The Message to Send Your Web Host

01 Why this is your host's fix

PHP is the code your website runs on. If your website is a shop, PHP is the floor it stands on: WordPress, Drupal, Joomla and a lot of online stores sit on it. On October 21, 2026, PHP shipped an emergency fix for two flaws, now called PHP2Shell, and its own advisory says updating is the only safe choice.

Wiz, Google's security team, says an attacker could take control of the computer that runs your website without a password, and steal the passwords and logins stored on it. Wiz showed it working on WordPress, Drupal and Joomla.

Updating WordPress doesn't touch this. Neither do your plugins. The fix lives on the server, with your host, the company that keeps your website running.

Many big hosts patched fast. Hostinger, for example, says its customers don't need to do anything. That's good, and it's still the host's word. The sites at risk are the forgotten ones, and the ones on old versions of PHP.

02 The message to send

Copy this, fill in your site, and send it to your host's support (a ticket, the chat, or the email on your invoice).

To my web host

Hi, I'm checking on the PHP2Shell flaw for my site [YOUR DOMAIN].

1. Which version of PHP is my site on, and does it have the October 21, 2026 fix? (The patched versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or a version you patched yourselves. If you fixed an older number without renaming it, please confirm the fix in writing.)

2. If my site is on PHP 8.1 or older, how is it protected today, and when do we move it to a supported version?

3. Was my site open to attack before you fixed it, and should I change any passwords or logins?

Thank you,
[YOUR NAME]

03 What each answer means

If they say It means Your next step

8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer Your PHP has the fix Ask question 3, then you're done

An older number, "but we patched it" Some hosts fix an old version without renaming it Ask them to confirm the fix in writing

8.1 or older The PHP project isn't fixing it at all Moving your site is the real fix: ask for a date

"We'll look into it" No clear answer That tells you something about your host

On question 3: attackers were already trying this before the fix existed, Amazon says, with the first attempt on October 17. Changing a password is cheap. Finding out later that someone had it is not.

04 Find your PHP version yourself

On a WordPress site, you can read the number before you write. In your WordPress dashboard, go to Tools, then Site Health, then the Info tab, and open Server. The line "PHP version" shows it.

How to read it. The first two numbers are the version, the last one is the fix level. 8.3.36 is version 8.3 with the fix; a lower last number on 8.3 means no fix, unless your host patched it themselves. The cut-off. 8.1 or older gets no fix from the PHP project. One security firm, VulnCheck, counts more than a million servers on versions like that. Didn't build the site yourself? Forward this page to whoever did, or straight to your host.

Send the message to your host. The three questions above, with your domain filled in.

Check the version they give you. 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer, or the fix confirmed in writing.

Get a move date if you're on 8.1 or older. No fix is coming for those versions.

Change passwords if they can't rule it out. The website's admin logins first.

Sources

PHP: News Archive 2026 (the October 21 security release) Wiz: PHP2Shell, AI uncovers critical RCE vulnerabilities SecurityWeek: PHP2Shell exploitation started days before patches Hostinger on X WordPress on X Wikipedia: PHP2Shell

Mathew's LibraryLibrary card

Free access

Keep reading free with your library card

One email opens this template and all 86 resources in Mathew's library. No account, no password.