Three takeover flaws in four months. Don’t reinvest in a flawed stack.

What happened

On 21 October 2026 the PHP project released emergency security updates for two vulnerabilities in the core PHP runtime, CVE-2026-109618 and CVE-2026-109619. Researchers have nicknamed them “PHP2Shell”. They were found by Wiz Research and disclosed through a coordinated process.

Both bugs are about how PHP manages memory between web requests:

• CVE-2026-109618: an out-of-memory condition can interrupt PHP while it is still setting up a request. Clean-up code can then treat that half-built data as valid.
• CVE-2026-109619: data belonging to one request can survive after its memory has been freed. The next visitor handled by the same PHP worker can then trigger use of that stale data.

Put simply, a carefully crafted request from anyone on the internet can let them run their own code on your web server. No password and no plugin bug is needed.

Why WordPress sites are in the firing line

WordPress is written in PHP, so every WordPress site runs on a PHP server. Because the flaw sits in PHP rather than WordPress, a fully updated WordPress install with every plugin patched is still exposed if the server underneath runs a vulnerable PHP version. The same goes for Drupal, Joomla, Magento, WooCommerce shops and any other PHP application.

Whether you're safe depends on your host:

• Managed WordPress hosts such as SiteGround and GoDaddy have announced that they are patching PHP on their platforms. It's worth confirming with yours that it's done.
• Cheap shared hosting, a VPS someone set up years ago, or a site “nobody looks after any more” is the real worry. Nobody is going to patch PHP on those for you.
• Old PHP versions. Many small-business sites still run PHP 7.x or 8.0/8.1 because a theme or plugin breaks on anything newer. Those versions won't get a fix at all.

2026 has been a bad year to run WordPress

PHP2Shell isn't a one-off. It's the third serious WordPress security flaw to make headlines since July:

1. July 2026, wp2shell. A chain of bugs in WordPress core that allowed takeover without logging in, with one request. Emergency updates went out on 17 July. The US cybersecurity agency CISA confirmed active exploitation and added both flaws to its Known Exploited Vulnerabilities list on 21 July. Attackers installed webshells, created admin accounts and planted malicious plugins.
2. September 2026, Click2Shell. Another core flaw, fixed in WordPress 7.1.1. If a logged-in administrator clicked a crafted link, an attacker could get a theme installed, and combined with a vulnerable theme, run code on the server.
3. October 2026, PHP2Shell. Two critical flaws in PHP itself, so every WordPress site is exposed until its host patches PHP, however up to date WordPress is.

Behind the headlines, the plugin ecosystem is the everyday risk. WordPress security firm Patchstack's figures for 2025:

• 11,334 new WordPress vulnerabilities found in 2025
• 42% more than in 2024
• 91% of them were in plugins
• 46% had no fix available when they were made public

A typical small-business WordPress site runs a couple of dozen plugins, so every one of them is a door that someone has to keep locked. Usually that someone is you.

A safer WordPress alternative: how our stack is different

The sites we build at BrightRay don't run PHP, and they don't have a database or admin login on the public web server. We build them with Next.js, React, TypeScript and Tailwind CSS, export every page ahead of time as plain static files, and serve them from Microsoft Azure Static Web Apps behind Azure Front Door's global network. This site runs on exactly the same stack. When a visitor loads a page, no code runs on our side to put it together, so there's nothing for a PHP2Shell-style attack to target.

Don’t reinvest in a flawed stack: choose a WordPress replacement

When something like PHP2Shell hits, the natural reaction is to patch and carry on. Look at where that money actually goes:

• An emergency developer to update PHP, then fix the old theme and plugins that break on PHP 8.2
• A malware clean-up, and a review request to Google if your site was flagged
• Another security plugin, a firewall subscription or pricier “secure” hosting

All of that buys you the same site on the same stack, waiting for the next wp2shell, Click2Shell or PHP2Shell. 2026 has shown that the next one is never far away. Spend that budget once on a WordPress replacement that doesn't have the problem, instead of paying again and again to prop up one that does.

The hidden cost of “free” WordPress

Even in a quiet year, WordPress itself is free but keeping it safe isn't. Most businesses end up paying, in money or in their own time, for:

• Hosting that's fast enough and patched quickly when something like PHP2Shell lands
• Premium themes and plugins, plus their yearly licence renewals
• Security plugins, firewalls and backup services
• Someone to apply updates every week and fix whatever an update breaks
• Clean-up when it goes wrong, plus lost sales and search ranking while the site is down or flagged by Google

A static site removes most of that list. There are no plugins to update and no database to back up, and nothing on the live server can be taken over.

To be fair: no website is “unhackable”, and WordPress can be run securely by a team that watches it closely. But most small businesses don't have that team. A site that has no server-side code is far less work to keep safe.

Why so many agencies sold you WordPress

If you paid an agency for a “cheap and quick” website in the last ten years, there's a good chance you got WordPress. That isn't because it was the best choice for your business. It's because it was the fastest way for them to turn a site round:

• Buy a theme, bolt on plugins, hand it over. A £50 theme and a stack of free plugins can look like a finished site in a few days. Every one of those plugins is someone else's code that has to be kept patched for as long as the site exists.
• Security becomes your problem after launch. Many low-cost builds come with no plan for updates. If there's a maintenance package, it often covers WordPress and plugin updates, but not the PHP version underneath. That's exactly the gap PHP2Shell goes through.
• Old sites are left on old PHP. A cheap theme that breaks on newer PHP is a common reason so many small-business sites are still on PHP 7 or 8.1. Those versions will never get a fix for this flaw.
• The fix is always “more WordPress”. Another plugin, another retainer, another emergency invoice. The agency's model depends on the stack staying the same.

Cheap to build, expensive to own. That's the WordPress agency model, and in 2026 the bill is arriving.

Questions to ask your web agency today

1. Which PHP version is my site on, and has it been patched for CVE-2026-109618 and CVE-2026-109619?
2. How many plugins does my site run, and who updates them?
3. Who would notice if my site was hacked tonight, and how quickly?
4. When was my site last backed up, and where is that backup kept?
5. If Google flagged my site tomorrow, what would it cost me to get it cleaned up?

If the answers are vague, or you can't get hold of the agency that built your site at all, contact us for a free WordPress vulnerability scan and we'll answer those questions for you.

We build back better than you had before

We don't patch up an old WordPress site and send you the invoice. We rebuild it on the same modern stack we use for our own site (Next.js, React and TypeScript on Microsoft Azure), with automated checks on every change, so you come out with a better website than the one you had:

• More secure: no PHP, no database and no public login to attack.
• Faster: pre-built pages served from Azure Front Door, with no plugin bloat slowing them down.
• Easier to find: clean code and structured data that Google and AI assistants can read and understand.
• Watched: monitoring and Search Console alerts set up from day one.
• Yours: your content and code under version control, not locked inside a theme someone else controls.

What a hacked website does to your business

A compromise is rarely just a technical problem. Once attackers are in, the damage spreads well beyond the server:

• Google warns people off. Google can label your site “This site may be hacked” in search results, and browsers can show a full-screen red warning before anyone reaches your homepage. The label stays until you clean the site and ask Google for a review.
• Your rankings get buried in spam. Hackers often add thousands of hidden spam pages (pharmacy, gambling, counterfeit goods) to borrow your site's reputation. Google sees a site full of spam, and your real pages suffer.
• AI assistants repeat what they find. ChatGPT, Perplexity, Google's AI Overviews and similar tools read the web to answer questions about you. If your site is serving injected spam or redirects, that's what they pick up, and a site Google has flagged is unlikely to be one they recommend.
• Customers are sent elsewhere. Visitors, and the clicks you pay for in ads, get redirected to scam or malware sites.
• Your email stops arriving. Hacked servers are used to send spam, which can get your domain blocklisted. Your invoices and quotes then land in junk folders.
• You may have a data breach to report. If customer details were exposed, UK GDPR can require you to report it to the ICO within 72 hours.

Cleaning up is the easy part. Recovering lost rankings and trust can take months.

How we protect your Google and AI rankings

Avoiding that damage isn't about one security plugin. It comes down to the right processes and the right stack, which we set up for every client:

• Nothing to hijack. The sites we build are static, so the live site has no PHP, no database and no admin login for attackers to take over and fill with spam.
• Every change is tracked and tested. Your site lives in version control on GitHub. Every change is recorded, and automated checks (code quality, a full build, performance and security headers) run before anything goes live. Any change can be rolled back in minutes, so nothing appears on your site without someone knowing.
• Locked down by default. Strict security headers, including a Content Security Policy, tell browsers to refuse scripts and content we didn't put there.
• We watch it for you. We set up uptime monitoring, Google Search Console and Bing Webmaster Tools, so we hear about security warnings and indexing problems before your customers do.
• Built to be found on Google and in AI answers. Fast pages, clear factual answers and structured data (schema.org) generated from the same content as the page, so it always matches what visitors see. That's what Google's AI Overviews, ChatGPT and Copilot read when they describe your business.
• Consistent everywhere. We make sure your name, address and phone number match across your site, Google Business Profile and directories. That consistency is one of the strongest signals for AI answers. ChatGPT's search leans on Bing, which is why we set that up too.
• No shortcuts that backfire. We don't churn out near-identical pages for every town or stuff in thin content. Google treats both as spam, and we've removed exactly that kind of page from our own site.
• Backups that live elsewhere. A complete copy of your site sits off the live server, ready to redeploy.

Looking for a WordPress replacement? Here's how the move works

Moving away from WordPress doesn't mean starting again. Our WordPress conversion service keeps what's working and leaves the risk behind:

1. Back up everything. We take a full copy of your WordPress files and database first, so nothing is lost.
2. Convert your content. Pages, blog posts, images and your design move across to our static stack.
3. Protect your rankings. We keep your domain and redirect any page addresses that change, so Google, AI search tools and your visitors find the new pages.
4. Switch over. Your new site goes live and the old WordPress install, along with its PHP, is retired.

Check your WordPress site right now

1. Find your PHP version. In your WordPress dashboard go to Tools → Site Health → Info → Server. Anything below 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (for its version line) is vulnerable.
2. Ask your host. Ask whether PHP has been patched for CVE-2026-109618 and CVE-2026-109619, and get a yes or no in writing.
3. Look for warning signs. Watch for new admin users you don't recognise, unfamiliar plugins, odd files in wp-content, redirects to spam sites, or warnings from Google or your browser.
4. Take a backup now. Back up both the files and the database, and store the copy somewhere other than the server. If you're unsure how, that's one of the things we'll do for you.

Don't patch it. Build back better. Start with a free scan.

If you're not sure whether the PHP flaw affects you, we'll check for free. Your free WordPress vulnerability scan covers:

• Your PHP version and whether your host has patched it for PHP2Shell
• Signs of compromise, such as unknown admin users, injected spam pages and suspicious redirects
• Google security warnings and how your site appears in search
• How AI assistants currently describe your business

We'll give you a plain-English report with no obligation, so you know the facts before you reinvest in anything. If your site is affected, we will:

• Back up your site immediately, including content, images and the database, so nothing is lost.
• Check it for signs of compromise and tell you plainly what we find.
• Rebuild it better on our static stack, keeping your content, design and web address.
• Get your business back up and running quickly, on a site with no PHP to attack, so your money goes into a better platform rather than the old one.

Sources

• Google Cloud: Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619
• PHP security advisories: GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp
• SiteGround: Critical PHP vulnerabilities, October 2026
• GoDaddy: Important PHP security update
• Patchstack: Major security alert: PHP vulnerable to critical RCE
• Patchstack: State of WordPress Security in 2026
• Google Search Help: “This site may be hacked” message
• Google Search Console Help: Security issues report
• Dark Reading: “WP2Shell” opens millions of WordPress sites to remote takeover
• INCIBE-CERT: Chain of critical vulnerabilities in WordPress, wp2shell
• BleepingComputer: WordPress Click2Shell flaw lets hackers execute PHP on the server