Skip to content
Redman Studio
Menu
Redman Studio · Watford, Hertfordshire

Blog · Redman Studio, Watford: PHP2Shell: if your website runs on WordPress, check it today

Two critical PHP flaws were patched on Wednesday and attacks have already started. Government sites went offline as a precaution. Here is how to tell whether your site is exposed, the one email to send your host today, and why the sites I build had nothing to patch.

Paul Redman4 min read

On Wednesday 21 October, the PHP project shipped emergency fixes for two critical security flaws, now known as PHP2Shell. Both are rated 9.2 out of 10. By the same afternoon, Cloudflare said it was seeing early attacks.

If your website runs on WordPress, this is about you. Not next month. Today.

What happened

PHP is the language behind WordPress and a large share of small business websites. The flaws let an attacker run their own code on a web server without logging in. No password, no stolen account. Just a request to a site that has not been patched.

The reaction tells you how serious it is. In the UK, the Office for Budget Responsibility, Oxfordshire County Council and Hillingdon Council took their sites offline as a precaution. So did government sites in the Netherlands, Finland and France. These are organisations with security teams, and their first move was to switch the site off.

Most small businesses do not have a security team. They have a site somebody built a few years ago, and a host they have never emailed.

Is my site affected?

If your site runs on WordPress, yes, it runs on PHP. Every WordPress site does. The same goes for most sites built on Joomla, Drupal or a custom PHP build.

If you are not sure what yours is built on, ask whoever built it or hosts it. It is a one-line answer.

The question that matters is which version of PHP your server runs. The fixed versions are:

  • PHP 8.5: fixed in 8.5.12
  • PHP 8.4: fixed in 8.4.27
  • PHP 8.3: fixed in 8.3.36
  • PHP 8.2: fixed in 8.2.35

PHP 8.1 and older are no longer supported by the PHP project. If your site is on one of those, the fix depends on your host, and some will not have one.

Wix and Squarespace sites are run by those platforms, so this one is theirs to patch, not yours.

What to do today

  1. Email your host or web person now. Ask: "Have you patched PHP2Shell on my site, and which PHP version am I on now?"
  2. Check the answer against the list above. Anything below those numbers is not fixed.
  3. If you are on PHP 8.1 or older, ask what the plan is. The UK's NCSC advises considering taking a site offline if it cannot be updated.
  4. Update WordPress and every plugin while you are at it. Separate WordPress flaws have also been patched in recent months.
  5. If nobody looks after your site, that is the real problem. Fix that first.

Some hosts have moved quickly. GoDaddy says it has patched PHP across its managed WordPress hosting. Do not assume yours has. Ask, and get the version number in writing.

If you do not get an answer by tomorrow, treat that as the answer.

Why my clients did not have to do anything

On Wednesday, while councils were pulling their sites, my clients did not need to do anything.

The sites I build do not run PHP. They are static-first: every page is built ahead of time and served as finished HTML from a global network. There is no PHP on the server, no admin login for an attacker to aim at, and no plugins to patch. PHP2Shell had nothing to reach.

That is not luck, and it is not because I patched faster than anyone else. It is how the sites are built. A WordPress site is a server running code on every visit, plus a stack of plugins, each one written by someone else and each one something to keep patched. Every piece is a way in. Take the pieces away and there is far less to go wrong.

It is also why my monthly fees are cheap. Nobody spends Wednesday night patching a site that has nothing to patch.

Should you leave WordPress?

WordPress suits plenty of sites, and a well-run one with a good host will be patched by the end of this week. If that is you, send the email above and carry on.

But if yours is a brochure site, a booking site or a listings site, you probably do not need a server running PHP at all. You are carrying the risk of a web application to publish what is, in the end, a set of pages. This week is the cost of that, and it will not be the last time.

If you would like to know where your site stands, send me the address. I will tell you what it runs on and whether anything needs doing today. No charge, and no pitch unless you ask for one.

Paul Redman runs Redman Studio, an independent web design and engineering studio in Watford, Hertfordshire.

Sources

Published
Length
925 words · 4 min
Written by
Paul Redman, Redman Studio, Watford
Set in
Schibsted Grotesk and Geist Mono
Printed as
Static HTML. Readable with JavaScript off.
Filed under
security, wordpress, static-first

  • Post 11, 5 min read

    Search for your own business by name. Does it come up?

    The easiest search a customer can do is your business's exact name, and plenty of small firms fail it. Why it happens, what I found when I searched my own name, and a five-minute check across Google, Bing and the AI assistants.

  • Post 9, 3 min read

    My AI-friendly website told Claude nothing. Here is the bug.

    The first version of my studio's MCP server passed every test I ran and still gave Claude a link instead of my prices. What went wrong, why curl will not catch it, and the one check to run on any tool you expect an AI assistant to use.

  • Post 8, 4 min read

    Google could see my whole site. Bing had read three pages.

    I build sites so AI assistants can read them, then found Bing had indexed three pages of my own. Here is why that matters for ChatGPT and Copilot, the four-minute check you can run on yours, what I changed, and what it has and has not done two weeks on.

Send me a URL.

I will run the checks in these posts on your site and reply with what a search engine and an AI assistant currently see. No charge, no obligation, occasionally uncomfortable.

Send a URLOr email me directly