PHP2Shell: what the PHP flaw means for WordPress sites in Malaysia

On 21 October 2026, the PHP team shipped emergency fixes for two critical flaws now known as PHP2Shell. The flaws are in PHP, the language WordPress runs on. An attacker who knows nothing about your site can send it a crafted request and run their own code on your server.

Attacks started before the fix was out. If your firm's website runs on WordPress, you can't fix PHP2Shell from the WordPress dashboard. This guide covers what happened, what to check this week, and why your website may not need to run on PHP at all.

1. What PHP2Shell is

PHP2Shell is two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10 for severity. Security researchers reported them to the PHP team privately. The fix was due on 22 October, and the PHP team brought it forward a day after the CVE numbers leaked.

Exploitation began earlier still. Amazon's threat intelligence team recorded an attempt on 17 October, four days before disclosure. More attempts from several different groups followed within hours of the release.

Both flaws can be triggered by ordinary web requests, including form uploads. One of them goes through session upload progress, a PHP feature that is on by default. Once an attacker gets in, they can plant backdoors, add spam pages, set up hidden redirects, install card skimmers or take data from your server.

The exposure is huge. PHP runs almost 70% of websites whose server language is known, according to W3Techs figures cited by Cybernews. WordPress, Drupal, Joomla and Magento all depend on it.

2. Why WordPress updates and security plugins can't fix PHP2Shell

PHP2Shell sits underneath WordPress. On servers running Apache with mod_php, the exploit runs before WordPress even loads. A security plugin never sees the attack.

Updating WordPress, your theme or your plugins won't help either. The only fix is a new PHP version on the server: 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

On shared or managed hosting, only your host can install it. That means your site's security depends on your host's patching schedule. Some hosts confirmed the fix the same day. A day later, others were still rolling it out.

Older sites are in a worse position. PHP 7.4 to 8.1 get only minimal source patches, which help only if your host builds and installs them. PHP 7.3 and older get no fix at all. PHP 8.2 itself stops receiving security fixes on 31 December 2026.

Many Malaysian firm websites were built once, put on low-cost shared hosting and then left alone. A site like that is often still on one of these unsupported versions. Our guide to web hosting options in Malaysia explains what you get at each level of hosting.

3. PHP2Shell is the second WordPress takeover flaw in three months

In July 2026, researchers disclosed WP2Shell. It was a pair of flaws in WordPress core that, chained together, let an anonymous attacker take over a site. It worked on a stock install with no plugins. Versions 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1 were affected.

Public exploits came out within days, and security firms confirmed attacks in the wild. WordPress pushed forced updates to affected sites.

The two flaws had different causes but show the same weakness. A self-hosted WordPress site has five layers: the server, PHP, WordPress core, the theme and the plugins. Each layer has its own release cycle, and someone has to apply every update. A Censys study cited by Cybernews found that only 14% of publicly visible WordPress sites were on the latest security patch.

For most firms, nobody owns that job. The freelancer who built the site moved on, the host patches when it chooses to, and the marketing team assumes someone else is handling it.

4. What a hacked website costs a Malaysian firm

Since 1 June 2025, the amended Personal Data Protection Act has required organisations to notify the Commissioner within 72 hours of a personal data breach. They must also notify affected individuals within seven days if there is a risk of significant harm, as China Briefing summarises.

Your website forms collect names, emails and phone numbers. Some collect IC numbers or financial details. If the server behind those forms is compromised, the breach is yours to report.

Credibility takes the next hit. Prospects research a law firm, accounting practice or fund before they make contact. If your site redirects to spam or shows Google's "This site may be hacked" label, the prospect leaves and you never hear about it.

5. Why Webflow sites sit outside this problem

A Webflow site has no PHP layer for you to patch and no plugins to keep updated. Webflow runs the hosting and states that patches and updates are automated, with no customer maintenance.

Every Webflow-hosted site gets TLS 1.2 or higher, HSTS by default, and a global CDN with DDoS protection and rate limiting. Webflow holds SOC 2 Type II and ISO 27001 certification.

No platform is immune to every threat, Webflow included. Moving to Webflow shifts server and platform security from your host and your freelancer to a dedicated security team that is audited against international standards.

Two things stay with you: who has access to your Webflow account, and which third-party scripts you add to the site. Turn on two-factor authentication and keep the script list short. Our checklist on how to create a secure website covers the rest.

6. Webflow keeps your site current without upgrade projects

On WordPress, keeping up with PHP is ongoing work. Each PHP version gets a fixed support window. When it ends, the site has to move to a newer version, and the theme and every plugin have to be tested for compatibility. Plugins that are no longer maintained often break at this step.

That's why so many sites stay on old PHP. The upgrade costs time and carries risk, so it keeps getting pushed back until a flaw like PHP2Shell forces it.

On Webflow, platform updates roll out without your team planning a migration. New features show up in the same project. Your design, CMS content and SEO settings stay where they are.

You also keep a way out. Webflow lets you export your site's code and your CMS content if you ever need to move. For a side-by-side view of the two platforms, read Webflow vs WordPress for professional services firms.

7. What to do about PHP2Shell this week

Even if you plan to migrate, your current WordPress site needs attention now. Work through this list:

• Check your PHP version. In WordPress, go to Tools > Site Health > Info > Server.
• Ask your host in writing whether the PHP2Shell fix is installed, and quote both CVE numbers. Some Linux distributions patch without changing the version number, so the number alone won't tell you.
• Plan an upgrade if you're on PHP 8.1 or older. Back up the site first.
• Look for signs of compromise. Check for unknown admin accounts, plugins you didn't install, and .php files inside wp-content/uploads. Search Google for site:yourdomain.com and look for pages you didn't create.
• If you find anything, ask your host to scan the server and restore a backup from before the incident, then change every password.

Moving your website off PHP

PHP isn't going away, and plenty of software runs well on it. A firm's marketing website doesn't need it, though. That site exists to win trust before the first meeting, and a self-managed PHP server adds risk without helping it do that.

Two takeover flaws in three months show how much maintenance a WordPress site needs. For a Malaysian firm handling client data under the amended PDPA, that maintenance has to happen on time, every time.

Moving to Webflow takes that job off your team. A planned WordPress to Webflow migration keeps your URLs, sets up 301 redirects and carries over your titles and meta descriptions, so your rankings come with you.

FAQ: PHP2Shell and your website

Is my WordPress site at risk from PHP2Shell?

If your server's PHP hasn't been updated since 21 October 2026, assume it is. PHP2Shell affects every common way PHP serves web pages, including PHP-FPM, Apache with mod_php and LiteSpeed. Ask your host whether the fixed version is installed.

Will a WordPress security plugin protect my site?

No. The attack happens inside PHP, before WordPress and its plugins load. A firewall in front of the site, such as Cloudflare, can reduce exposure while you wait for your host, but only the PHP update fixes the flaw.

Do Webflow site owners need to do anything about PHP2Shell?

No. Webflow site owners don't run or patch PHP. Webflow manages the hosting and applies platform patches itself, so there is nothing for your team to update.

Will moving from WordPress to Webflow hurt our Google rankings?

Not if the move is planned. Every existing URL is mapped, 301 redirects are set up, and titles and meta descriptions are carried over before launch.