Hackers Could Already Be Inside Your Website And You Wouldn’t Even Know It

A major cybersecurity threat is raising alarms worldwide after researchers uncovered two critical security flaws that could allow hackers to take control of vulnerable websites without knowing a single password.

The vulnerabilities, collectively known as PHP2Shell, affect PHP, a programming language used to power millions of websites, including those built with WordPress, Drupal, and Joomla.

Emergency security updates were released on October 21, 2026, after researchers demonstrated that attackers could exploit the flaws to execute unauthorized commands on vulnerable servers.

Also Read

Two New Orleans Men Arrested On Child Sexual Abuse Material Charges In Separate Investigations

Both vulnerabilities received a critical security rating of 9.2 out of 10.

And perhaps most concerning, attackers have already been observed attempting to exploit the weaknesses.

What’s Actually Happening?

Normally, hackers trying to access a website might attempt to steal passwords, exploit a vulnerable plugin, or trick an administrator into providing access.

These vulnerabilities create a different problem.

They affect the underlying PHP software responsible for processing website requests.

By sending specially crafted requests to a vulnerable server, an attacker could potentially manipulate how PHP handles memory and errors, allowing unauthorized code to execute.

In certain configurations, this could happen before the website’s normal security checks are even reached.

That means a hacker might not need an administrator’s username, password, or two-factor authentication code.

A successful attack could potentially allow criminals to steal information, modify website files, install malicious software, redirect visitors, or use the compromised server for additional attacks.

The website might continue operating normally while unauthorized activity takes place behind the scenes.

However, a vulnerable website is not necessarily a compromised website. The actual risk depends on its PHP version, server configuration, and whether the security patches have been installed.

Security Researchers Report Active Attacks

Amazon’s threat intelligence researchers identified exploitation attempts dating back to October 17, several days before the official security updates became available.

Cybersecurity firm watchTowr also reported observing exploitation activity through its global monitoring network.

The discoveries prompted emergency responses from security companies and government cybersecurity organizations.

Some organizations temporarily took websites and online services offline while investigating their exposure and applying protective updates.

The reported attack activity does not establish that every targeted website was successfully compromised, but it demonstrates the urgency of installing the fixes.

Why This Matters To Small Businesses

This isn’t just a problem for major corporations.

Local businesses, contractors, restaurants, churches, nonprofits, and independent news organizations frequently depend on PHP-based websites.

A business owner might have a professionally designed website, strong passwords, and updated WordPress plugins while still running a vulnerable version of PHP on the server.

Because PHP operates behind the scenes, many website owners have no idea which version their hosting company uses.

And simply updating WordPress or changing passwords will not fix these particular vulnerabilities.

How To Check Whether Your Website Is At Risk

The first step is determining whether your website uses PHP.

If your website runs on WordPress, Drupal, Joomla, or another PHP-based system, contact your hosting provider or check your hosting control panel.

WordPress administrators can often find PHP version information under Tools, then Site Health, then Info, under the Server section.

However, the displayed version may not reveal whether a hosting provider has applied a special security patch to an older version.

The PHP development team released fixes in the following versions.

PHP 8.2.35
PHP 8.3.36
PHP 8.4.27
PHP 8.5.12

Newer patched versions are also acceptable.

Older PHP versions, including PHP 8.1 and earlier, are no longer supported directly by the PHP project. Some operating system vendors provide separate security patches for older packages.

If you are unsure whether your website is protected, ask your hosting provider to confirm that both CVE-2026-109618 and CVE-2026-109619 have been addressed.

How To Protect Your Website Right Now

1. Contact Your Hosting Company

Ask whether your website is running a patched PHP version and whether the hosting provider has applied the October 21 security updates.

If your hosting company manages PHP automatically, it may already have deployed the necessary fixes.

Do not assume that automatic WordPress updates also update PHP.

2. Update PHP Immediately

If your server uses an affected PHP version, arrange to install the corrected release or an officially supported vendor patch.

Back up the website and database before making major server changes.

After the update, the hosting provider should restart the affected PHP services and verify that the patched software is actually serving website requests.

This is the most important protective step.

3. Check For Signs Of Unauthorized Activity

Installing an update prevents future exploitation of the corrected vulnerabilities, but it does not automatically remove malicious software that may already be present.

Website administrators should review security logs, unfamiliar administrator accounts, unexpected file changes, suspicious redirects, and unusual server activity.

A website that looks normal to visitors is not proof that it has never been compromised.

4. Keep Backups Of Your Website

Maintain reliable backups of your website files and database.

Ideally, backups should be stored separately from the website’s hosting environment.

A clean backup can help restore a website if files are damaged, deleted, or altered by an attacker.

5. Use Additional Security Protections

Website firewalls, security monitoring, limited administrative access, and multifactor authentication provide additional layers of protection.

Companies such as Cloudflare and Amazon Web Services have introduced protections designed to reduce exposure to known attack methods.

However, cybersecurity experts emphasize that firewall rules are temporary safeguards, not substitutes for installing the PHP security updates.

6. Investigate Any Suspected Compromise

If you believe someone has accessed your website without authorization, contact your hosting provider or a qualified cybersecurity professional.

Preserve relevant logs and backups, investigate whether sensitive information was accessed, remove unauthorized access, and replace potentially exposed passwords and security credentials.

Simply changing passwords without investigating the underlying server may leave an attacker with continued access.

What If Your Hosting Company Hasn’t Updated PHP?

If your hosting provider cannot confirm that the vulnerabilities have been patched, request an immediate security update.

Organizations unable to patch immediately should ask their server administrator about temporary PHP configuration changes and protective firewall measures recommended by the PHP security team.

These measures can reduce certain attack opportunities, but they do not completely eliminate the vulnerabilities.

For especially sensitive systems, temporarily restricting public access may be necessary until the software can be updated.

Could Your Website Already Be Compromised?

Possibly, but there is no evidence that every website running an affected PHP version has been hacked.

The discovery of a serious vulnerability does not mean every exposed server has been successfully attacked.

What makes this incident particularly concerning is the combination of widespread software use, critical vulnerabilities, demonstrated attack methods, and reports of exploitation attempts.

For business owners, the safest approach is to verify their website’s PHP security status rather than wait for something suspicious to happen.

The bottom line is simple. Your website can appear completely normal while serious security problems exist behind the scenes.

Website owners should contact their hosting providers, confirm the emergency PHP updates have been installed, and investigate any evidence of unauthorized activity.

Waiting until a website stops working could mean discovering a security problem long after the damage has already occurred.