Critical PHP Vulnerability “PHP2Shell”: Do You Need to Shut Down Your WordPress Website Now?
In the past few days, a shock wave has gone through the tech world: The German Federal Office for Information Security (BSI) has declared the orange warning level for a critical security vulnerability in the core of the PHP programming language . Since WordPress is almost entirely based on PHP, millions of websites worldwide are potentially threatened.
Since then, the wires have been glowing in our agency. The most frequently asked question from our customers at the moment is: “Do we have to take our website offline immediately to protect ourselves from hackers?”
The short answer is: No, in the vast majority of cases, you don’t have to shut down your website – but you need to act now!
What happened? The problem behind “PHP2Shell”
The vulnerabilities (registered under CVE-2026-109618 and CVE-2026-109619) affect the way PHP processes file uploads. Attackers can exploit this vulnerability to inject malicious code onto the server and, in the worst case, take complete control of the website and server.
The tricky thing about it: It’s not a bug in WordPress itself or in a specific plugin, but in the technological basis of the entire server.
The 3-step contingency plan for your WordPress website
To secure your website, you (or your technical partner) should follow these steps today:
Step 1: Check PHP version
Log in to your WordPress backend and navigate to Tools -> Website Health -> Report -> Server. There you will see which PHP version is currently active.
Step 2: Reconcile versions
The PHP developers reacted at lightning speed and provided security updates. Check if your version is one of the secure ones:
- PHP 8.5.x ➔ Secure from version 8.5.12
- PHP 8.4.x ➔ Secure from version 8.4.27
- PHP 8.3.x ➔ Secure from version 8.3.36
- PHP 8.2.x ➔ Safe from version 8.2.35 (Attention: Support expires at the end of 2026!)
- PHP 8.1 or older ➔ Acute danger! There are no longer any official security patches for these versions. An update to a more modern PHP version is unavoidable here.
Step 3: Contact the hoster or patch it yourself
If you use a normal web hosting package or “managed WordPress hosting”, many large providers have already automatically closed the gap in the background or temporarily blocked the affected function.
However, if you operate your own server (vServer/root server), you are responsible for installing the operating system updates yourself.
When “taking it off the grid” actually makes sense
Shutting down your website completely will hurt your business, your SEO ranking, and your image. It should be the absolute last resort.
A temporary “shutdown” is only advisable if:
- Your website is running on an outdated PHP version (8.1 or older) and a quick update is technically not possible at the moment.
- Your web host has not yet installed the security updates and you notice active attacks.
Our agency tip: Instead of deleting the website completely, set up a so-called complete directory protection (via .htaccess / HTTP-Basic-Auth). This locks the entire page behind a password entry. Automated hacker bots fail at this barrier, while you can calmly prepare the updates in the background.
No time or unsure? We’ll take care of it for you!
Security vulnerabilities such as “PHP2Shell” show how important continuous maintenance and monitoring of WordPress systems is. As a WordPress agency, we have already checked and secured all systems for our customers with existing maintenance contracts.
Do you have questions about your PHP version or do you need urgent help with the secure update of your website? Get in touch with us immediately. We check your system and bring your website safely through the current threat situation.
