No Password Needed. Your WordPress Site Is an Open Door.

Bob did the thing everybody tells you to do. He picked a long password for his website, and he doesn't use it anywhere else. He figured that was the security part handled, and he went back to work.

Then on October 21, the people who make PHP rushed out an emergency fix for two holes. PHP is the software under every WordPress site, Bob's included. With those holes, a stranger could send his server one request and run their own code on it. No login. No password. Bob's good password never even came up.

That's what this post is about. Not a plugin. Not a weak password. A door under the whole site with nobody standing at it. The fix is out, it takes about thirty seconds to find out if it's on your site, and I built the check right into this page.

TL;DR

PHP2Shell is two holes in PHP itself, the software every WordPress site runs on. A stranger could run their own code on your server with one request and no password (Help Net Security, 2026). The fix came out October 21, 2026, and it lives on your host's side, not in your WordPress dashboard. Ask your host which PHP version you're on and whether the October 21 fix is on it. If you're on Wix, Squarespace or Shopify, this one isn't yours.

3 Things to Remember

One Request. No Login. No Password.

Here's the hole in plain words. Every WordPress site has PHP running underneath it, building each page when somebody visits. These two holes let a stranger send that computer one request and then run whatever they want on it (Help Net Security, 2026). That's the whole attack. One knock and the door swings open.

Most break ins need something from you. A weak password. A click on a bad email. An old plugin you forgot about. This one needed nothing. You could have done every single thing right and still been exposed.

Run code on your server means they can do what your site can do. Your pages. Your contact form. The customer info coming in through it. Whatever's sitting on that computer.

The people who make PHP rated it 9.2 out of 10. One security company gave it a full 10 (Help Net Security, 2026). That's about as bad as the scale goes. Sit with that for a second.

Mistake: you think a strong password keeps the door locked.

Fix: find out whether the fix is on the computer under your login.

Payoff: you know the door is shut instead of hoping it is.

It's Not a Plugin This Time. It's Under WordPress.

I've spent years telling you the danger lives in the plugins. Most weeks that's still true. This isn't one of those weeks. The hole is in PHP, the thing WordPress, every plugin and every theme all sit on.

It worked on the newest version of WordPress too (Patchstack, 2026). So if you're the kind of owner who clicks every update the day it shows up, good for you. It didn't help here. The hole was underneath all of it.

About 69% of websites use PHP (Wikipedia, 2026). If your site is on WordPress, you're in that 69%. Your site doesn't have to be big or famous. It just has to be running PHP.

And WordPress itself isn't the safe middle either. Back in July, WordPress had its own hole that let strangers in with no password. Now the layer under it has one. Plugins on top, WordPress in the middle, PHP on the bottom. Every one of those layers is a door you're on the hook for.

Mistake: you click every update in your WordPress dashboard and figure you're covered.

Fix: know this fix isn't in your dashboard. It's on your host's computer.

Payoff: you stop thinking you're done when the big one hasn't happened yet.

Your Host Holds the Fix. Go Ask Them.

Here's the good news. The fix is out, and on most sites it's not on you to install it. It's on your web host, the company you pay every month or every year to keep your site up. Not you. Not WordPress.

If you want numbers to hold them to, here they are. The fixed versions came out October 21, 2026: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything at or past those on the same line has the fix (Help Net Security, 2026). If your host says you're on 8.1 or older, push on that. Those old versions got no normal fix (Wordify, 2026), so your host has to move you up to a newer one.

So here's your move. Find your PHP version, or ask for it. Type it in below and it tells you straight. If it says open, send your host the email under it.

I run a [TYPE OF BUSINESS] and my website is [YOUR WEBSITE ADDRESS].
It runs on WordPress. My web host is [YOUR HOST'S NAME].

On October 21, 2026, PHP put out a fix for two serious holes that
people call PHP2Shell. The fixed versions are 8.5.12, 8.4.27, 8.3.36
and 8.2.35. PHP 8.1 and older got no normal fix.

Write me a short, polite, firm email to my host. It must ask:
1. Exactly which PHP version my site runs right now.
2. Yes or no: is the October 21 PHP fix on my site?
3. If not, the date they will put it on.
4. If I am on PHP 8.1 or older, what it takes to move me to a newer
   version, and what on my site could break when they do.
5. Whether my site sits behind a shield like Cloudflare that blocks
   this attack.

Rules: plain words, 5th grade reading level, under 150 words.
Ask for the answer in writing. No threats. No jargon. No hype.
Give me a subject line too.

If your site sits behind Cloudflare, they put up a shield for this one, free accounts included (Help Net Security, 2026). Good. That buys you time. It doesn't replace the fix.

Mistake: you assume your host already did it because you pay them every month.

Fix: ask for the version and a yes or no, in writing.

Payoff: one email and you know where you stand by tomorrow.

884,000 Servers Are Still on the Old Version.

Here's the part that should land. A lot of websites run on old versions of PHP that are past their expiration date. When this fix came out, those old versions didn't get a normal release (Wordify, 2026). There's nothing simple for the host to click and install. Somebody has to move the site up to a newer version.

That's not a typo. 884,000 (The Hacker News, 2026). On every one of those, the door stays open until somebody does the work of moving it up.

And the clock was already running. Attacks started the morning of October 21, the same day the fix came out (Patchstack, 2026). This wasn't a someday problem.

It was big enough that governments pulled their own websites offline. The NSA and the UK told sites that couldn't update right away to go offline (Help Net Security, 2026). Those people have whole security teams. You've got a crew to run and a phone to answer.

Mistake: you leave the old version alone because the site still works.

Fix: have your host move you to a newer version with the fix, and have somebody look the site over after.

Payoff: you're off the list of servers with no fix coming.

My Sites Had No PHP to Patch.

I didn't write this from the cheap seats. I ran my own business on WordPress for years, which means PHP was under my site too. I used to read every one of these alerts like a to do list. So I moved 1,387 of my own posts off it.

Here's how that move went, rankings and all. It wasn't as bad as I'd built it up to be.

Everything I build now is an AI-JSX site. 281 of them so far. None of them run PHP. So when this hit, there was nothing on them for it to hit, and nothing to patch. Not because I'm any sharper than you. Because there's nothing there for it to be about.

That's not me saying my sites can't be hacked. Nobody can promise that. They still need a builder keeping them current, and that's my job. There's just no PHP under them for this one to hit.

If you want the plain version of how those sites work, here's what an AI site actually is.

When This One Isn't Your Problem.

I'll give credit where it's due, and you should weigh it before you take my side. When this came out, the people who make PHP shipped a fix fast. Cloudflare put up a shield for everybody, free accounts included. That's people doing their jobs, and doing them quick.

If your site is on Wix, Squarespace or Shopify, this one isn't yours. Those companies run their own computers and do their own fixing. Close the tab and go run your business.

If you're on WordPress and your host tells you in writing that the October 21 fix is on, you're in decent shape for this one. Check it off and get back to work.

Now the turn. These holes sat in PHP for years, and AI is what made them easy to use (Wikipedia, 2026). Those tools keep getting better. I wouldn't bet these are the last two.

Check the Number. Then Decide.

I'm not telling you somebody got into your site. I'm telling you the door was open on every site running PHP without the fix, and on a lot of them it still is.

So do the easy part today. Find your PHP version. Send your host the email. Get the yes or no back in writing.

Then think about the bigger thing. You didn't get into business to learn what PHP is. You got into it to do the work and get paid. A website should be the quiet part of your week, not the part where the floor needs an emergency fix.

If you'd rather see your business on the 100K Site, with no PHP under it, take a test drive. I'll put your site on my code, and you look at it before you spend a dime.

Take a Test Drive →

FAQ

Read These In This Order

1. WTF Is PHP? Your Website Runs on It. Are You Safe? Hackers Just Cracked It.
2. Governments Shut Down Their Own Websites. PHP Is Hacked. Is Your Site Safe?
3. No Password Needed. Your WordPress Site Is an Open Door.
4. We Know WordPress Sucks. Now PHP Sucks Too? Don't Let Them Destroy Your Business.
5. Every WordPress Site Needed an Emergency Fix. Here's Why My Sites Didn't.
6. WordPress Left Your Site Wide Open. The Feds Noticed.