Back in July, I was working on a client’s website that had been quietly falling behind. Nothing was on fire. The site still loaded, and visitors probably didn’t notice anything wrong. But under the hood, parts of it were outdated and deprecated, meaning the software it relied on was being phased out and would eventually stop getting updates.
So I did what good maintenance is supposed to do. I brought the site up to date and moved it onto current, supported software, including a supported version of PHP, the programming language that runs WordPress behind the scenes.
It wasn’t glamorous work. Then, three months later, it suddenly mattered a lot.
October: PHP2Shell
On October 20, 2026, details of two critical security flaws in PHP leaked online ahead of their planned announcement. The flaws, now known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), could let an attacker take over a web server remotely, with no password needed. Security researchers had discovered them back in August, and the PHP team had been quietly working on a fix.
Because of the leak, PHP rushed its emergency fixes out a day early, on October 21. PHP runs WordPress, Drupal, Joomla and a huge share of the websites on the internet, so website owners everywhere were suddenly scrambling to patch.
Why my July update made all the difference
Here’s the part most people don’t realize: emergency security fixes only come out for supported versions of software. When PHP released its fixes, they were for the current PHP 8 releases.
Because I’d already moved my client’s site onto supported, up-to-date software in July, it was ready to take the fix as soon as it came out. There was no panic and no weekend rebuild. It was just another update.
A site still stuck on an old, unsupported version is in a much tougher spot. There’s no simple patch to install. It has to be upgraded first, often in a hurry, while attackers are actively looking for vulnerable sites. That’s stressful, expensive, and exactly what I’d rather my clients never go through.
I didn’t know PHP2Shell was coming when I did that work in July. Nobody outside a small group of security researchers did. But that’s the point of regular maintenance: you don’t have to predict the next big threat to be ready for it.
What this means for your website
Most website owners only think about updates when something breaks. By then, it’s often too late to fix things calmly. A few habits keep you ready for whatever comes next:
- Keep WordPress, your theme and your plugins updated. Updates are where security fixes live.
- Make sure your hosting runs a current, supported version of PHP. If you don’t know which version you’re on, that’s worth finding out.
- Keep recent backups, so any update can be undone if something goes wrong.
- Don’t ignore “deprecated” warnings. They’re early notice that something will stop being supported.
Not sure if your site is ready?
If you don’t know what version of PHP your site runs, or whether it’s been patched for PHP2Shell, I can check for you. It’s quick, and it’s exactly what my website maintenance packages are for. Contact Bev or call 406-777-GEEK. I’ve got your back.