23/10/2026
If your business has a website, a quick one worth five minutes today.
PHP, the software behind a huge number of websites, had a serious security flaw patched on 21 October. It lets an attacker take control of a web server without needing a password. Attacks are already being tried.
You don't need to understand the technical detail. You need three answers:
• Does our website run on PHP? (Most do, including WordPress sites.)
• Has our host or developer applied the 21 October fix?
• Is anything else we rely on, like an old booking tool or intranet, running PHP that nobody looks after?
Updating WordPress doesn't fix this one. The fix comes from your host or server. Full details here: https://devpanda.co.nz/insights/php2shell-php-vulnerability-2026?utm_source=facebook&utm_medium=social&utm_campaign=insight_php2shell_php_vulnerability_2026&utm_content=facebook_post_checklist&utm_term=php-patching
If you can't get a straight answer from whoever looks after your site, send us a message. We'll help you find out where you stand.