Is your business website affected? A one-minute PHP check
Does PHP2Shell affect your business website? Answer five quick questions, read one of three results, and get a message to send your developer or host.
By Jeensuk Yang
PHPFree · Web security · Quick check
?Who this is for
- You saw the PHP2Shell news and wonder whether it applies to your business website
- You don't know what your site is built on or who looks after the server
- You want a quick answer before you call anyone
!What you'll learn
- Which websites PHP2Shell affects
- Five questions you can answer in a minute, and three possible results
- What to ask, and whom, if most of your answers are "I don't know"
At a checkup, you fill out the form before you see the doctor.
"What's wrong?" is hard to answer. So the intake form starts small: do you sleep well, do you take any medication? As you answer, a map of your health takes shape. Your website works the same way. Instead of the big question, "Is our site at risk?", here are five small questions you can answer in a minute. "I don't know" is a fine answer. Knowing what you don't know is where checking begins.
Which websites does PHP2Shell affect?
Any website that runs on PHP and hasn't moved to a fixed PHP release yet. The size of your company and your industry don't matter.
CISA, the US cybersecurity agency, says the flaws "affect all PHP installations serving web requests."1 The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and PHP 8.1 and older get no official fixed release.2
The catch is how common PHP is. As of October 24, 2026, "PHP is used by 69.3% of all the websites whose server-side programming language we know," according to W3Techs.3 That's like seven houses out of ten on your street using the same brand of lock. If that lock has a flaw, it's worth checking yours, big house or small.
Only about a third of the PHP instances where we could identify the version run a branch covered by this security update. — Bitsight, Oct 21, 2026
Bitsight adds that the most common branch it saw "by far is PHP 7.4," which is past end of life.4 Meanwhile, in a 2025 survey of 1,000 executives at organizations with under $100 million in revenue, 64% said their organization is "too small to be an attractive target."5
Jeensuk's take"Who would bother with a business our size?" is half right. No person is choosing you. But the programs that rattle locks rattle every door on the street.
The one-minute check: which questions do you answer?
Answer these five questions in order. "Yes," "no" or "I don't know" is enough for each.
- Q1 Built with: Is your website built on WordPress?
- Q2 Managed by: Does your host manage the server, or do you (or your developer) manage it yourselves?
- Q3 Notice: Has your host announced that it has applied the fix?
- Q4 Version: Is your site's PHP 8.1 or older?
- Q5 Hidden sites: Do you have old campaign pages, a test server or a separate admin site somewhere?
If any answer is "I don't know," your result is "Needs checking." That's a perfectly good answer.
| Question | Why we ask |
|---|---|
| Q1 WordPress? | WordPress runs on PHP. WordPress recommends PHP 8.3 or newer6 |
| Q2 Who manages it? | On managed hosting, the host usually patched PHP for you. On a VPS or your own server, someone on your side has to7 |
| Q3 Fix notice? | Hostinger said every plan except VPS needed no action,7 Kinsta patched PHP 7.4 through 8.5,8 and Reclaim Hosting's managed hosting needed no action, while customers running their own PHP containers had to redeploy by October 279 |
| Q4 8.1 or older? | These branches get no official fixed release. Check whether your host fixed them separately2 |
| Q5 Hidden sites? | An old event page or test server still online is another door into your house. Bitsight notes many PHP sites don't even show their version4 |
Jeensuk's takeQ5 is the one people forget. If a page you made for an event years ago is still live, it's a door into your house too.
How do you read the result, and what do you do next?
There are three results. "Not affected" means nothing to do. "Needs checking" means read your host's notice and send one message. "Needs action" means follow the update steps.
These are the same three results ATATAKAI Digital's 30-second check gives. It reads only what your site shows from the outside.
| Result | When | What to do |
|---|---|---|
| Not affected | Your website doesn't run PHP (for example, a static site that serves only prebuilt HTML) | Nothing to do for this issue |
| Needs checking | It's WordPress on shared or managed hosting run by your host, or you answered "I don't know" to any question | Read your host's notice and send your developer one message (section 4) |
| Needs action | You manage the server yourselves (VPS or your own server) and it's below the fixed release, or it's 8.1 or older with no fix notice from your host | Update in the order in the "PHP vulnerability fix guide" (English edition coming soon). Hostinger's advice for self-run PHP: "update it and restart it now"7 |
Jeensuk's takeIf you get "Not affected," you can believe it. When that's the case, we tell people the same thing: "No need to move right now."
If you answered "I don't know" a lot, whom do you ask, and what?
Ask whoever built your website, or your host. You can send the message below as is.
Not knowing isn't a failure. Intruders often go unnoticed for a while: Mandiant reports that the global median dwell time, how long attackers stay before being found, "rose to 14 days from 11 days."10 When you don't know the way, asking is the fastest way to get there.
When you get the answers, change your "I don't know"s to "yes" or "no" and read the check again.
Jeensuk's takeAsking takes a minute. If waiting for the answer makes you uneasy, run the 30-second check to see the outside first.
What can't this check tell you?
It tells you only whether you're affected. It doesn't tell you whether someone already got in before the fix.
An intake form doesn't diagnose an illness, and this check doesn't diagnose a break-in. Our 30-second check also reads only what your site shows from the outside, so it can't see inside the server. If you get "Needs checking" or "Needs action," also do the self-check in "A back door left on your site?" alongside the fix (English edition coming soon).
Jeensuk's takeThis check is a map, not the destination. But with a map, where to go next becomes clear.
Frequently asked questions about whether PHP2Shell affects you
If my site isn't WordPress, am I unaffected?
Not necessarily. CISA says the flaws affect all PHP installations serving web requests, so other PHP-based software needs checking too.
I'm on managed hosting. Is there anything to do?
Often not. Many hosts, including Hostinger and Kinsta, patched for their customers. Read your host's notice to confirm, and if you're on an old, unsupported PHP version, plan a move to 8.3 or newer.
Does "Needs checking" mean I'm at risk?
No. It means it's not known yet. Your host's notice and your developer's answer usually turn it into "Not affected" or "Needs action."
SOURCES
- CISA, "Critical Vulnerabilities in PHP Require Immediate Patching" (Oct 21, 2026; revised Oct 23) cisa.gov
- PHP Group, "Security advisory: Critical remote code execution vulnerabilities, update now" (Oct 21, 2026) php.net
- W3Techs, "Usage statistics of PHP" (Oct 24, 2026) w3techs.com
- Bitsight, "CVE-2026-109618 and CVE-2026-109619 (PHP2Shell): Two Critical PHP Remote Code Execution Flaws" (Oct 21, 2026) bitsight.com
- Security Boulevard, "Survey Surfaces Myriad Small Business Security Challenges" (Coalition / Wakefield Research survey, Jul 7, 2025) securityboulevard.com
- WordPress.org, "Requirements" (updated May 7, 2026) wordpress.org
- Hostinger, "Hostinger deploys protections against php2shell PHP vulnerabilities" (Oct 21, 2026; updated Oct 23) hostinger.com
- Kinsta, "PHP2Shell: How Kinsta protected WordPress sites" (Oct 23, 2026) kinsta.com
- Reclaim Hosting, "Reclaim Cloud and PHP2Shell" (Oct 22, 2026) reclaimhosting.com
- Google Cloud (Mandiant), "M-Trends 2026: Data, Insights, and Strategies From the Frontlines" (Mar 24, 2026) cloud.google.com
Once you know whether you're affected, the next steps continue here. More English editions are on the way.
- Is your business website affected? A one-minute PHP check (this article)
- PHP vulnerability fix guide: from checking to moving off PHP (coming soon)
- Where to check and change your PHP version, host by host (coming soon)
- A back door left on your site? A web shell self-check (coming soon)
To understand what happened, read risk series part 1, "What is PHP2Shell?" More articles on the ATATAKAI Digital blog.
Stuck on a question? It takes 30 seconds.
Enter your site address and we'll check it against the same criteria: whether it runs on PHP and where your host stands. If you're not affected, we'll say so plainly: "No need to move right now."
Run the free 30-second checkWant to talk it through after you see the result? Contact ATATAKAI Digital
Updated Oct 26, 2026
