Security alert · 22 Oct 2026Two critical flaws in PHP, the software behind most small business websites, are being targeted by attackers. Here's free help to check yours.

Free help · PHP2Shell (CVE-2026-109618 and CVE-2026-109619)

Is your website safe from PHP2Shell?

PHP runs most WordPress, WooCommerce, Joomla and Drupal websites. On 21 October 2026 it was found to have two serious flaws that let attackers take over a website's server without a password. The fix is out. This page helps you find out whether your site has it, even if you don't have an IT person.

Why it matters

An attacker could steal customer details and passwords, or plant harmful code on your site. Attacks have already started.

Updating WordPress isn't enough

PHP sits underneath your website, on your hosting company's server. It needs updating there.

Often your host fixes it

Many hosting companies are updating PHP for their customers. The quickest win is to ask them to confirm.

Your site is fixed if it runs one of these, or newer

8.5.12 8.4.27 8.3.36 8.2.35 8.1 and older: no official fix

Start here

Pick the route that suits you

Easiest

Check it for me

Type in your web address and we'll email you what we can see from the outside. Takes a minute.

Use the free checker If you can log in to your hosting

Check it myself

Step-by-step guides for cPanel, Plesk and the hosting companies UK businesses use most.

Open the help sheets If you'd rather ask someone

Ask my host or IT support

Ready-written emails you can copy, fill in and send. They ask exactly the right questions.

Copy an email

Free website check

Check my website

We look at your website the way any visitor's browser does. We never try to break in, and we only read what your site already shows the world.

We'll use this to send your results, and nothing else unless you tick the box below.

Alexein Ltd uses your email address to send the results you asked for. We keep check records for 30 days and then delete them. See our privacy notice.

What we check

  • Whether your site tells visitors which PHP version it runs, and if so, whether that version has the fix
  • Whether your site looks like WordPress, Joomla, Drupal or another PHP-based system
  • Whether your site sits behind a protective service such as Cloudflare, which has put blocks in place for known attacks
  • A few basics while we're there, such as whether your site has a working padlock (HTTPS) and sends visitors to it automatically

What we can't tell you

  • Most well-run sites hide their PHP version, so the most common answer is "we can't tell from outside". That's normal, and the help sheets or emails below will get you a definite answer.
  • Some hosts fix PHP without changing its version number, so an older number isn't proof you're at risk.
EXAMPLE RESULTS EMAILexample-bakery.co.uk

Can't tell from outside

PHP VERSION
Hidden (this is good practice)
BUILT WITH
Looks like WordPress, so it uses PHP
PROTECTION
No Cloudflare detected
PADLOCK
Working, and visitors are sent to it automatically
NEXT STEP
Ask your hosting company to confirm. We've included a ready-written email.

Help sheets

Find your PHP version yourself

If you can log in to your hosting account, this takes about five minutes. Find your hosting company below, follow the steps, then type the number into the box to see what it means.

Two numbers to look for

Your hosting control panel usually shows the family, such as 8.2. To know if you're fixed you need the full number, such as 8.2.35.

If your site uses WordPress, the easiest place to see the full number is inside WordPress itself:

  1. Log in to your WordPress dashboard (usually yoursite.co.uk/wp-admin).
  2. Go to Tools → Site Health → Info.
  3. Open the Server section and read the line PHP version.

Not on WordPress, or can't find it? Your hosting company can tell you the full number. Use the email template.

What does my number mean?

This only reads the number you type. Nothing is sent anywhere.

cPanel (most UK shared hosting)

Krystal, Namecheap, GoDaddy cPanel, Bluehost, TSO Host, Heart Internet and many more
  1. Log in to your hosting account and open cPanel.
  2. In the Software section, click MultiPHP Manager or Select PHP Version (you'll have one or the other).
  3. Find your website in the list. The version shown next to it, such as PHP 8.2, is your family.
  4. For the full number, use WordPress Site Health (above) or ask your host.

On shared hosting, your host installs the fixed version for you. You can't usually change the last number yourself, only the family.

Plesk

Fasthosts and IONOS servers, many hosting resellers
  1. Log in to Plesk and go to Websites & Domains.
  2. Under your website, click PHP (sometimes shown as PHP Settings or PHP version).
  3. Plesk usually shows the full number, such as 8.3.36, in the version drop-down.

GoDaddy

Web Hosting (cPanel) and Managed WordPress
  1. Sign in and go to My Products.
  2. Web Hosting: click Manage, open cPanel Admin, then follow the cPanel steps above.
  3. Managed WordPress: GoDaddy has said it is updating PHP for these customers. Check your site's Settings page for the PHP version, or use WordPress Site Health.

IONOS

Web Hosting and WordPress plans
  1. Log in and choose Hosting, then your contract.
  2. Look for PHP version or PHP settings in the hosting menu.
  3. The family is shown next to your website. Use WordPress Site Health for the full number.

Hostinger

hPanel
  1. Log in to hPanel and click Websites, then Manage (or Dashboard) next to your site.
  2. Go to Advanced → PHP Configuration.
  3. The PHP version tab shows your family. Use WordPress Site Health for the full number.

SiteGround

Site Tools
  1. Log in and open Site Tools for your website.
  2. Go to Devs → PHP Manager.
  3. The PHP Version tab shows the version your site runs. SiteGround manages PHP updates on its servers, so ask them to confirm the fix.

123 Reg

Web Hosting and WordPress Hosting
  1. Log in to your control panel and choose your hosting package.
  2. Look for PHP version or PHP settings in the hosting tools.
  3. Use WordPress Site Health for the full number, or ask 123 Reg using the email template.

20i and resellers using StackCP

Many UK web designers host clients here
  1. Log in to My20i or StackCP and open your hosting package.
  2. Find PHP Version Manager (in the Web Tools area).
  3. The family is shown there. If a web designer hosts your site, they may hold the login. Send them the web designer email below.

Fully managed WordPress

WP Engine, Kinsta, WordPress.com, Flywheel and similar

These companies run PHP for you and patch it themselves. Check their status page or blog for a PHP2Shell notice, and confirm with WordPress Site Health. If in doubt, send them the hosting email.

Wix, Squarespace, Shopify, Webflow

Website builders

Good news. These platforms don't give you a PHP server of your own, and they look after their own systems. You don't need to do anything for your website. If you use other PHP-based tools (a booking system, a forum, a shop add-on hosted elsewhere), check those.

Your own server or VPS

For technical readers

Run php -v, but don't rely on it alone. Linux distributions often add the fix without changing the version number, so check your package changelog for CVE-2026-109618 and CVE-2026-109619. Update through your distribution's packages, restart PHP-FPM or your web server, and follow the NCSC's priority actions.

Written 22 October 2026. Hosting companies change their menus from time to time. If a step doesn't match your screen, search your host's help pages for "PHP version".

Ready-written emails

Ask someone to check for you

Copy an email, fill in the highlighted parts, and send it from your usual email. You don't need to understand the technical bits. They're there so the person reading knows exactly what you mean.

To your hosting company

The company you pay for your website hosting, such as GoDaddy, IONOS or 123 Reg.

Subject: Is my website protected from the PHP2Shell flaw?

Hello,

I'm [your name] from [business name]. You host our website, [web address], on account [account number or login email].

I've seen the news about the critical PHP flaws called PHP2Shell (CVE-2026-109618 and CVE-2026-109619), fixed by PHP on 21 October 2026. The UK's National Cyber Security Centre is telling organisations to update straight away.

Please could you tell me:

1. Which PHP version our website runs on, including the full number.
2. Whether it now has the fix (PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your own patched version).
3. If not, when it will be fixed, and whether I need to do anything.
4. Whether you've seen any signs of attack on our site.

Thank you,
[your name]
[phone number]

To your IT support company

Whoever looks after your computers, servers or network. This also covers systems beyond your website.

Subject: PHP2Shell: are any of our systems affected?

Hello,

I've seen the news about the critical PHP flaws called PHP2Shell (CVE-2026-109618 and CVE-2026-109619), fixed on 21 October 2026. The National Cyber Security Centre is advising organisations to update now, or take affected systems offline.

Please could you check and let me know:

1. Whether any of our systems use PHP. That includes our website, any internal web apps, intranet, booking or CRM systems, and devices such as routers, firewalls or storage boxes with a web control page.
2. Whether each one has been updated (PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor patch).
3. Whether you've seen any signs of attack.
4. Whether this is covered by our support agreement, or if there's a cost, before any chargeable work starts.

Our website is [web address].

Thank you,
[your name]
[business name]

To your web designer

For when a designer or agency built your site and still looks after it or its hosting.

Subject: Our website and the PHP2Shell flaw

Hi [name],

Have you seen the PHP2Shell news (CVE-2026-109618 and CVE-2026-109619)? Could you confirm for [web address]:

1. Who manages our hosting and its PHP version: you, us or the hosting company.
2. Which PHP version the site runs on, and whether it has the fix (8.5.12, 8.4.27, 8.3.36 or 8.2.35).
3. If we're on PHP 8.1 or older, what's needed to move to a supported version, and whether our plugins and theme will cope.
4. Whether there's a cost before you start any work.

Thanks,
[your name]

In the news

Read more about PHP2Shell

Start on the left for the plain-English version. The right-hand column is for readers who want the technical detail.

Plain English

Technical detail

Think you've been hacked?

What to do straight away

  1. Tell your hosting company and ask them to check your site and restore a clean backup if needed.
  2. Change passwords for your hosting, website admin, email and database, starting with any that share the same password.
  3. Look out for warning signs: new admin users you don't recognise, pages you didn't write, or customers saying your site redirects them elsewhere.
  4. Report it. In England, Wales and Northern Ireland, report to Action Fraud. In Scotland, call Police Scotland on 101.
  5. If customer data may have been taken, you may need to tell the ICO within 72 hours.

Rather we just sorted it?

We'll check it for you and tell you what to do.

Alexein helps UK small businesses without an in-house IT person. Book a free 45-minute call and we'll look at your website, talk to your host if needed, and give you a fixed price for anything that needs doing. You only pay when it's done.

Book a free call