Last Wednesday, the PHP project released emergency fixes for two critical flaws now known as PHP2Shell. PHP is the language behind roughly 70% of websites, including most WordPress sites, which makes this a small business website security story as much as a technical one.
Attackers moved fast. Amazon recorded the first attempt to exploit the flaws on its honeypot servers on October 17, four days before the public announcement. Cloudflare’s CEO said attempts reached the tens of thousands within 45 minutes of the disclosure, and millions soon after. Amazon’s chief security officer described the flaws as broadly exploited in the wild. Japan, the UK and Finland took some government web services offline as a precaution.
For most businesses, the technical fix is quick. The harder question comes first: whose job is it?
What PHP2Shell means for small business website security
The flaws sit in PHP itself, not in WordPress, plugins or themes. That detail matters. A website can have every plugin up to date and still be exposed, because the vulnerable software runs underneath it, on the server.
If attackers get in, they can run their own code on that server. In practice that can mean stolen form submissions and customer details, a defaced homepage, or a site quietly used to host malware or phishing pages under your name.
The fix is to run a patched release of PHP 8.2, 8.3, 8.4 or 8.5 from the October updates. Sites still on PHP 8.1 or older get no official fix, so they need to move to a supported version, ideally after testing that the site still works.
The ownership gap behind most website risk
Ask a small business who looks after its website and you usually hear one of four answers:
- The web designer who built it, sometimes years ago
- The hosting company
- The IT provider
- “I think it updates itself”
Any of these can be the right answer. The trouble is that each party often assumes someone else covers the server. Web designers tend to look after the design and the content. IT providers often look after computers, email and the network, and the website may sit outside their agreement. Hosting varies widely. The large managed WordPress platforms told customers they were already protected. On basic shared hosting it depends on the plan, and on a self-managed server it’s entirely on the owner.
None of this means anyone has failed. Most websites start life as a marketing project, and the security side simply never gets a named owner.
Three questions to answer this week
1. What version of PHP is our site running? In WordPress, an administrator can find it under Tools, Site Health, Info, Server. Anything below 8.2 needs attention.
2. Has our host or provider confirmed the PHP2Shell patch in writing? A short email is enough. If the site runs an older version, ask them to confirm the fix covers both flaws.
3. Whose agreement actually says “website server updates”? Check the hosting plan, the web designer’s maintenance terms and your IT provider’s scope. If none of them say it clearly, that’s the gap to close.
Where to start
Start with the first question. It takes two minutes and tells you how urgent the other two are.
Then use the moment to give your website a clear owner. The same confusion will come back with the next major flaw, and there will be a next one. Website security works best when it’s written into someone’s agreement with a response time attached.
A Free Tech Stack Assessment looks at your whole setup, website included, and helps you see who covers what and where the gaps are. It’s a calm, practical way to make sure nothing important is left unowned.