Your website is often the first thing a couple or a studio sees before they book you. It holds your portfolio, your contact form and, for many filmmakers, client galleries and delivery links. A server-level flaw like PHP2Shell does not care how good your films are. If the server is vulnerable, the whole site is.
What happened with PHP2Shell
On 21 October 2026, the PHP project released security updates for two critical vulnerabilities. Security researchers named them PHP2Shell. Both carry a CVSS v4 score of 9.2 out of 10, according to Rapid7’s analysis.
- CVE-2026-109618 involves memory corruption triggered by specially crafted web requests. Tanium’s analysis says it occurs while PHP parses multipart requests, the type browsers use for file uploads.
- CVE-2026-109619 involves stale data left behind between requests on the same server worker, a “use-after-free” bug in the request that follows a fatal error.
Either flaw can let an attacker run their own code on the server with a single web request, before any WordPress code even runs. The flaws affect the common ways servers run PHP: PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed. In other words, almost every shared, managed and VPS hosting setup a videographer is likely to use.
The US National Security Agency, the US Cybersecurity and Infrastructure Security Agency (CISA) and the UK’s National Cyber Security Centre (NCSC) all issued warnings. The NCSC went as far as urging organisations to take systems offline if they can’t be fixed. Amazon’s threat intelligence team reported seeing an exploitation attempt on 17 October, four days before the public announcement, as reported by Help Net Security.
Does PHP2Shell affect wedding videographers?
If your website runs on WordPress, yes, until your host installs the fixed PHP version. That includes most portfolio sites built with themes like Astra, Blocksy or Divi, and sites built with page builders like Elementor. The risk has nothing to do with your theme or plugins: it is the PHP software underneath them.
Fixed versions: PHP security release, 21 October 2026, as reported by Rapid7 and Help Net Security. PHP released limited source backports for 7.4, 8.0 and 8.1, but these versions are past end of support. Support dates: php.net, Supported Versions.
Hosted website builders such as Squarespace, Wix and Pixieset are run by the platform itself, so you can’t change their PHP versions yourself. If you use one of these, check the platform’s status page or announcements.
How widespread is the PHP2Shell risk?
The numbers explain why governments issued warnings. CybelAngel, citing Shodan counts published on 20 October 2026, found about 2.24 million internet-facing hosts advertising PHP. Of the roughly 1.5 million that showed a version number, 59% (883,717 hosts) were on versions with no official fix coming. The United States had the largest count of these hosts, at 228,770.
WordPress sites are part of that picture. The same report cites WordPress.org statistics showing 35.1% of WordPress sites on an unsupported PHP version, including 16.46% still on PHP 7.4. Censys, quoted by Tanium, counted more than 13 million internet-facing assets running PHP versions that may be affected.
These are host counts, not a list of hacked sites. One shared server can carry hundreds of websites, and some hosts quietly backport fixes. But the message is clear: an old PHP version on a small portfolio site is not unusual, and attackers scan for exactly that.
How to check your PHP version in WordPress
Log in to WordPress
Go to yourwebsite.com/wp-admin.
Open Site Health
In the left menu, click Tools, then Site Health.
Open the Info tab
Expand the section called Server.
Read the PHP version line
It shows the full number, for example 8.3.35. Compare it with the table above.
Your hosting control panel usually shows the PHP version too, but often only the main version, such as 8.3. The full number in Site Health is what tells you whether the fix is installed. It also shows the version actually serving your website, which matters: Tanium notes that after patching, the server’s PHP workers must be restarted before the new version takes effect.
How to change PHP version on common hosts
Switching to a newer PHP branch, for example from 8.1 to 8.3, is something you can usually do yourself in the control panel. Installing the patched build within a branch (8.3.35 to 8.3.36) is the host’s job. Here is where the setting lives on three popular hosting panels.
Hostinger (hPanel)
Go to Websites, click Dashboard next to your site, then open PHP Configuration in the sidebar. Pick a version and click Update. Hostinger says the change applies within a couple of minutes, applies to all websites on that hosting plan, and that versions below 8.2 are no longer available to select.
cPanel hosts
Many hosts use cPanel’s MultiPHP Manager. Tick the box next to your domain, choose a version from the PHP Version menu and click Apply. If a version isn’t listed, it isn’t installed on the server, and your host has to add it.
SiteGround (Site Tools)
Open Websites, click Site Tools, then go to Devs › PHP Manager and click the pencil icon. SiteGround’s “Managed PHP” option moves sites to newer versions automatically; if you pick a version manually, SiteGround won’t update it for you.
A safe switch, in five steps
Take a full backup
Files and database, stored somewhere other than the server.
Update plugins and theme first
Older versions are the most likely to break on newer PHP.
Switch the PHP version
Use the panel paths above.
Test the pages that earn money
Homepage, portfolio, galleries, contact and booking forms, and wp-admin.
Roll back if needed
If something breaks, switch back, note the plugin at fault, and replace or update it before trying again.
What to ask your hosting company
Only your host can update PHP on a shared or managed server. Send them a short, specific message:
- “My site reports PHP [your version]. When will you install the PHP2Shell fixes (CVE-2026-109618 and CVE-2026-109619) on my server?”
- “Are you blocking known PHP2Shell attack requests in the meantime?”
- “My site is on PHP 7.4 / 8.0 / 8.1. Can I move to PHP 8.2 or newer, and can I switch back if something breaks?”
Many managed hosts are rolling out patched builds automatically. Tanium’s 21 October snapshot listed fixed packages already available for cPanel’s EasyApache 4 and Plesk for Linux, which many hosts use. Cloudflare has also deployed firewall rules for known exploit patterns, available on all plans including free, according to Help Net Security. These help, but they are a stopgap, not a replacement for the patched PHP version.
If you run your own VPS, the job is yours. Update PHP from your distribution or panel, restart PHP-FPM or the web server, then confirm the version in Site Health. Searchlight Cyber has released an open-source php2shell-scanner that technical users can run against their own servers.
If you need to change PHP versions, take a backup first, switch, then test your homepage, galleries, contact form and wp-admin. A move from 7.4 to 8.x can break old plugins, so test before you leave it.
PHP support dates every site owner should know
PHP2Shell is a reminder that each PHP branch has an expiry date. After it, the PHP project stops publishing fixes, and the next serious flaw stays open.
Source: php.net, Supported Versions and Unsupported Branches (accessed 23 October 2026).
WordPress recommends PHP 8.3 or greater on its official requirements page. For most videographers, the sensible target is 8.3 or 8.4, tested on a backup first. That gets you through PHP2Shell and past the end of 8.2 support in one move.
What to do after the patch
- Re-check Site Health to confirm the PHP version now shows a fixed release.
- Update WordPress, themes and plugins. Patchstack found 11,334 new WordPress vulnerabilities in 2025, 91% of them in plugins.
- Look for anything you didn’t add: unknown administrator users, unfamiliar plugins, or plugins in the Must-Use list.
- Look further back than you think. CybelAngel advises checking for signs of compromise back to at least June 2026: unfamiliar PHP files, recently modified files and new admin users.
- Change admin passwords and turn on two-factor login if you see anything suspicious. Be wary of “urgent security” emails asking you to log in, as attackers often use news like this as bait. Our guide to phishing scams targeting wedding videographers shows what to watch for.
- Keep a clean backup off the server. If you ever need to restore, you want a copy from before any problem started. The same 3-2-1 backup approach you use for footage works for your website.
For the complete routine, see our website security checklist for videographers.
Common PHP2Shell mistakes on WordPress sites
- Relying on a security plugin. The flaw sits in PHP and can trigger before WordPress loads. Patchstack also found traditional hosting defences blocked only 12% of WordPress-specific exploit attacks.
- Reading only the main version number. “PHP 8.3” in your panel doesn’t tell you whether you have 8.3.36. Site Health does.
- Assuming WordPress updates fix it. Updating WordPress, themes or plugins does not change PHP. Only a server update does.
- Jumping versions without a backup. A big jump can break old gallery or booking plugins. Back up and test first.
- Forgetting old sites. Staging copies, old portfolio domains and forgotten microsites on the same hosting account need checking too.
If website upkeep keeps eating into your editing hours, it may be time to hand some of that work off. Our guide explains how to outsource wedding video editing step by step.
Common questions
Sources: Rapid7, CVE-2026-109618 and CVE-2026-109619 analysis (October 2026); Help Net Security, PHP2Shell vulnerabilities patched (21 October 2026); Tanium, PHP2Shell: Responding to CVE-2026-109618 and CVE-2026-109619 (21 October 2026); CybelAngel, 2.24M internet-facing PHP hosts, 59% on versions with no fix coming (21 October 2026); CISA, Critical vulnerabilities in PHP require immediate patching (21 October 2026); NSA advisory on PHP updates (October 2026); UK NCSC guidance on PHP2Shell (October 2026); Searchlight Cyber, php2shell-scanner (October 2026); php.net, Supported Versions and Unsupported Branches (accessed 23 October 2026); WordPress.org, Requirements (accessed 23 October 2026); Hostinger Support, How to change the PHP version of your Hostinger hosting plan; cPanel Docs, MultiPHP Manager for cPanel; SiteGround Knowledge Base, What is Managed PHP; W3Techs, usage of PHP (23 October 2026); Patchstack, State of WordPress Security in 2026. Information correct as of 23 October 2026.
