PHP2Shell and WordPress: what business owners should know

What happened with PHP2Shell?

PHP2Shell refers to critical PHP vulnerabilities disclosed in October 2026. Researchers used AI to help investigate the flaws and develop working exploits. An attacker can use affected installations to run code on a server without signing in, or read sensitive information from memory. The flaws are in PHP itself, so a site can be affected even when its application code has no related bug. Wiz's research explains the findings and demonstrations.

On October 21, the PHP project released fixes for CVE-2026-109618 and CVE-2026-109619. Its official security advisory lists the fixed releases as PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Hosting providers may supply vendor packages with backported fixes, so the provider should confirm the patch status of your installation.

What should a WordPress site owner ask their host?

WordPress runs on PHP, and the hosting provider often manages that underlying software. Updating WordPress or a plugin alone does not confirm that PHP has been patched. Ask your provider:

• Which PHP installation serves our website, and has it received the fixes for both PHP2Shell vulnerabilities?
• Has the patched software been put into service for every affected site on our account?
• Who is responsible for future PHP security updates?

Keep the provider's response with your website records. If you are considering a rebuild, deal with the security update first; a migration takes planning and testing. The linked PHP advisory is dated October 21, 2026. Check your provider's current guidance for later updates.

Why we don't use WordPress for new builds

Our current website stack at Beach Intelligence doesn't use PHP, and we don't build new sites on WordPress. A typical WordPress setup includes the PHP runtime and a database, plus a theme and plugins that add the features the business needs. Those components have to be maintained and tested together when they change.

We prefer to choose the components around the work the site needs to do. A service business might need clear information, an inquiry form, and a way for staff to edit a few pages. A client portal needs account permissions and document access as well. Those are different requirements, and we scope the build accordingly.

What we build instead

We serve public website files from AWS through a content delivery network. Forms and private client accounts connect to separate backend services, so the public pages do not need a running WordPress installation to display their content.

When staff need to update the site, we can provide a private content manager with fields for the content they maintain. That might include service descriptions or business hours. Staff can make those changes without editing source code. Booking and payment services can be connected where they are part of the agreed scope.

Our website design and development service covers the build and handover. Projects that need a portal or a connection to an existing business system fall under our custom software work.

What moving away from WordPress involves

A migration starts with an inventory of the pages, content, and functions the business uses. We check what each plugin does before deciding how its function should carry over. Some features may belong in an existing booking or payment service; others may need custom development.

Search visibility needs attention during the move. Existing page addresses should stay where practical, with redirects for addresses that change. Titles, descriptions, and important content need to carry over, and forms need to be tested from submission through delivery. A rebuild does not guarantee better search rankings.

We also agree on who will maintain the new site and who owns the domain and hosting accounts. You review the build on a staging address before launch. Scope and pricing are set out in a written quote.