Does the PHP Security Vulnerability Affect My Website?
Updated: 23 October 2026
A few of my clients have contacted me about the PHP security vulnerability currently in the news. They wanted to know whether their website was affected and whether they needed to do anything.
If you’ve been wondering the same, here is what you should know. The answer depends on how your website is built, where it is hosted and which services are connected to it.
What is the PHP security vulnerability?
PHP is a programming language used to run WordPress and many other websites. On 21 October 2026, the PHP project released fixes for two serious security flaws, commonly called PHP2Shell. These flaws can allow attackers to run unauthorised code on an affected server.
The fixes are available. If your website uses PHP, the priority is to confirm that the server running it has been updated.
Which websites need a PHP update?
Your website | What you need to do |
WordPress or WooCommerce | Ask your hosting provider to confirm that the PHP security fixes have been applied. |
Wix or Wix Studio | There is no PHP update for you to install within Wix. |
Hosted on Webflow | Webflow has confirmed that its core services are unaffected and no customer action is required. |
Standard Shopify-hosted store | Shopify manages the hosting and platform updates. There is no PHP update to install in your Shopify admin. |
Apps, custom integrations and services hosted elsewhere need to be considered separately. I explain those below.
Is my WordPress or WooCommerce website affected?
If you use WordPress, contact your hosting provider and ask whether the PHP fixes have been applied to your website’s server. This also applies to WooCommerce stores.
Your host may already have done the work. WordPress’s official notice recommends checking with them and arranging a PHP update promptly if one is still needed.
You can see your PHP version in your WordPress dashboard under Tools > Site Health > Info > Server. Your host can confirm whether that installation includes the fixes.
When contacting them, ask about CVE-2026-109618 and CVE-2026-109619. These are the reference numbers for the two vulnerabilities, so they help identify exactly which update you mean.
Will updating WordPress or my plugins fix it?
Updating WordPress, a theme or a plugin does not update the PHP software on your server. For this particular issue, your host or server administrator needs to apply the PHP fix.
Keep your usual WordPress updates going, but check the server update separately.
Does Wix use PHP?
Wix does not support PHP in your site’s own code. Its Velo development environment uses JavaScript, with backend code running on Node.js.
There is no PHP update for you to install within Wix or Wix Studio in response to this alert. Wix handles its platform infrastructure.
Is Webflow affected by PHP2Shell?
Webflow has addressed this directly in its Trust Center. It says its core services are not built on PHP and are unaffected. No action is required from customers, while Webflow checks its separate internal systems that use PHP.
If your site was built in Webflow but exported and hosted elsewhere, ask your hosting provider about that setup.
Does my Shopify store need a PHP update?
For a standard Shopify-hosted store, Shopify provides the hosting and manages platform updates. There is no PHP installation for you to update through your Shopify admin.
Could a booking tool, app or other integration be affected?
Yes, if it runs on a vulnerable PHP installation. An external booking tool, customer portal or inventory system may be hosted separately from your website. Some Shopify apps are also hosted by their developers.
Ask the provider whether its service was affected and whether the necessary fixes have been applied. If you are unsure what is connected to your website, your developer can help you identify what needs checking.
Should I take my website offline?
If your host confirms that your website runs vulnerable PHP and cannot be patched promptly, contact them immediately about restricting access or taking the affected service offline until it is fixed. This follows CERT-EU’s guidance.
For websites on managed platforms, follow the provider’s advice for that service.
Who should look after my website’s updates?
A website can be built by one company, hosted by another and maintained by someone else. Check who handles the server, website software and custom integrations, and who you should contact when something urgent comes up.
If you have a maintenance agreement, ask what it covers. An agreement for content edits, for example, may not include server updates or custom apps.
Need help with your website?
If you’re unsure what needs checking on your website, you are welcome to contact us. We can help you find out where the update needs to be handled and arrange the work with your hosting or service provider where needed.
At Boccholie Design, we work with Wix, Wix Studio, WordPress, Webflow, Shopify and custom applications. You can contact us about this issue, other website updates or ongoing maintenance.
Email me at minna@boccholie.com with your website address and a few words about what you need help with. We can take it from there.
Comments