A Critical PHP Vulnerability: Is Your WordPress Export Website Secure?
Even when WordPress and its plugins are current, an export business website may still have vulnerabilities in its PHP runtime. This security notice explains PHP2Shell, the fixed releases, and what to confirm with your host about updates, suspicious activity and backups.
If your export business website uses WordPress, a recent security announcement deserves attention.
On October 21, 2026, PHP released security updates fixing two critical vulnerabilities.
Under certain conditions, attackers may be able to exploit them to execute malicious code on the server without signing in to the website's administration panel.
Why does this matter to export business websites?
Because WordPress runs on PHP. Even if WordPress and all plugins are updated, the underlying server environment may still carry security risks.
For companies that rely on Google SEO, advertising and website inquiries to acquire customers, this is not a minor issue to overlook.
01 How serious are these vulnerabilities?
The issue is known as PHP2Shell and involves two vulnerabilities:
CVE-2026-109618
CVE-2026-109619
Both have a CVSS 4.0 score of 9.2 out of 10, classified as Critical.
In simple terms, attackers may be able to execute malicious code on affected PHP servers and potentially access sensitive data.
The issue has attracted attention from several public authorities and technology companies.
The European Union Agency for Cybersecurity, ENISA, issued a joint statement with relevant organizations, recommending prompt investigation and patching of vulnerable PHP systems.
WordPress also published a security notice on October 21, advising site owners to update PHP promptly and contact their hosting providers to confirm remediation.
Cloudflare described protections against PHP2Shell and reported observing related attack traffic.
Figure 1 | A cropped screenshot of the official PHP security advisory, captured on October 23, 2026. View the original page.
Figure 2 | A cropped screenshot of the official WordPress security notice, captured on October 23, 2026. View the original page.
A critical vulnerability does not mean every WordPress website has already been attacked. Actual risk also depends on the PHP version, server environment and patch status.
02 What is the real risk to an export business website?
Companies typically invest considerable time and money in their own websites.
From development and product content to Google SEO and advertising, building stable traffic and inquiries can take months or years.
An attack can have several direct consequences.
Customer inquiry data may be exposed.
Email addresses, contact details and purchasing requirements submitted through the site may be accessed unlawfully.
Website content may be altered.
Attackers may insert spam pages, malicious links or redirect code, disrupting visits and potentially harming Google indexing and SEO performance.
Inquiries may be interrupted.
If the site remains unavailable, active advertising may waste budget and potential customers may be lost.
Brand credibility may suffer.
Customers who see a security warning when opening a site are likely to close it.
For companies relying on their website to reach overseas customers, security problems can ultimately become business losses.
03 Does this mean WordPress is insecure?
No.
WordPress is widely used for export business websites. It is open source and mature, with convenient content management and an established SEO ecosystem.
But a WordPress site depends on more than WordPress itself. It also relies on PHP, a database, a server, themes and plugins.
All of these need maintenance.
For example, some websites still run old PHP versions or plugins that have not been updated for a long time, years after launch.
A site appearing to work normally does not mean it has no security risks.
Being open source does not make WordPress insecure, but leaving a site unmaintained for years does allow risks to accumulate.
PHP2Shell is a reminder that website security involves the underlying runtime as well as WordPress plugin updates.
WordPress has explicitly stated that these vulnerabilities are not in WordPress itself. The fix requires updating PHP, rather than a WordPress application update.
04 What should WordPress users do now?
Contact your website provider or host promptly to confirm four things.
① Has PHP received the security update?
PHP has released the following fixed versions:
PHP 8.5.12
PHP 8.4.27
PHP 8.3.36
PHP 8.2.35
If you run an earlier release within one of these branches, or PHP 8.1 or an older branch, ask the server administrator about an upgrade plan or whether a vendor-supplied security patch has been applied.
② Has the server been patched?
If you use managed hosting such as SiteGround or Hostinger, contact the hosting provider directly.
Some server vendors may fix the issue through backported security patches, so the displayed PHP version alone is not enough to determine whether the system is secure.
③ Is the website showing unusual behavior?
Unexpected redirects, unfamiliar administrator accounts, altered pages or other suspicious activity deserve investigation.
The absence of obvious symptoms does not guarantee the absence of a security problem.
④ Does the website have reliable backups?
Confirm that site files and the database are backed up regularly and can be restored promptly if something goes wrong.
Figure 3 | A cropped screenshot from Cloudflare's security protection article, captured on October 23, 2026. The passage explicitly calls for patching PHP. View the original page.
A particular reminder:
These vulnerabilities affect the PHP runtime. Updating WordPress plugins or installing a security plugin cannot replace PHP security patches.
05 Plan website security before the build
When commissioning a website, companies often focus on design, SEO, features and price.
But the site must continue operating after launch.
How will the server be configured? Are third-party plugins necessary? Who handles security updates? How will the site be restored after a problem?
These questions belong in the planning stage.
When developing website proposals for clients, we include technology selection, server deployment, security measures and ongoing maintenance, adapting the approach to the project.
No website can guarantee that it will never have a security vulnerability.
What matters is reducing risk in advance and being able to respond and recover promptly.
For businesses relying on their own websites to acquire overseas customers over the long term, this matters as much as SEO and inquiry conversion.