How to keep your business secure after the PHP2Shell warnings
If your website runs on WordPress, it runs on PHP, and October's security warnings apply to you. The good news is that most of the fix is simple: confirm your site is patched, check nobody got in, and tighten the basics.
You may have seen the headlines. Government websites across Europe went offline as a precaution, and the UK's National Cyber Security Centre (NCSC) told organisations to act immediately.
This guide explains what happened in plain English. It then covers what to check on your website, how to protect your wider business and data, and what to do if you think something has gone wrong.
What happened with PHP2Shell?
If your website runs on WordPress, it runs on PHP, and October's security warnings apply to you. The good news is that most of the fix is simple: confirm your site is patched, check nobody got in, and tighten the basics.
You may have seen the headlines. Government websites across Europe went offline as a precaution, and the UK's National Cyber Security Centre (NCSC) told organisations to act immediately.
This guide explains what happened in plain English. It then covers what to check on your website, how to protect your wider business and data, and what to do if you think something has gone wrong.
What else has been happening?
PHP2Shell was not the only warning this autumn, and the others affected ordinary WordPress plugins. The common thread is that attackers are going after the tools websites trust.
| Issue | What happened | What to do |
|---|---|---|
| A newer PHP flaw (CVE-2026-115560) | Disclosed on 23 October and not fixed by the October updates. It needs an unusual setup, so PHP says widespread exposure is unlikely. | Ask your host whether the recommended setting is applied until a fix ships. |
| UpdraftPlus connection keys | Attackers took keys from the developer's website on 17 to 18 October, then used them to install backdoor plugins on connected sites. | Update to 1.26.13 or 2.26.13 and delete old UpdraftCentral keys. Updating alone does not remove a backdoor. |
| Rank Math PRO | Version 3.0.123 carried malicious code if downloaded on 15 to 16 October. | Check your version and follow Rank Math's guidance. |
The lesson from the plugin incidents is uncomfortable. A site can be fully up to date and still be affected, because the trusted update or connection was the way in.
The UK picture supports this. The government's Cyber Security Breaches Survey found 43% of businesses had a breach or attack in the last 12 months, including 42% of micro businesses and 46% of small ones. Phishing was by far the most common, affecting 38% of businesses.
Five website checks to do this week
You do not need to be technical to start these. If someone else manages your website, send them this list and ask for an answer on each point.
1. Confirm PHP has been patched. Updating WordPress or your plugins does not fix PHP2Shell, because PHP sits on the server. Ask your host: "Is the October 2026 PHP security fix installed for the version my site uses, and on what date?" Get a clear yes. Be aware that the version number may not change on some hosts, and that WordPress Site Health may not warn you.
2. Move off old PHP versions. PHP 8.1 and older no longer get official updates. Ask your web team to test your site on a supported version, then switch.
3. Update everything else. That means WordPress, your theme and every plugin. Delete anything you no longer use, because an inactive plugin can still be a risk.
4. Look for things that should not be there. Check your users for any administrator or editor you do not recognise. Check your plugins too, including the Must-Use tab if you have one.
5. Test a backup. Keep at least one copy away from your hosting account, then make sure it restores. A backup you have never tried is only a hope. Also keep any backups from before mid-October until you are sure your site is clean.
Protecting the rest of your business and data
Your website is only one way in, and email is the most common one. These steps cost little and cover most of the everyday risk.
Turn on two-step login. Only 47% of UK businesses require it. Start with email, your website, hosting, domain registrar, banking and social accounts.
Use a password manager. Give every account its own long password, so one leak does not open everything.
Limit admin access. Give people only the access they need. Remove old staff, freelancers and suppliers from your website and systems.
Train people to pause. Agree a simple rule: any request to change bank details or make an urgent payment gets confirmed by phone, on a number you already hold.
Keep devices updated. Turn on automatic updates for laptops and phones, and use up-to-date malware protection.
Know what data you hold. List where customer data lives, delete what you no longer need, and protect what remains. Website forms and old exports are easy to forget.
Ask your suppliers questions. Only 15% of businesses formally review the risks from their immediate suppliers. Ask yours who patches what, how quickly, and how they would tell you about a problem.
Write a one-page plan. Only 21% of micro businesses have a formal incident response plan. Yours can be simple: who decides, who to call, where the backups are and who tells customers.
Two free or low-cost next steps are worth knowing about. The NCSC's free Early Warning service can alert UK organisations to potential threats on their network. Cyber Essentials is the government-backed scheme for proving you have the basics in place.
What to do if you think something has happened
Stay calm, keep the evidence and get help early. Signs can include unknown admin users, strange redirects, spam pages in Google, customers receiving odd emails, or a warning from your host.
1. Start a log. Note the time, what you saw and everything you do from now on. The ICO recommends this even if you end up not needing to report anything.
2. Call your web team or host. Ask them to take a copy of the site and its logs before anything is changed. Deleting files first can destroy the evidence of how someone got in.
3. Contain it. Take the site offline if it is harming visitors or customers. From a clean device, change your passwords and sign everyone out of website, hosting, email and banking accounts.
4. Rotate your keys. Replace database passwords and any payment, email or API keys stored on the site. A stolen key can keep working after a password change.
5. Clean it properly. Restore from a backup taken before the problem began, then patch before going back online. Check again for rogue users and plugins, as restoring can bring problems back.
6. Work out if personal data was affected. If so, assess the risk to the people involved. If the breach is likely to put them at risk, you must report it to the ICO without undue delay and, where feasible, within 72 hours. The clock starts when you discover the breach. If the risk to people is high, you must tell them too.
7. Report the crime and tell your insurer. If you have cyber cover, call your insurer early, because many policies include expert help.
| Who | When | How |
|---|---|---|
| ICO | Personal data may be affected | Online report or 0303 123 1113 |
| Report Fraud | Cyber crime or fraud in England, Wales or Northern Ireland | reportfraud.police.uk or 0300 123 2040 |
| Police Scotland | Cyber crime or fraud in Scotland | 101 |
| NCSC | Reporting a cyber incident | report.ncsc.gov.uk |
| Your bank | Money or card details may be at risk | The number on your card, straight away |
The ICO's own first step is "Don't panic". It says not every reported breach results in formal action, and that its main aim is to help organisations avoid similar incidents. This guide is general information rather than legal advice.
Want someone to check your website?
Most of this comes down to knowing who is responsible for what. Cloud Digital is a web design and digital agency based in Poole, Dorset, and we help businesses keep their websites hosted, updated and looked after.
If you are not sure whether your site is patched, or you think something looks wrong, get in touch with our team. We will tell you plainly what needs doing.
Sources:
NCSC: Critical security issue affecting PHP
DSIT: Cyber security breaches survey 2025/2026
ICO: 72 hours, how to respond to a personal data breach
ICO: Personal data breach reporting
Report Fraud
ITPro: PHP patches and agency warnings
CSO Online: Two critical PHP flaws
The Hacker News: UpdraftCentral keys abused
Arabian Post: CVE-2026-115560 guidance
runZero: PHP exposure and exploitation update
WitsCode: PHP2Shell WordPress guide
Wikipedia: PHP2Shell
