Your Website Probably Runs on Code the Feds Just Flagged

Yesterday, the NSA, CISA, and the FBI put out a joint advisory telling every organization in the country to patch two critical security flaws in PHP, the programming language that powers roughly 70% of all websites. If you’re a business owner, you probably didn’t see that advisory. You probably don’t know what PHP is. And you almost certainly don’t know whether your website runs on it.

It does. If your site is built on WordPress and more than 40% of all websites are, it runs on PHP. That means the code your customers interact with every time they visit your site has two holes in it that federal agencies are calling a 9.2 out of 10 on the severity scale. For context, a 10 is as bad as it gets.

The vulnerabilities are being actively exploited right now. Amazon’s security team detected exploitation attempts four days before the advisory was even published. This isn’t theoretical, it’s happening.

Here’s what that means in plain English: someone with basic technical skills can take control of your website’s server — without needing a password, without needing an account, without you ever knowing it happened. They can steal customer data, install malware that infects your visitors’ devices, redirect your site to a scam page, or just take the whole thing offline.

If you’re thinking, “Doesn’t my hosting company handle this?” keep reading. The answer is more complicated than you’d expect, and it’s the reason we’re writing this today.

What Is PHP2Shell, and Why Should a Greenville Business Owner Care?

PHP2Shell is the name the security community gave to two vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, discovered in PHP, the server-side language that processes nearly every page load on most business websites. The PHP Foundation, the organization that maintains this code, called their own response timeline a “structural failure.” The patches were issued on October 21, but exploitation was already underway before anyone outside of Amazon’s security team knew there was a problem.

Here’s the part that matters to you: these are “unauthenticated remote code execution” vulnerabilities. In non-technical terms, an attacker doesn’t need to log into anything. They don’t need to guess your password. They just send a specially crafted request to your server, and they’re in. Full control.

Within hours of the patch being published, security researchers confirmed that working exploit code was circulating openly online. By the time the NSA issued its advisory on October 21, the flaws were already being “broadly exploited in the wild”, their words, not ours.

PHP2Shell at a glance: the numbers behind the federal advisory.

And the real kicker? 54% of small business owners handle all their marketing, including their website, entirely on their own. That means more than half of the small business websites out there don’t have a dedicated person watching for advisories like this one. Forty-two percent of small business sites don’t even run analytics, which means they’d have no way to detect unusual activity on their server even if they knew to look.

This isn’t a story about hackers. It’s a story about the gap between what business owners assume is being handled and what’s actually being handled. And it’s a gap that just got very expensive to ignore.

5 Things to Do About PHP2Shell Right Now (Even If You’re Not Technical)

You don’t need to become a cybersecurity expert to deal with this. But you do need to take five specific steps this week, and most of them involve asking hard questions of the people you’re currently trusting with your website.

1. Find Out Who Actually Controls Your Server Software

Most business owners can tell you who built their website. Fewer can tell you who manages the server it sits on. Those are two completely different jobs, and right now the second one is the one that matters.

Your web designer builds the pages you see. Your server administrator manages the software those pages run on, including PHP. When the NSA says “patch PHP immediately,” the question isn’t “who made my logo look nice?” It’s “who has root access to my server, and did they already apply this patch?”

If you don’t know the answer, that’s not unusual, but it’s the first thing to figure out today. Call whoever you pay for hosting or website maintenance and ask: “Who is responsible for applying server-level security patches, and has the PHP2Shell patch been applied?” If they can’t answer that in a sentence, you have a problem that goes beyond this one vulnerability.

2. Understand the Response-Time Gap (It’s Bigger Than You Think)

Here’s a detail from the PHP2Shell timeline that should concern every business owner: Amazon’s security team detected active exploitation attempts on October 21, four full days before the NSA published their advisory. The patch existed, but most of the world didn’t know they needed it yet.

That four-day window is the response-time gap. It’s the difference between a team that monitors security feeds in real time and a business owner who finds out about a critical vulnerability from a blog post (or a news story, or a friend’s panicked text). Enterprise-level companies have 24/7 security operations centers that catch these things the hour they drop. Small businesses typically find out days or weeks later, if they find out at all.

You can’t build a security operations center for a 20-person company. But you can make sure whoever manages your website is plugged into the right feeds and has a response plan for exactly this scenario. Ask them: “When a critical vulnerability is disclosed, what’s your process for patching our environment, and what’s your typical turnaround time?” The right answer is hours, not days.

3. Stop Treating Your Website Like a Set-It-and-Forget-It Project

We hear this all the time from business owners: “We paid $15,000 for our website three years ago. It’s done.” But websites aren’t like a building renovation. They’re more like a car: they need regular maintenance, or things start breaking in ways you can’t see from the outside.

PHP alone has released 14 security patches in the last 12 months. WordPress pushes updates roughly every two weeks. Every plugin on your site has its own update cycle. If nobody is applying those updates, your website is accumulating vulnerabilities the way an unserviced car accumulates wear. PHP2Shell is just the one that made national news.

Seventy-two percent of small business websites don’t even have a contact form on their homepage. If that many sites are missing something that basic, imagine how many are running outdated server software that nobody’s checked in months.

The difference between a website that’s managed and one that’s just… sitting there.

4. Your Hosting Provider Isn’t Your Security Team

This is one of the most common misconceptions we run into. Business owners assume that because they pay a hosting company $20 or $30 a month, that company is handling everything, including emergency security patches like PHP2Shell.

Here’s how it actually works on most shared hosting plans: the hosting provider manages the physical server hardware and the network. They might update the base operating system. But the PHP version your specific site runs on, the WordPress version, the plugins, the themes that’s usually your responsibility. Or your developer’s. Or nobody’s, if you didn’t specifically assign it.

Some managed hosting providers (WP Engine, Kinsta, Flywheel) do handle PHP updates as part of their service. But even they have different timelines for applying emergency patches. Some roll them out in hours; some wait for their own testing cycle, which could take days. You need to know exactly what your hosting plan covers and what it doesn’t. Don’t assume. Call them and ask.

5. Here Are the Exact Questions to Ask Your Web Team Today

Whether you have an in-house IT person, a freelance developer, or an agency managing your site, send them this list today. Their answers will tell you everything you need to know about whether your website is protected not just from PHP2Shell, but from the next vulnerability that drops:

1. “What version of PHP is our website running?” – If it’s anything older than 8.5.12, 8.4.27, 8.3.36, and 8.2.35 (the patched versions), you’re exposed.
2. “Has the PHP2Shell patch (CVE-2026-109618 and CVE-2026-109619) been applied to our server?” – Yes or no. If they don’t know what you’re talking about, that’s your answer.
3. “Who monitors our server for critical security advisories, and how quickly do patches get applied?” – The right answer is a specific person or team with a specific process.
4. “When was the last time our WordPress core, plugins, and themes were updated?” – If the answer is “I’m not sure,” you’ve found the gap.
5. “Do we have automated backups, and has anyone tested restoring from a backup in the last 90 days?” – Backups that have never been tested are decorations, not safety nets.

What We’re Doing About It for Our Clients

We started reaching out to every client with a PHP-based website within hours of the advisory dropping on October 21. By the time you’re reading this, our team has already verified PHP versions, applied patches where we have server access, and contacted hosting providers where we don’t. That’s what ongoing website management looks like: not waiting for the business owner to read a news article and panic.

We’ve seen the other side, too. We worked with a Greenville-area service business last year that came to us after their website had been quietly compromised for three months. Malware was redirecting their mobile visitors to a phishing site. They had no idea until a customer called to ask why the website was “acting weird.” That business lost an estimated 160 potential customer visits over those three months visitors who showed up, got redirected to a scam page, and never came back.

After we cleaned up the site, rebuilt their security layer, and put them on a managed maintenance plan, their website traffic recovered within six months. But those three months of lost trust? You can’t patch that.

Frequently Asked Questions

Sources

• National Security Agency “NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities” (October 21, 2026) – nsa.gov
• ABC7 Chicago News – “Urgent security fix issued for code vital to estimated 70% of all websites” (October 21, 2026) – abc7chicago.com
• W3Techs, PHP Usage Statistics (2026) – w3techs.com
• National Vulnerability Database, CVE-2026-109618 and CVE-2026-109619 Severity Ratings
• PHP Foundation, Post-incident disclosure statement (October 2026)

Not Sure If Your Website Is Protected?

Our Website Performance Checkup covers everything: PHP version, patch status, plugin vulnerabilities, speed, mobile experience, and a prioritized list of what to fix first. We’ll tell you exactly where you stand, delivered in 5–7 business days.

Talk to Cherish. She’ll walk you through it.