The problem, in plain terms
On October 21, 2026, the PHP project published fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, together called PHP2Shell. Both score 9.2 out of 10 for severity. The flaws sit in PHP itself, the software that runs most small business websites, not in WordPress or any plugin. One lets an attacker run their own code on your server without logging in. The other lets them read pieces of the server's memory. Updating WordPress and plugins does not touch either flaw, because PHP is the floor they stand on.
For a business site, the practical damage is familiar: your site quietly starts serving someone else's pages, your customers get redirected or warned away, Google flags the site as hacked, and the cleanup costs far more than the patch would have. The window matters too: when a flaw this public lands, scanners sweep the internet for exactly the version numbers that are exposed.
What the evidence can and cannot show
Most servers announce their PHP version publicly, and the free check above reads that announcement against the patched releases: PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Three honest outcomes exist. An announcement at or above the patched release points to patch status confirmed for the reviewed CVEs. An announcement below it points to potentially affected. And two situations need the full check: servers that hide their version, and servers whose host quietly applied a distribution backport, a fix folded into an older package without changing its number. A backport can make a below-number server safe, which is why we never call a site vulnerable from the number alone.
PHP 8.1 and older received no patched release at all. For those sites the honest answer is different: there is nothing to patch to, so the fix is a move to a supported branch, with your site tested on a staging copy first.
What the fix involves
We do not publish a do-it-yourself recipe here, for the same reason a locksmith describes the lock, not the picking: the steps are the paid work, and done in the wrong order they take sites down. What you can hold us to is the shape of every job: a confirmed full backup before anything changes, the patched release applied for your branch (or a staged move when your branch has none), the server restarted so the fix is actually running, agreed checks on your homepage, forms, and checkout afterwards, and a written verification record showing before and after. If the upgrade cannot be completed safely, the backup is restored and we say so plainly; a restoration is not sold to you as a completed patch.
What it costs
An in-branch patch is Fix It, CA$197. If the check proves other problems too, one Secure It job at CA$397 closes them together. Sites on PHP 8.1 and older are platform moves, priced exactly in the written scope before any work, under the service terms.