PHP2Shell: Is your business website affected, and what should you do?

By Alex Beeston, founder of Amplify. Information checked on 22 October 2026.

A website security headline can leave you with a surprisingly basic problem: you do not know whether it applies to you. You know who designed your website. You may know where it is hosted. But the software running underneath it is probably something you have rarely needed to think about.

The PHP2Shell news has brought that question into focus. Here is what business owners need to understand, what to do next, and where a move to a managed platform such as Webflow could fit.

What is the PHP2Shell vulnerability?

PHP2Shell is the name associated with two critical security vulnerabilities in PHP, a programming language used to run websites and applications. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Under certain conditions, they can allow an attacker to run code on an affected server without logging in.

PHP released fixes on 21 October 2026. Its official security advisory identifies PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as fixed releases and urges users to update immediately. Some hosting and operating-system vendors supply equivalent fixes within their own packages, so confirmation from your provider matters more than guessing from a version number.

Is my WordPress website affected?

WordPress uses PHP, as do Drupal and Joomla. A website on one of these platforms therefore needs its hosting checked. That does not mean every website remains vulnerable today, or that yours has been hacked. Its current exposure depends on the underlying installation and whether the relevant fixes have been applied.

Automattic has confirmed protection for sites hosted on WordPress.com, WordPress VIP, WP Cloud, Pressable and Tumblr. A WordPress website hosted elsewhere needs confirmation from that provider.

Updating WordPress, a theme or a plugin does not, by itself, patch PHP. These are different layers of software. A message saying your WordPress installation is up to date does not answer the PHP2Shell question.

If you do not know what your website runs on, contact the person who manages its hosting. A site that looks and works normally is not proof that the underlying software is protected.

What should website owners do now?

Start with whoever is responsible for your hosting and maintenance. Ask for a specific answer about these vulnerabilities, rather than a general reassurance that security is taken seriously.

The NCSC advises organisations to identify PHP systems and apply the security update. Where updating is not immediately possible, it points to temporary mitigations; if these cannot be applied promptly, it advises considering taking the system offline. Temporary measures are not equivalent to a complete fix. Suspected compromise should be investigated by the hosting provider or an appropriate incident-response specialist.

Questions you can send to your hosting provider

Keep the response. It gives you a record of what has been checked and who is responsible for the next step. If the answer is unclear, ask your developer to help you interpret it.

Is Webflow affected by PHP2Shell?

Webflow says its core services are not built on PHP and are not affected by these vulnerabilities. Its PHP2SHELL security statement says no action is required from customers. It also notes that its security team is assessing non-production systems that use PHP.

That statement covers Webflow's own services. If your Webflow website connects to a separately hosted PHP application, such as a customer portal or booking service, check that service with its provider too.

Should you move from WordPress to Webflow?

A security incident is a reason to review your website's setup. The decision to rebuild should depend on what you need the site to do, how well it currently does it, and the effort involved in keeping it running.

If you have a capable provider, prompt updates and a website that serves the business well, improving or retaining that arrangement may be sensible. Managed WordPress hosting can also remove much of the day-to-day responsibility from the owner.

The case for Webflow becomes stronger when maintenance is one of several frustrations: changes are awkward, the design feels dated, the message has fallen behind the business, and nobody seems to own the technical details.

For a consultancy, design practice or specialist service business, the website may mainly need to explain the offer, present projects, publish insights and generate enquiries. My view is that this is where a carefully planned Webflow website can be a particularly good fit.

What changes with a managed platform?

Webflow manages its hosting infrastructure and security patches. With a standard Webflow-hosted website, you are not responsible for maintaining your own PHP installation. Depending on your requirements, you may also be able to replace a collection of separate plugins with built-in functionality.

The practical benefit is less routine technical administration. Time that went into checking updates or coordinating suppliers can go into improving the website's content and usefulness.

There are still responsibilities: account access, permissions, custom scripts and external integrations need care. There are also platform costs and constraints. Complex ecommerce, membership services or bespoke application logic need a proper suitability assessment before a move is recommended.

Three questions worth asking before a rebuild

• What does the website actually need to do? List the features people use, including anything that connects to your wider business systems.
• What is the current setup costing you? Include hosting, licences, support, staff time and the disruption of changes that become unnecessarily difficult.
• What would a new website improve? Look at the clarity of the offer, quality of the enquiries, ease of publishing and confidence in the underlying setup.

Those answers make the decision more useful than a blanket comparison between platforms. A website should earn its place through what it does for the business.

What does a WordPress-to-Webflow migration involve?

Moving platforms is a website project that needs planning. Before design begins, establish which pages, content, search visibility and functionality must be carried forward.

I would start with an inventory of the existing site: important URLs, useful articles, forms, integrations and the pages that currently bring in visitors or enquiries. Then decide what to retain, improve or retire.

The migration plan should cover:

• rebuilding the necessary pages and CMS content;
• preserving useful URLs where practical and mapping redirects where they change;
• carrying across appropriate metadata and checking indexing settings;
• testing forms, integrations, mobile layouts and analytics;
• planning the domain switch and checking the site after launch;
• retiring the old installation securely once it is no longer needed.

If the old site may have been compromised, that needs investigation before anything is reused. A redesigned front end does not resolve an incident on a server left running elsewhere.

For a fuller explanation of suitability, costs, content and SEO, read my WordPress-to-Webflow migration guide for business owners. It will help you decide whether moving platforms would solve the right problems.

If you are starting to scope a project, my website redesign brief will help you capture the requirements. You can also read more about my approach to bespoke Webflow website design.

A clearer next step for your website

Get the immediate PHP2Shell question answered by your hosting provider. Then consider how much confidence you have in the wider arrangement.

If this incident has highlighted a website that is already difficult to maintain or no longer reflects the business, it is a reasonable time to plan a change. That change should give you a clearer message, a more useful website and a manageable technical setup.

I work with established businesses in Oxfordshire and across the UK on website strategy, messaging and bespoke Webflow design. Send me your website address and a little about what you want to improve, and we can discuss whether moving to Webflow makes sense for you.

Sources checked on 22 October 2026: PHP security advisory, NCSC guidance, Automattic's hosting update, Webflow Trust Center and Webflow hosting documentation. Check those sources for subsequent developments.