PHP2Shell alert
A critical PHP flaw is being targeted right now. Is your practice website safe?
On October 21, PHP released emergency fixes for “PHP2Shell”, two flaws that let attackers run code on a website’s server without a password. Attack attempts started before the fix existed. If your site runs WordPress, check your PHP version today. We’ll fix it for free for the first 10 therapist websites.
Updating WordPress or your plugins does not fix this. Only your PHP version does.
Free for the first 10 therapist websites. We start within 1 business day, US time.
Am I at risk? Check in 2 minutes
What matters is the full version number, not just “8.3”. A site on 8.3.35 is vulnerable. A site on 8.3.36 is patched.
How to find your full PHP version
- Log in to your WordPress dashboard.
- Go to Tools, then Site Health.
- Open the Info tab and click Server.
- Read the line called PHP version. It looks like 8.3.36.
| Your PHP version | Status |
|---|---|
| 8.5.12 or higher | Patched |
| 8.4.27 or higher | Patched |
| 8.3.36 or higher | Patched |
| 8.2.35 or higher | Patched for now. Support ends Dec 31, 2026, so plan an upgrade. |
| Any 8.2 to 8.5 version below those | Vulnerable. Patch today. |
| 8.1, 8.0, 7.4 or older | Highest risk. No official fix. Upgrade today. |
Not sure, or can’t log in? Request the free fix and we’ll check for you.
Why this is serious for a therapy practice
Both flaws are rated 9.2 out of 10 (critical). They let someone with no login run code on the web server that hosts your site.
That is the kind of access that lets an attacker inject spam or malware, redirect your visitors, read or change what your contact and intake forms collect, or get your site flagged by Google.
Your clients trust your website with sensitive information, so this is worth ten minutes today. Here is where things stand: attack attempts have been reported, and when CISA published its alert it had not observed successful exploitation. That can change, and checking your version costs you nothing.
A note on HIPAA, carefully worded. If your forms collect or store client health information, keeping the software behind them patched is part of protecting it. This isn’t legal advice, so check with your compliance advisor about what applies to your practice.
What our free emergency fix includes
- A check of your full PHP version, and whether your host has patched
- A full backup before we touch anything
- An upgrade to a patched, supported version. We recommend PHP 8.4 or 8.5 where your theme and plugins support it, and at minimum the latest patched build
- WordPress core, theme and plugin updates so they work on the new PHP
- A quick compromise check: unknown admin users, recently modified core files, suspicious redirects, injected scripts and Google Safe Browsing status
- Testing of your contact form, booking and mobile view
- A short written report, and our temporary access removed when we’re done
If we find signs your site was already compromised, we’ll tell you right away and give you a fixed quote for cleanup before doing anything.
What’s not included
- Replacing plugins that no longer work
- Rebuilding a theme
- Malware cleanup (we check for signs and quote it separately)
- WordPress versions too old to update safely
If we find one of these, we’ll tell you exactly what it would take and give you a fixed quote before doing anything. You can say no.
How it works
You request the fix
Fill in the short form below. It takes about two minutes.
We check your site
We start within 1 business day (US time) and write back with what we found.
You add a temporary admin user
We send instructions. Please never send us your password.
We fix, test, report and leave
We upgrade, test, send you a short report, and remove our access.
Is this for me?
This is for WordPress sites only, for therapists, psychologists, counselors and group practices in the US.
If your site is on Squarespace, Wix or a practice-management platform such as SimplePractice, you don’t need this. Those platforms handle PHP for you.
Why we’re doing this
We saw the alerts. We also know most therapists won’t, and that nobody told you your website runs on PHP in the first place.
You have little time between sessions, so for the first 10 practices we’re taking this one off your list, free. No contract, no sales call.
Srikaant H.
Request your free emergency fix
It takes about two minutes. We start within 1 business day (US time).
Questions
PHP2Shell is the name used for two critical flaws in PHP, CVE-2026-109618 and CVE-2026-109619. PHP released emergency fixes for them on October 21, 2026. Both are rated 9.2 out of 10, and they let an attacker with no login run code on the web server. PHP is the software under every WordPress site. Your host sets the version, not WordPress.
No. Updating WordPress, your plugins or your theme does not fix this. The flaws are in PHP itself, so only a patched PHP version fixes them. Check the full version in Tools, then Site Health, then Info, then Server.
Probably, but verify it. Look up the full PHP version and make sure it is 8.5.12, 8.4.27, 8.3.36, 8.2.35 or higher. Also check that nothing suspicious happened before the patch, because attack attempts were reported as early as October 17. We check both as part of the fix.
Yes, if it is 8.3.36 or higher. PHP 8.3 is a supported version and the patched build is available. The risk is in the full number: 8.3.35 and below are vulnerable.
Attack attempts were reported before the fix existed, but the sources we link to do not report confirmed successful attacks, so there is no reason to assume yours was hit. Signs to look for: admin users you don’t recognize, redirects to other sites, spam pages or links you didn’t add, files changed recently that you didn’t change, and a “This site may be hacked” warning from Google. We check for these as part of the fix, and if we find any we’ll tell you right away.
PHP 8.2 security support ends on December 31, 2026. That is a separate deadline from PHP2Shell, and another reason to move to PHP 8.4 or 8.5 rather than stay on 8.2.
Yes. The fix itself costs nothing and does not need a contract or a care plan. If we find something that isn’t covered (see what’s not included), we’ll tell you what it would take and give you a fixed quote before doing anything, and you can say no.
If your forms store submissions inside WordPress, an admin login could technically display them. Before we log in, we’ll ask you to either export and clear those stored entries, or sign a business associate agreement with us. If your forms only email you and don’t store entries, this doesn’t apply. This isn’t legal advice.
We take a full backup first and test before and after. If the upgrade breaks something we can’t fix quickly, we switch your PHP version back to what it was and tell you exactly what stopped working and what it would take to fix. Your site goes back to how it was.
This page will say so. You can still check and fix your PHP version yourself with our free guide, or we can do it for you as part of a WordPress Care Plan.
Want it kept safe after this?
WordPress Care Plans look after updates, backups and security every month, so the next alert like this one doesn’t sneak up on you.
The free fix does not require a care plan. Care plans are for WordPress sites only.
WordPress Care Plans are from $110/mo.
