PHP2Shell: The Great Cybersecurity Meltdown And What Website Owners Really Need To Know

On 21 October 2026, business owners around the globe had a collective meltdown over PHP, which suddenly, and rather inexplicably, posed a major security threat to their websites. And a lot of them had no clue what PHP even is.

Which…fair.

Given the BBC was bleating about two critical vulnerabilities with the potential to let hackers take control of website servers without even logging in? Panic was kinda reasonable.

But the weird thing wasn’t the BBC’s alarming lack of proper context and predictable level of fearmongering. It was the rather spectacular demonstration that followed of how deeply most business owners misunderstand website security.

Because people generally had one of two reactions to the latest cybersecurity crisis, and neither was good.

Reaction One: LOCK EVERYTHING DOWN

The first was to do what we’ve all been taught to do when threatened online: change your passwords. Update your software. Check your security plugins. Make sure everything’s LOCKED DOWN.

Totally reasonable.

Yesterday? Completely pointless.

The vulnerabilities, now known as PHP2Shell, were in PHP. That’s the technology running behind your website, and millions of other websites. And the issue meant hackers could potentially bypass login security entirely.

So…your password could have been fifty characters long, include special characters and clever number-for-letter substitutions or be completely randomised, and it wouldn’t have done you any good.

The hackers didn’t need to crack it.

Like, at all.

And once people realised THAT, we started to see reaction two.

Reaction Two: TAKE THE WEBSITE OFFLINE!

Which, to be fair, wasn’t helped by the BBC reporting cybersecurity authorities were advising organisations to consider doing exactly that. And providing zero context for that particularly apocalyptic piece of advice.

Because without context, it really does sound like you’re being told to shut down your whole website, or hackers will ruin your entire business and nothing can possibly stop them.

We know how seriously businesses were taking that advice, because we had customers panic emailing, instructing us to immediately shut down their websites.

Which…no.

Your website is responsible for bringing in enquiries, customers and revenue. The good ‘ole ‘switch it off and on again’ trope DOES NOT APPLY.

The advice on website shutdown was real, but it didn’t automatically apply.

The National Cyber Security Centre’s guidance was to consider taking affected systems offline where immediate remediation wasn’t feasible and adequate mitigations weren’t in place.

And that qualification changes the situation considerably.

Who Actually Controls Your Website Security?

Website security isn’t one thing. It’s layers of technology. And different vulnerabilities affect different layers.

Yesterday’s problem wasn’t something you could fix by logging into WordPress, changing your passwords or updating your plugins. The vulnerability existed in the PHP software running on the server BEHIND the website.

Unless you actually manage that server infrastructure, you can’t fix it yourself.

Even Simon couldn’t directly fix it himself.

We’ve built, hosted, managed and maintained hundreds of websites for our customers, but our underlying hosting infrastructure sits with specialist providers. And deploying those server-level security patches is something only they can do within our hosting arrangements.

This is true for a lot of hosting companies, tech support services, website managers, whatever. The person managing your website isn’t necessarily the server administrator. Even your hosting provider might rely on another company to manage the underlying infrastructure.

And a lot of business owners are completely unaware of this because…well, why would you know?

How We Handled The PHP2Shell Security Threat

Our job yesterday was to establish exactly what the threat was, make sure our hosting partners had implemented appropriate temporary protections, monitor the rollout of the permanent fixes and assess whether taking our customers’ websites offline was actually necessary.

Because there’s a fairly significant difference between a website being potentially vulnerable and a website being actively compromised.

Having an unprotected vulnerability isn’t the same as having effective security measures in place while a permanent fix is being deployed.

We confirmed the temporary protections were in place, kept our customers informed and monitored the situation until our hosting partners had deployed the permanent patches.

The result?

Every single one of our customers’ websites remained online throughout the great PHP meltdown. No emergency shutdowns. No unnecessary disruption to their businesses.

The permanent fixes have now been deployed.

Why Website Downtime Is No Joke

If yesterday taught us anything, it’s that an alarming number of business owners are chronically underinformed about website security.

And when something like this happens, that can very easily lead to one of two things.

You do everything you THINK is right, assume you’re now safe, and leave yourself exposed to hackers.

Or you panic at how vulnerable you are and pull the plug on your whole site, potentially costing the business thousands, in some cases millions, in revenue.

Website downtime is no joke.

Depending on how many leads or sales you get in a day, and how much each is worth to you, shutting the site down can be incredibly costly.

Website continuity also isn’t as simple as ‘switch it off for a bit and everything will pick back up when you put it back’.

Because what about transactions, bookings or other processes interrupted while the website’s offline? And what about all the people who came to you in the interim and went somewhere else because you were gone?

That doesn’t just affect on-the-day sales. It can affect brand credibility, customer loyalty and the lifetime value of your customers.

What Should You Do When The Next Website Security Scare Hits?

The sensible response in situations like this is to establish which part of the technology is vulnerable, who actually controls it, what protections are already in place and whether those protections are sufficient to keep the website running safely.

Or, if we’re hosting or maintaining your website for you, just ask us.

Sometimes we’ll need to take immediate action. Sometimes it might GENUINELY mean taking a website offline. But that is always a last resort, and certainly not something we do as a knee-jerk panic response.

Most of the time, all YOU need to realistically do is let the people responsible for whichever part is vulnerable crack on with fixing it while your business carries on as normal.

The goal of cybersecurity isn’t to shut everything down at the first sign of trouble.

It’s to keep your business secure, running, and thriving.

Even in the face of a PHP apocalypse.

That’s all.

Book Your FREE Consultation Now…