Millions of Websites at Urgent Risk with PHP2Shell Vulnerability

October 22, 2026

Two critical vulnerabilities in PHP were discovered that could allow an unauthenticated attacker to gain control of a website and execute malicious code. Since these vulnerabilities affect PHP itself, any website running a vulnerable version may be at risk.

This vulnerability affected roughly 70% of websites on the internet, including sites built on WordPress, Drupal, and Laravel. A patch was released on October 21, 2026, for PHP 8.2 and newer, as well as all PHP versions running on servers using CloudLinux.

How this impacts Simplistics Web Design

Since our servers run on CloudLinux, the patch was applied to every website we host.

If we do not host your website, please contact your website host to ensure that PHP has been updated to avoid any ongoing risk.

Even though we have patched all versions of PHP on our servers, we do recommend updating your website to the latest supported version of PHP. As a best practice, with PHP 8.2 end of life coming up in December we recommend all clients update to a minimum version of PHP 8.3+.

If your website is already on PHP v.8+ our team is actively working on upgrading your site to 8.3 or higher and no action is required on your end. The upgrade from 8, 8.1, and 8.2 is typically harmless and our team will take care of this at no extra cost to you.

If you have any questions, please feel free to reach out to your account manager.