Most website security scares start with a dodgy plugin that nobody in the marketing team remembers installing. This week’s scare starts with PHP itself, the language quietly running underneath WordPress and most other content management systems.
Two major flaws, nicknamed PHP2Shell, allow attackers to control a web server without logging in. Details leaked a day before the patch was released on 21 October. The UK’s National Cyber Security Centre has urged organisations to act quickly.
At first, this is an IT issue, but it quickly becomes an SEO problem if a hacked site starts sending spam to Google. If you rush a fix and break templates or take pages offline, you could lose rankings you worked hard to build.
What is PHP2Shell?
Two vulnerabilities, known as CVE-2026-109618 and CVE-2026-109619, are causing concern in server rooms across the country. Both have a severity score of 9.2 out of 10 and allow remote code execution, meaning someone else can run commands on your server.
These flaws stem from how PHP handles memory, so they affect any server running a PHP-based website. Wiz Research, which found the bugs, says every PHP version since 5.4 is affected by at least one of these issues.
The original plan was to release everything together on 21 October, including patches and technical details. However, details leaked a day early, along with a video showing an exploit tool running code on WordPress and Magento sites.
Wiz says these bugs have been in PHP for decades, hidden by an exploit chain too complex for most researchers. Frontier AI models helped uncover them, which might surprise anyone who thinks AI only writes LinkedIn posts.
What is PHP?
PHP stands for PHP: Hypertext Preprocessor. The name is a recursive acronym, a kind of joke programmers enjoy. It started in 1994 as Personal Home Page Tools, a few scripts Rasmus Lerdorf made to track visits to his online CV. Over time, the name changed and the language became much more than just one person’s homepage project.
PHP is a server-side language, which means it runs on the web server and creates each page before you see it in your browser. WordPress uses PHP, as do most other major content management systems for business websites. A problem in PHP itself is far more serious than a bug in a single plugin.
Why a marketing team should care about a server bug
Your search rankings rely on Google trusting what your server returns, but remote code execution gives someone else control of your server. Once attackers have access, they can change every page and redirect on your site.
Attackers usually use hacked sites for spam, since these sites have built up trust that new spam domains lack. They use that trust to rank pages selling fake goods or questionable pharmaceuticals, often in languages your customers have never seen before.
The data shows that many UK businesses are at risk this week. WordPress.org’s statistics say 35.1% of WordPress sites use a PHP version that no longer gets official patches. Patchstack also reported active exploitation on the morning the patch was released, though other security firms had not yet confirmed attacks.
Is my site safe if it’s on a managed host?
Managed WordPress hosts usually patch quickly. Many took steps before the official release. Still, it’s a good idea to ask for confirmation, since some hosts using control panel packages may be waiting on their suppliers.
How a hacked site damages your SEO
Hacking is one of the few negative SEO tactics that almost always leads to real ranking loss. The damage usually shows up in a few predictable ways, but some problems can stay hidden for weeks.
Spam pages flood the index.
A common sign is thousands of new URLs suddenly appearing on your domain, each loaded with keywords unrelated to your business. It can quietly use up your crawl budget for months before anyone notices.
Google then has to figure out if your domain is a real business or just a spam site with a nice homepage. You never want Google to question the site that brings you enquiries.
Cloaking hides the damage from you.
More advanced attacks show spam to Googlebot, but normal pages to everyone else, so the site looks fine from your desk. Some hacks only redirect visitors from Google on mobile, which is traffic your team usually doesn’t see.
The first sign is often a strange title in search results or a sudden drop in clicks that no one can explain. By then, Google may have devoted weeks to crawling spam pages you didn’t know existed.
Warnings and manual actions hit clicks.
Google can add a “This site may be hacked” warning to your results. Chrome might show a full-page red alert before visitors reach your site. Search Console’s Security Issues and Manual Actions reports will let you know if this happens, as long as someone checks them.
Click-through rates drop sharply when a red warning screen appears. Fixing the hack won’t remove the warning. You need to clean the site and request a review. Every day you wait can cost you real enquiries.
AI crawlers see the same pages as Googlebot, so injected spam can end up in the answers that assistants give about your brand. This makes it an AI search visibility problem.
Can the fix hurt your rankings too?
Rushing an upgrade can cause SEO problems, especially for sites moving from PHP 7.4 to a supported 8.x version. Older themes and plugins often depend on functions that PHP 8 has removed or changed in unanticipated ways.
If things go wrong, the upgrade can turn a working template into a blank white screen or cause 500 errors on many pages. Googlebot won’t wait for your developer to fix things before it starts recrawling those URLs.
Test on staging, then crawl.
Run the upgrade on a staging copy and crawl it thoroughly before changing your live site. A full crawl will find broken templates and error codes much faster than clicking around the homepage. Set up a full site crawl. Cover everything down to the reports you check.
After switching, crawl your live site again and watch Search Console’s crawl stats closely for the next two weeks. Ecommerce sites need extra attention, since emergency rules that block file uploads can also break some checkout forms.
If you have to go offline, use a 503
The NCSC recommends taking systems offline if you can’t patch or protect them quickly. If you do this, serve a 503 status code with a Retry-After header to let Google know the outage is temporary.
If your holding page returns a normal 200 code, Google may index your “back soon” message instead of your service pages. Google usually handles short outages well, but if a 503 stays up for weeks, it can start removing pages from the index.
Sansec, a security firm, warns that the built-in maintenance modes in WordPress and Magento do not protect against this attack. PHP processes each request before the application checks for maintenance, so any block must happen at the server or CDN level.
What to do this week
Find out which PHP version you run.
You can find your PHP version in WordPress under Tools, then Site Health, then the Info tab. Most hosting dashboards also show it clearly. The patched versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, so update anything older in those branches right away.
PHP 8.1 and earlier versions no longer get official support, so sites using them need to upgrade or get a backported fix from their vendor. If your WordPress site still runs PHP 7.4, now is the time to arrange that upgrade.
Ask your host the right questions.
WordPress’s automatic updates won’t fix this, since the patch is on the server below your CMS. Ask your host if the patch is installed and when it was applied; make sure to get their answer in writing.
Many hosts turned off a PHP setting called session.upload_progress as a temporary fix and WordPress doesn’t use it, so this change is low risk. Sites using Cloudflare also got emergency firewall rules for the known exploit routes, even on the free plan.
These rules buy you time while you apply the patch, but they only block attack routes researchers already know about.
Look for signs of compromise.
Patching shuts the door, but it won’t remove anyone who got in before. Start by checking Search Console’s Security Issues report and do a site: search for pages you don’t recognise.
If you see a sudden increase in indexed pages or unfamiliar admin accounts in your CMS, take a closer look. If anything appears off, the NCSC suggests calling in an approved incident response provider before deleting any files.
Will updating WordPress protect my site from PHP2Shell?
The flaws are in PHP on the server, below WordPress, so updating your CMS or plugins won’t fix them. Your host or developer needs to update PHP itself or use a backported fix from the vendor. It should tolerate brief downtime when the server returns a 503 status code during the outage. Problems start when the outage runs for weeks or when a holding page returns a 200 code instead.
Patch first, then protect your rankings.
PHP2Shell is a server issue, but it can seriously hurt your search performance. A hacked site loses Google’s trust fast and takes a long time to recover. A failed upgrade can cause similar problems in just one afternoon.
Install the patch this week, crawl your site afterwards and watch Search Console closely for at least a month.
If you want another opinion, our technical SEO team can run an audit to look for injected spam. Book a free strategy session today. We’ll let you know if the upgrade caused any issues.
