The October 2026 PHP Security Fix: What Mississippi Website Owners Should Do (in Plain English)

You may have seen headlines this week about "php2shell." Here's what it is in plain words, one simple step you can take today, and why we build websites the way we do. No panic needed, just a little homework.

Update, Oct 23

Two new developments since our first post:

• One setting to turn off for now. PHP.net now suggests turning off a setting called `session.upload_progress.enabled` until its next release. It closes an unlikely path tracked as CVE-2026-115560, and only sites with an unusual setup are exposed (php.net (opens in a new tab)).
• What the security watchers are seeing. Attackers are trying, according to Wordfence, a security vendor. It reports blocking exploit or probing attempts linked to these flaws and says it has seen no confirmed break-ins (Wordfence (opens in a new tab)).

Your to-do is the same, with one added question. Ask your host or IT person to confirm your PHP is on 8.5.12, 8.4.27, 8.3.36, or 8.2.35, and ask whether `session.upload_progress.enabled` is turned off.

What happened

On Oct 21, the PHP project released urgent updates that fix two critical security flaws in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619 (nicknamed php2shell) (php.net advisory (opens in a new tab)). PHP is the software on the web server that runs WordPress and many other websites. The same day, the US Cybersecurity and Infrastructure Security Agency (CISA) urged organizations to patch (CISA (opens in a new tab)).

Does this affect my site?

It might, if your site runs on PHP. The most common sign is WordPress, which runs on PHP (WordPress.org (opens in a new tab)). Page-builder plugins like Elementor run inside WordPress on that same PHP (WordPress.org plugin page (opens in a new tab)).

Here's the part that surprises people: the fix is a PHP update on the server, so updating WordPress alone doesn't fix it. WordPress.org says these flaws aren't specific to WordPress, and no WordPress update is required or planned for them (WordPress.org News (opens in a new tab)).

Not sure what your site runs on? Just ask whoever built or hosts it.

The one step to take today

Send your web host this question:

"Has our PHP been updated to 8.2.35, 8.3.36, 8.4.27, or 8.5.12, or to your vendor's patched package?"

Those are the fixed versions named by the PHP project. Some hosts use a Linux vendor's patched package instead, which is fine too (php.net (opens in a new tab)).

Pro tip: In WordPress, go to Tools > Site Health > Info > Server to see your PHP version for yourself (WordPress.org News (opens in a new tab)).

On PHP 8.1 or older? Ask about upgrading. The PHP project no longer updates those versions, and CISA advises taking systems on unsupported versions offline until they can be updated (php.net (opens in a new tab); CISA (opens in a new tab)).

The bigger lesson: every layer needs upkeep

Behind every website sit a server language, plugins, a theme, and a database, and someone has to keep each one updated. When one layer needs an urgent fix, the clock starts for every site that uses it. For a business, a site that's down or out of date can mean missed calls and visits. For a church or non-profit, it can mean visitors and shut-ins who can't find your service times or watch online.

How we build at S3

This is a big part of why our sites are built differently. No PHP and no WordPress plugins to patch; the hosting and database are managed and updated for you. Fewer moving parts means a much smaller target, fast pages, and less upkeep on your plate.

To be fair, every website still needs good habits. Your domain, your email, and your passwords still matter.

Already have a website?

We build websites for businesses, churches, schools, and venues across Mississippi. Our Site Migration & Refresh moves your current site onto our simpler setup. You'll get your first mobile design draft within 72 hours of completed, paid onboarding. That draft is a private preview for you to review, not a live site, and every site we build is built with accessibility in mind.*Clock starts when your form is complete and setup is paid. See how it works

Starting fresh? You can start without PHP from day one.

For churches and ministries: a quick website check-up

This week is a good time for a simple self-check:

• Can a first-time visitor find your service times and location on a phone?
• Can shut-ins and members who are away watch or listen online?
• Can people give online easily?
• Is your site kept up to date, and do you know who updates it?

If your site is on WordPress, ask whoever hosts it, "Has our PHP been updated?"

Get a free check-up

Not sure where your site stands? Run the free S3 Compass check-up at s3mediateam.com/compass. It looks at your site's speed and visibility. Questions? Email sales@s3mediateam.com and a real person on our team answers.

Sources (checked Oct 22–23, 2026):

• PHP.net, News Archive 2026, "Security advisory: Critical remote code execution vulnerabilities, update now" (Oct 21, 2026): https://www.php.net/archive/2026.php
• CISA, "Critical Vulnerabilities in PHP Require Immediate Patching" (Oct 21, 2026): https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
• WordPress.org News, "Critical PHP Security Release" (Oct 21, 2026): https://wordpress.org/news/2026/10/critical-php-security-release/
• WordPress.org, Requirements: https://wordpress.org/about/requirements/
• WordPress.org Plugins, Elementor Website Builder: https://wordpress.org/plugins/elementor/
• PHP.net, News Archive 2026, informational advisory on session.upload_progress (Oct 23, 2026): https://www.php.net/archive/2026.php#2026-10-23-1
• Wordfence, "Attacks on php2shell Continue, But No Known Compromises as a Result Yet" (Oct 22, 2026): https://www.wordfence.com/blog/2026/10/attacks-on-php2shell-continue-but-no-known-compromises-as-a-result-yet/