Your Website Looks Fine. That Does Not Tell You It Is Patched.
On October 21, 2026, cybersecurity experts started warning website owners about two critical vulnerabilities in PHP, one of the most widely used technologies on the web. Researchers at the security company Wiz found them with the help of AI, and the issues are now known as PHP2Shell.
If you run a small business, headlines like that usually land in one of two ways. Either “this has nothing to do with me”, or “70% of websites are at risk, so mine is probably hacked.” Neither is right, so here is the calmer version.
What actually happened
PHP runs on the server behind a very large number of websites, including sites built with WordPress. According to the research, the vulnerabilities could let attackers gain unauthorized access to an affected server, steal sensitive information or change website content.
Two details made the story spread. Some of these weaknesses had existed for more than a decade before researchers showed how they could be exploited. And AI helped the researchers find and demonstrate them much faster than before.
About that 70% number
PHP is used by roughly 70% of websites whose server-side language is known. That is where the scary figure comes from.
It does not mean 70% of websites have been hacked. It does not even mean every PHP website will be attacked. The real risk depends on three things: which PHP version the site runs, how the server is configured, and whether the security updates have already been installed.
Why “it works” is not an answer
Most owners judge their site by opening it. The homepage loads, the contact form sends, so everything must be fine.
Get PanWebsites’s stories in your inbox
Join Medium for free to get updates from this writer.
The uncomfortable part is that a website can look and work perfectly while still running a vulnerable version of something underneath. Some attacks also go unnoticed while the site keeps working normally. You will not see a missing patch by scrolling through your own pages.
If something did go wrong on a vulnerable server, the possible consequences for a business are very practical: the site could stop working, information stored on the site or server could be exposed, content could be changed without your permission, and normal operations could be disrupted. These are possibilities, not proof that any given site has been hit.
The one question worth asking this week
The good news is that PHP has already released security fixes. So you do not need to learn programming. You need to send one message to whoever looks after your website, your developer, agency or hosting provider:
“Does our website use an affected version of PHP, and have the security updates been installed?”
If nobody can answer that, the real issue is bigger than PHP2Shell. It means no one is clearly responsible for the security of a tool your business depends on.
A note on where we stand
I should be transparent here: I am part of PanWebsites, a small web development team, and we wrote up this news on our site for our own clients. The websites we build with technologies like Next.js and Astro, without relying on PHP, are not affected by these specific PHP2Shell vulnerabilities, and we have told our clients so.
That is not a claim that any technology is immune. No website is protected from every possible threat. Every stack, ours included, needs maintenance and ongoing attention to security. Which is exactly why I think responsibility for a website should not end on the day it goes live.
If you want the short FAQ version and the original sources (Wiz Research, the official PHP security announcement and W3Techs), it is here: https://panwebsites.com/en/newspaper/ai-discovers-a-major-security-threat-affecting-millions-of-websites-is-yours-at
Disclosure: I work at PanWebsites (panwebsites.com). This story was written with AI assistance and reviewed by a person.
