this issue. The fix has to happen in PHP, on the server. If you or your developer manage your own server, update PHP, then restart the web server and PHP services so the new version takes effect. 

4. If you can’t patch today, consider taking the site offline 

CISA, the NSA, and the FBI all recommend taking vulnerable systems offline if they can’t be updated right away. For many small businesses, that could mean putting your site in maintenance mode for a few hours. A short outage costs far less than a hijacked server. 

A web application firewall, a service that screens out malicious traffic before it reaches your site, may offer some protection in the meantime, according to CISA. Providers like Cloudflare have added protective rules, even for free-plan customers. But these are a stopgap, not a fix. 

5. Look for signs of a break-in 

Because attack attempts may date back to October 17, check whether anything has changed on your site since then. Warning signs include administrator accounts you don’t recognize, unfamiliar files, unexpected scheduled tasks, and a site that’s suddenly crashing or restarting. 

If something looks wrong, follow CO—’s 5 Steps to Take Immediately If Your Business Is Hacked and WordPress’s guide for hacked sites. You can report an incident to CISA or to the FBI’s Internet Crime Complaint Center. 

6. Change passwords and keys once you’re patched 

Because one flaw can leak passwords and keys from server memory, reset them after the fix is in place, especially if your site was exposed before patching. Start with your website admin and hosting accounts. Then ask your developer about replacing the connection keys (the secret “digital handshakes”) your site uses for payments, email marketing, and other services. 

While you’re at it, turn on multi-factor authentication wherever you can. 

7. Watch out for fake fixes 

Don’t install a “PHP2Shell fix” plugin or a code snippet from a forum or social media post.  

Security firm Patchstack has warned against these unofficial fixes, and some may contain malware. Be wary of unexpected emails or calls offering to fix the problem for you, and reach your host through its official website or phone number instead. 

Questions to ask your web host, developer, or vendors 

You don’t need to be a tech expert to get clear answers. Send these questions to your hosting company or web developer today, and keep their reply in writing:

• Which version of PHP is running our website right now, and does it include the fixes for the PHP2Shell security flaws (known as CVE-2026-109618 and CVE-2026-109619)? 
• When was the fix applied, and were PHP and the web server restarted afterward?
• Are our other sites and tools covered too, including test sites and older sites we no longer actively use?
• If we’re on PHP 8.1 or older, what’s the plan and timeline for upgrading? 
• Have you checked our site for signs of attack going back to October 17? 

Ask the same of vendors that run websites or online tools on your behalf, such as booking systems, customer portals, and online stores. Your business depends on their security as much as your own. 

The bottom line: Act today, then make patching routine 

This flaw touches a huge share of the web, but the fix is straightforward: Make sure PHP is updated on every server that runs your website and business tools. For most small businesses, that’s one conversation with your host or developer. 

As providers race to patch, you may notice brief outages, slowdowns, or temporary limits on file uploads, on your own site or on sites you depend on. If your site will be down for a few hours, a quick note to customers goes a long way.  

Longer term, use this as a prompt to know exactly who maintains your website, keep software on supported versions, and turn on automatic updates wherever you can. As AI helps attackers find weaknesses faster, the window to patch keeps getting shorter. 

Helpful resources:

• CISA: Critical Vulnerabilities in PHP Require Immediate Patching 
• NSA: Critical Patches Recommended for PHP Vulnerabilities 
• PHP: Official security advisory 
• WordPress.org: Critical PHP security release 
• CISA: Cyber Guidance for Small Businesses 

CO— aims to bring you inspiration from leading respected experts. However, before making any business decision, you should consult a professional who can advise you based on your individual situation.

CO—is committed to helping you start, run and grow your small business. Learn more about the benefits of small business membership in the U.S. Chamber of Commerce, here.