On the morning of October 21, 2026, the PHP project released emergency fixes (PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35) for two critical vulnerabilities. Our support team had every site we host on our own servers updated that same morning.
Why the rush? Under the right conditions, these flaws could let a stranger on the internet take control of the server a website runs on without needing a username or password. When it comes to security problems, they don’t get much worse than that. The pair has been nicknamed “PHP2Shell,” and both flaws scored 9.2 out of 10 on the standard severity scale.
This major vulnerability was made worse by the timing. Details about the flaws got out before the official fix was ready, so would-be attackers were able to get a head start. Website owners usually have at least a short window between a fix coming out and attackers learning how to use the flaw to protect themselves. In this situation, that window was close to zero.
What is PHP and Why Does it Matter?
PHP is the programming language running behind a huge share of the web, including every WordPress site. It’s basically like the engine running under your website’s hood. When someone visits your site, PHP goes to work on the server. It pulls your latest content, builds the page and sends it to the visitor’s browser, all in a fraction of a second. Every page view, contact form and site search on your website runs through it.
That’s why a flaw in PHP is such a big deal. Most website security problems are in a single plugin or theme, so they only affect the sites that use it. A flaw in PHP is different because it sits underneath everything else, so a flaw there can put a huge number of sites at risk at the same time.
The other complicated part is that you can’t fix this issue from your website’s dashboard. PHP runs on the server, not inside WordPress, so updating your plugins won’t help. Whoever manages your server has to install the new version of PHP. If that’s your hosting company, your protection depends on how quickly they act.
How Our Support Team Handled It
We started preparing the evening when the advance notice went out, so that on release morning we could focus on execution.
- The night before: we inventoried every server and every PHP version running on it, applied all pending updates, and took server snapshots so we could roll back instantly if anything misbehaved.
- Release morning: the fix went public at 9:00 AM Central. Our team was standing by, applied the patched PHP builds to every Matchbox-managed server, and restarted PHP so the new version was live.
- Verification: we confirmed each site was running the fixed version, checked that every site loaded normally, and reviewed error logs for anything unusual.
By mid-morning, every site on the servers we manage through SpinupWP was running the fixed version of PHP (just a few hours after the fix was released). Remember how we mentioned the window between “fix available” and “attackers rushing in” was close to zero? That’s the window our team was able close, which meant that our clients’ sites were exposed for as little time as possible.
Sites Hosted on WP Engine
Some of our clients’ sites are hosted on WP Engine instead of our own servers. WP Engine runs and maintains its own servers, PHP included, so it’s the only one who can install this fix there. So unfortunately we can’t install it ourselves.
The good news is that WP Engine is already on it and is rolling the fix out across its platform now. You can follow along on the WP Engine status page. In the meantime, we’re watching that rollout closely and will confirm each WP Engine site we manage once it’s patched.
If your site is on WP Engine, you don’t need to do anything. We’ll let you know when your site is patched. If you have questions before then, you can always reach out to our support team.
What This Means for You
If Matchbox hosts or maintains your website, there’s nothing you need to do. This is exactly the kind of work our hosting and maintenance plans are built for. We watch for threats, prepare before they land, and patch fast so the problem is fixed before you’re even aware it exists.
If your site is hosted elsewhere, check with your host today to confirm they’ve updated PHP to one of the fixed versions above. If you’re not sure who manages your server, or you’d like a team that handles this for you, get in touch. We’re happy to help.
