LankaRank PHP security warning
Security warning
On 21 October 2026 the PHP project fixed two critical flaws that let attackers take control of a website's server without a password, and attacks have already begun. If your website runs on WordPress or ordinary hosting, ask your hosting company today to confirm PHP has been updated.
Fixed on
21 October
PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35
Severity
9.2 out of 10
Rated critical in PHP's own advisory
First attack seen
17 October
Four days before the fix, reported by Amazon
Sri Lankan websites showing old PHP
23%
281 of 1,201 we re-read, 22 October 2026
Two flaws in PHP itself, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), that can let an attacker run their own code on a website's server. PHP's advisory says every installation that serves web pages is at risk, and both are rated 9.2 out of 10 for severity.
An attacker who gets in this way can change or delete the website, put scam or gambling pages on it, read what's stored on the server, or use it to attack others. The flaws go back to versions released more than ten years ago, so old websites are affected as well as new ones.
If it runs on PHP and hasn't been updated since 21 October 2026, yes. In our study of Sri Lankan business websites, 49% ran on WordPress, which always runs on PHP, and many hand-built sites use it too.
When we re-read the homepages of 1,201 working Sri Lankan business websites on 22 October 2026, the day after the fix, 292 told visitors which PHP version they run, and 281 of those showed a version without the fix. Of those, 154 ran versions so old that the PHP project no longer updates them at all. The rest don't say, so the real number using old PHP is likely higher.
Ask your hosting company, or whoever looks after your website, to confirm in writing that PHP is on 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or newer. PHP's advisory says only an update fully fixes the flaws. On most hosting plans, keeping PHP updated is their job.
It can warn you, but no outside check can prove a website is safe. Our free check reads the PHP version your server announces, and if it's one without the fix, your report shows a security notice.
Two things it can't see: many servers hide their version, and some hosting companies install the fix without changing the version number. So "no notice" doesn't mean "safe", and a notice means "ask your host", not "you've been hacked". We never try the attack on anyone's website: we only read what your server already tells every visitor.
Check your website free. It takes about a minute, and the same report shows what's stopping customers finding and contacting you.
By checking your website every week, so problems like this are spotted in days, not months, and by fixing them for you if you'd rather not. No one can honestly promise a website will never be attacked. What we can promise is that you hear about a problem like this quickly.
The same check covers what costs you customers. In our study, the typical Sri Lankan business website took 7.9 seconds to show its main content on Google's phone test, and 76% had no WhatsApp button.
On ordinary shared or cPanel hosting, the hosting company updates PHP on its servers. If your website runs on its own server (a VPS or cloud server), whoever set it up and looks after it is responsible, usually your web developer.
A fix within the same version, such as 8.3.35 to 8.3.36, rarely changes how a website works. Moving from an old version, such as 7.4, to a current one can stop an old theme or plugin working, so ask for a backup first and check your website straight afterwards.
Ask your hosting company: they can tell you in one message. Many hosting control panels also show it. Our free check shows it only when your server announces it, and many servers don't.
No. The flaws are in PHP, the language WordPress and many other websites run on, so updating WordPress or its plugins doesn't fix them. Keep WordPress updated anyway: it's a separate, ongoing job.
Sources: PHP's security advisory (21 October 2026: fixed versions, who is at risk); PHP's advisory records on GitHub (severity 9.2, critical); Tenable's PHP2Shell FAQ (first attack seen on 17 October by Amazon Threat Intelligence, and attacks since); and our own re-read of 1,201 Sri Lankan business websites' homepages on 22 October 2026, which only read the version each server announces (how the websites were chosen).
Not sure what you need?
You don't need to know anything about websites or SEO. Our check reads your site, or your Google listing, the way a customer would, and tells you what to fix first.
Best if you have a website and are happy to make small changes yourself, with step-by-step help.
Limited time: 33% off your first month
Rs 2,990first month
then Rs 4,490 a month
Best if you'd rather not touch your website at all. We make the changes for you.
Rs 29,900/month
Best if you don't have a website yet, or yours is broken or out of date.
Rs 14,900one-off
With Done For You, we deal with your hosting company when a security update like this comes out. The Growth Plan re-checks your website every week and tells you what to ask.