# Critical security update to patch PHP2Shell vulnerability in websites running PHP On 21 October 2026 the PHP Foundation released a critical security patch for a new vulnerability called PHP2Shell. It affects millions of websites. PHP is the software behind many websites, including sites built on WordPress, Drupal, Magento and Joomla. If a website isn’t updated, an attacker could potentially take control of the server it runs on. What you need to do depends on how your website is run. Choose the tab that matches your situation: * Smaller sites - for example on WordPress.com hosting or self-hosted WordPress.org via a hosting company * Managed for you - for example via an agency * Self-hosted - where you host and manage your website yourself * [Smaller sites](#tab:php2shell-smaller-sites) * [Managed for you](#tab:php2shell-managed) * [Self-hosted](#tab:php2shell-self-hosted) ## Smaller sites, for example on WordPress Many charities use WordPress to manage their website, with the web space provided by a hosting company such as 123Reg, Fasthosts, Hostinger, Ionos or Bluehost. For the WordPress part: * **WordPress.com**, where you pay WordPress to provide the service: this has been patched automatically. * **WordPress.org**, where you run your own copy of WordPress: you’ll need to [check that your PHP version has been updated](https://wordpress.org/news/2026/10/critical-php-security-release/) in your web hosting portal. [See information on self-hosted services](#php2shell-self-hosted) To find out what you need to do with your hosting provider, search their help pages for PHP2Shell. For the security patch to work, you need to be running PHP 8.2 or newer. ## If a company/agency manages your website for you Ask the team or person looking after your website to make these checks, and to confirm they have completed all the actions needed to secure your site. 1. Does our website or any online service run on PHP, and which version? 2. If we use PHP 8.2 or newer, when will the update be installed, and does anything need to be done on our side? 3. If we use PHP 8.1 or older, will our host provide a fix? If not, what is the plan to move to a supported version? 4. Are recent backups in place, so we can restore the site if something goes wrong during the update? 5. Who should we contact if we notice anything unusual on the site? ## If you host and manage your services yourself Read the detailed technical guidance from the [National Cyber Security Centre](https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php) or the [PHP Foundation security advisory](https://www.php.net/archive/2026.php#2026-10-21-5). In summary: * Review all of your web systems for anything running on PHP. * Apply the security patch, updating where necessary. * If you run more than one site, check each one. * If you’ve been running an older version of PHP, take care: a major update could break some features. If you need time to apply the security patch, be prepared to take your services offline. Part of this guide is based on content from Bobi Robson at [Poteris](https://poteris.co.uk). --- ## About SCVO SCVO (Scottish Council for Voluntary Organisations) is the national membership organisation for Scotland's voluntary sector. Our role is to champion the role of voluntary organisations in Scotland and to support them to do work that has a positive impact. SCVO supports members and the wider voluntary sector with all aspects of setting up and running a voluntary organisation. SCVO represents the needs and concerns of the voluntary sector to the Scottish government in Holyrood and UK government and Westminster. Through our learning and events programme SCVO offers training and development opportunities to the sector. Members access an extensive membership benefits package including specialist, in-depth, 1-to-1 guidance from our Information Services team and from professional service partners. Access to exclusive membership networks (including comms, employers, governance and policy) supports members to grow their connections, stay up to date, exchange ideas and views with peers, and learn through tailored learning opportunities. SCVO members enjoy free access to Funding Scotland Premium to stay on top of funding opportunities to support their organisation’s financial resilience. Discounts and savings on SCVO products and services (including our HR service, managed IT support, payroll service and events and training) and partner offers provide members with support to allow them to focus on delivering their organisation’s goals. Further SCVO products and services include [extensive digital support](https://scvo.scot/support/digital), a climate action resource [Growing Climate Confidence](https://climateconfident.scot), a voluntary sector publication [Third Force News](https://tfn.scot) and a voluntary sector jobs and recruitment service [Goodmoves](https://goodmoves.org). For more information on SCVO membership, visit [SCVO membership](https://scvo.scot/membership)