PHP2Shell explained in plain language, with a copy-and-paste host verification message, a Falls+Partners checklist PDF and a practical plan for small business websites.
Your website loading normally does not prove its PHP software is protected. Jason Falls explains PHP2Shell, the WordPress/PHP distinction, hosting responsibility and a practical small business battle plan.
COPY AND PASTE THIS MESSAGE TO YOUR HOST
Subject: Please confirm our website’s PHP2Shell protection
Have you addressed both PHP2Shell vulnerabilities on the systems running my website? What fix is in place, when was it applied, and what action remains? Please confirm protection against CVE-2026-109618 and CVE-2026-109619, identifying the fixed PHP package or documented vendor security update. Please confirm the protected software is actually serving our website and any required restarts are complete.
Please include our main website, subdomains, staging and test sites, old installations still online, and separately hosted tools. Identify anything outside your responsibility. Have you reviewed PHP’s October 23 follow-up advisory, and does our setup require additional action? If any protection is temporary, please explain what remains to be patched, who owns that work and when it will be completed.
Please tell us whether you found signs of possible compromise, what checks you performed and whether investigation remains. Confirm who will test our forms, bookings, checkout and confirmation emails after the work. Please identify any action we need to take and who will verify completion. We need your response in plain language, in writing.
DOWNLOAD THE FALLS+PARTNERS CHECKLIST (PDF)
https://fallspartners.com/wp-content/uploads/2026/10/Falls-Partners-PHP2Shell-Checklist-1.pdf
WHAT RUNS YOUR WEBSITE? WHITEBOARD EXPLAINER
https://fallspartners.com/wp-content/uploads/2026/10/what-runs-your-website-wordpress-php-whiteboard-1.png
WordPress manages content; themes and HTML/CSS shape presentation; PHP runs back-end logic; the database stores content; hosting supplies the computer.
NEED A STRAIGHT ANSWER?
Contact Falls+Partners: https://fallspartners.com/contact/
Tell us: “I need a straight answer about my website.”
CHAPTERS
00:00 Welcome to Winfluence
00:25 Declaring war on PHP2Shell
01:23 What is PHP2Shell?
03:07 How bad is the risk?
04:18 WordPress, Drupal, Joomla and hosting responsibility
06:31 What Shopify merchants should check
07:14 Your three-step battle plan
07:51 The message to send your host
08:37 Verify the fix and test your website
09:37 Older sites and suspected compromise
11:04 The Falls+Partners declaration and next steps
SOURCE GUIDANCE
https://www.php.net/archive/2026.php
https://wordpress.com/support/php-security-update-october-2026-cve-2026-109618-and-cve-2026-109619-php2shell/
https://www.shopify.com/website/hosting
Recorded in October 2026. Check current provider guidance; this episode does not diagnose your website or guarantee overall security.
