On October 21, PHP shipped emergency fixes for two remote-code-execution flaws nicknamed PHP2Shell. If your site runs WordPress or Laravel, PHP is the engine under it. You do not need to read a CVE. You do need to know whether your host actually applied the patch.
AI Map’s weekly roundup put the stakes in one paragraph: PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on 21 October, fixing CVE-2026-109618 and CVE-2026-109619, both scored 9.2 under CVSS v4.0. Around 70% of websites run PHP. AWS said it saw exploit attempts on 17 October, four days before disclosure, and that the flaws are now broadly exploited. The PHP Foundation said it knew of no successful remote code execution. Those two statements can both sit in the record. Your job is still to patch.
Laravel News covered the same releases in its October archive. The October 21 write-up is the one to send your developer: every PHP install that serves web requests is affected, including the way most Laravel apps run in production. There are no complete mitigations. Updating is the only complete fix. WordPress sits on the same engine. Clicking Update in wp-admin does not patch PHP.
What this actually is
Remote code execution means a stranger on the internet can run code on the server that hosts your site. That is not a defaced homepage. That is the keys to the shop: customer records, contact forms, payment settings, admin logins.
You will not see this listed in WordPress as a plugin update. PHP lives on the server. Your host, or whoever manages the box, is the person who installs it.
If you run a shop in Statesville, a clinic in Mooresville, or a contractor around Lake Norman, the question is the same: is the machine under the website on one of those four patched versions, or is it still on whatever PHP was there in September?
A checklist to send your host or developer
Copy this into an email. Ask for answers in writing.
1. What PHP version is on the site right now? They should answer in one line. You want 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or a Linux-vendor package that backports those same fixes. Laravel News listed those four versions as the emergency releases.
2. When was PHP last updated after October 21? If the answer is “we haven’t” or “we’re not sure,” that is the whole problem.
3. If we are on PHP 8.1 or older, what is the plan? Laravel News is explicit: PHP 8.1 and older no longer get updates from the PHP project. Some distributions backport fixes. Some do not. Laravel Forge has no patch for PHP 8.0 or 8.1. You need a supported version.
4. WordPress site: did you patch PHP on the server, not just WordPress core? Core, theme, and plugin updates are a different pile. Necessary, but they do not close PHP2Shell.
5. Laravel site: which host, and did anyone have to click a button? Laravel News is specific:
- Laravel Cloud: patched in place. No redeploy needed.
- Laravel Forge: you or your developer open each server and click Update PHP, then confirm the version. Ubuntu 20.04 or older cannot get the update. You need a new server.
- Laravel Vapor: patched runtimes are live, but you still have to deploy. Native PHP 8.2 or later needs a redeploy. Custom or Docker images need a new deployment.
6. If we cannot update today, what is sitting in front of the site? Updating is the only complete fix. A firewall rule is not a patch. Do not accept “we’re monitoring it” as the end of the conversation.
7. Who is on the hook the next time this happens? If the answer is “whoever built the site five years ago,” you do not have a maintenance plan.
What you can check yourself
You cannot always see the PHP version from the public homepage, and that is fine. You can still:
- Log into the host panel (cPanel, SiteGround, WP Engine, Cloudways, Forge) and look for PHP version. If it says 8.1, 8.0, 7.4, or “PHP 8.2” with no patch date, email the host today.
- If you pay a developer a monthly retainer, this is what that retainer is for.
- If nobody maintains the site, that is the finding. An Iredell County business on a five-year-old WordPress install is the typical case, not the exception.
Do not go hunting for proof-of-concept exploits. Several of the ones that circulated were fake. Volker Dusch of the PHP Foundation told Laravel News that some screenshots only worked against a specially modified Docker container, and did nothing against a default install.
This is a business issue, not an IT footnote
A patched marketing site is boring. An unpatched one is how customer data leaves the building without you noticing.
If you are already planning to move off a fragile WordPress stack into a real application, Laravel development is the usual path we take. That does not replace this week’s patch. It is the longer conversation about who owns the server after the news cycle moves on.
AI optimization will not save an unpatched site. Neither will an agent. Get PHP current first. Then, if you want the site to do work besides sit there, AI engineering belongs in the application you control, not in a random plugin.
systemsevendesigns can read the host’s reply with you, confirm the version, and handle the update on Laravel or WordPress stacks we maintain for owners around Statesville, Mooresville, and Lake Norman. If you only want the seven questions run, send them. That is a short call, not a rebuild.