Does PHP2Shell put your business website at risk?

On Google today, the homepage of a school group in Portugal has a new title: "LIGA367 : Info Bocoran Link Slot Gacor 2026". It's an ad for an Indonesian slot casino. I found it on 22/10/2026 while looking at what happens to websites nobody looks after, the week PHP2Shell sent business owners asking whether their own site is next. PHP2Shell is the name for two serious flaws in PHP, the software under most websites, including every WordPress site, fixed on 21/10/2026. Nobody has tied the school's page to PHP2Shell. It shows what an unwatched website turns into, and this flaw is one more way in. If your site runs on PHP and nobody keeps it updated, it is at risk.

TL;DR: PHP2Shell puts your website at risk if it runs PHP and nobody updates it. About a third of PHP websites run versions PHP no longer fixes. Hacked sites often end up selling casino links their owners never see: I found 71 such pages on seven Portuguese public websites today. Get your PHP version in writing and check Google monthly.

Is my business website affected by PHP2Shell?

Any website that runs on PHP stays exposed to PHP2Shell until its PHP is updated to a fixed version. PHP runs 69.3% of the websites whose server software is known, according to W3Techs, which surveys the software websites run on. WordPress, Joomla and Drupal all run on it. The two flaws, CVE-2026-109618 and CVE-2026-109619 in the PHP security advisory (opens in a new tab), let someone take control of the server over the internet with no password, even when the website's own code is fine.

The PHP project released the fixes on 21/10/2026, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Version 8.1 and anything older gets no fix from the PHP project. W3Techs counts 27.0% of PHP websites still on PHP 7 and 7.7% on PHP 5, about a third of them, before you add 8.0 and 8.1. Some Linux distributions and hosting companies patch older versions themselves, which is why the answer has to come from whoever runs your server.

Updating WordPress, your theme or your plugins doesn't fix it, because the flaw sits in PHP underneath them. A site that loads normally tells you nothing about which PHP it runs on. So far, the reports are of attacks being tried: security firms such as Recorded Future describe attackers probing websites, and as of the afternoon of 21/10 no break-in had been confirmed.

What to do about PHP2Shell this week

Get one answer in writing from whoever looks after your website, whether that's your hosting company or the person who built it. If that person has moved on, start with the hosting company you pay every month: it can see which PHP your site runs. Send them this:

“

Which PHP version, with the full number, is my site running, and has this week's PHP2Shell fix been applied and PHP restarted?

Ask for the full number because a reply that just says "8.3" could still be the unpatched 8.3.35. Ask about the restart because the server keeps running the old version until it happens. If your site runs on WordPress, you can see the version yourself: in the admin area, open Tools, then Site Health, then Info, then Server.

If the answer is 8.1 or older and your host doesn't patch it, the site has to move to PHP 8.2 or newer, and old plugins can break on the way, so ask for a full backup first. If nobody can update it at all, the US National Security Agency's advice on 21/10 (opens in a new tab) was to take the site offline until someone can. In Portugal, CNCS, the national cybersecurity centre, published an alert on the same flaws (opens in a new tab).

What happens to a website nobody looks after?

When a business website gets broken into, it usually ends up serving someone else's business. Sucuri, a website security company, wrote in 2025 that online casino spam had become the most common kind of search spam it finds on hacked sites. It found gambling spam on 87,201 sites in 2023, up 200% on the year before, and 39.1% of the hacked sites it cleaned were running out-of-date software when they were broken into. Asked why small sites get picked, Sucuri answers: "Attackers don't care what your site is about." They borrow its age and its standing in Google.

I've been building for the web since 2014, and I wanted to see what that looks like close to home. On 22/10/2026 I searched Google for three phrases this spam uses, limited to Portuguese government websites, and ran the same searches three times. One of them, "slot gacor", is Indonesian slang for slot games that pay out easily. The searches found 71 pages of casino spam (70 on one run) on seven websites belonging to five public bodies. How each one got there, I don't know. The result that surprised me most was Portugal's National Library, with 53 gambling pages sitting in its First World War archive. Here's what the search showed, body by body:

• A school group's homepage, whose title on Google is now a slot casino.
• 53 gambling pages and PDFs inside the National Library's First World War archive.
• A regional employment institute's homepage, with a list of slot-site links in its text.
• A regional education project's WordPress site, with casino links in the footer of every page.
• A public survey with the spam in its answers, which is probably an open form nobody watches rather than a break-in.

Why can't you see it when your website is hacked?

The owner usually can't see it because the spam is aimed at Google and at people who arrive from a search. Sucuri describes injected links as "typically only visible to search engines", and redirects that send visitors from a Google result to a spam page. When you type your own address and open the homepage, everything looks the way it always did.

An education company in India learned this on Google's help forum in November 2025. Google showed their site with Thai gambling titles. They had cleaned the server, reset every password and updated WordPress, and their own visitors saw a clean site, yet a Google product expert who checked found the server still sending the gambling version to Google alone.

You usually hear about it from Google. It can label your result "This site may be hacked", and Google Ads disapproves ads that lead to a compromised site, which its policy describes as one that redirects visitors or runs software with known security holes that has been exploited. Once the site is clean, Sucuri says a full recovery in Google's rankings often takes 2 to 8 weeks. Sucuri also found a hidden way back in, a back door, on 49.21% of the hacked sites it cleaned, and warns that deleting the spam you can see without closing it gets the site reinfected within days.

How to check your website every month

The search that found the school group is one any owner can run on their own site in a minute. This is the monthly check I'd put on any website a business depends on:

1. Name one person who updates it, in writing: PHP, WordPress, the theme and the plugins. If that's your hosting company, ask exactly which of those it covers.
2. Search Google for your own site with the words this spam uses. Type site:yourdomain.com casino, then the same with slot and with viagra. Pages you didn't write mean a call to that person the same day.
3. Add your site to Google Search Console, which is free, and turn on email alerts. Its Security issues report is where Google tells you it found a problem.
4. Open the list of admin users and remove anyone you don't recognise. On 55.2% of the sites Sucuri cleaned with malware in their database, attackers had added an admin account of their own.
5. Keep a recent backup somewhere other than the website's own server.

What I'd tell a business owner this week

The PHP2Shell fix is out, and the sites that stay exposed are the ones nobody owns, built once and then left alone. That's how a school group's homepage can carry a slot casino's name on Google with no one noticing.

If you'd rather have someone do it, upkeep is included in every plan at SharpHaw (opens in a new tab), my studio. If you have a question about your own site, ask me on gabs.app, and for more on how I build and look after websites, follow me on X (opens in a new tab) or read more posts on gabs.app.