The PHP Hack: What Kenyan Website Owners Need to Do This Week

Two critical flaws in PHP itself, nicknamed PHP2Shell, let an attacker run commands on a web server without logging in. Patches came out on 21 October 2026. If your website runs on PHP, which includes every WordPress site, you need to confirm your host has applied them.

What happened

PHP's developers fixed two serious bugs in the language engine. One is a memory-corruption bug that appears when PHP runs out of memory. The other is a use-after-free bug linked to state PHP keeps between requests. In both cases an attacker on the internet can send crafted requests and end up running their own code on your server.

Because the bug is in PHP and not in your website, a perfectly written and fully updated WordPress site is still exposed until the server's PHP version is fixed. WordPress.org has confirmed no WordPress update is needed. The fix happens on the server.

Who is at risk

• Any site that runs PHP: WordPress, WooCommerce, Joomla, Drupal, Laravel and custom PHP sites.
• Business sites on shared hosting or cPanel, where your host patches the server and you choose the PHP branch.
• VPS and dedicated server owners, where you control the PHP version and must update it yourself.
• Sites that take M-Pesa, card or customer data. A taken-over server can read all of it.

Step 1: find out which PHP version you run

You need to be on one of these fixed versions, or newer.

On cPanel, open MultiPHP Manager (some hosts call it Select PHP Version) and read the branch for each domain. cPanel often shows only the branch, such as 8.3, and not the exact number, and a branch can still be unpatched. To see the exact version, ask your host, or upload a file named info.php containing <?php phpinfo(); to your site, open it in a browser, read the version at the top, then delete the file straight away. Leaving it online helps attackers.

On a VPS, connect over SSH and run: php -v. If your server runs PHP through PHP-FPM or Apache, the command line version and the website version can differ, so check both.

Step 2: get the fix

Most Kenyan business websites are not on a VPS. They sit on shared hosting with a cPanel login, where the host runs the server and you only choose settings. The fix depends on which of these you have, so start with the one that matches you.

Shared hosting with cPanel (most Kenyan business sites)

On shared hosting you cannot patch PHP yourself. The host does that for the whole server, and what you control is which PHP branch your site uses. Do these four things.

1. Check your version. In cPanel, open MultiPHP Manager and note the version next to each domain. Add-on domains and subdomains have their own setting, so check every one.
2. Move off old versions. If a domain shows 7.x, 8.0 or 8.1, switch it to 8.3 or 8.4 in the same screen. Take a backup first (Backup or JetBackup in cPanel), then open the site and test the key pages, the contact form and checkout. Old themes and plugins sometimes break on a newer version, so ask your developer before switching a live shop.
3. Ask your host to confirm the patch. Send this through support: Have you applied the October 21 PHP security update for CVE-2026-109618 and CVE-2026-109619 on my server? Which PHP versions are patched? Some hosts, including SiteGround and InMotion, switched off the affected functionality before the patch was out. Get the reply in writing.
4. Use the cPanel tools you already have. In File Manager, sort public_html and wp-content/uploads by date and look for PHP files you did not add. Under Cron Jobs, delete any entry you do not recognise. Under FTP Accounts and SSH Access, remove accounts nobody uses. If your host offers malware scanning such as Imunify or ImunifyAV, run a full scan.

WordPress on cPanel

Updating WordPress does not fix this, because the PHP fix still comes from the host. While you wait, update WordPress, themes and plugins anyway, delete the ones you do not use, and install a security plugin that does file scanning and login protection. Keep automatic backups on, and send a copy somewhere other than the same hosting account.

VPS or dedicated server

On Ubuntu or Debian, run: sudo apt update && sudo apt upgrade. Then restart PHP and your web server (for example sudo systemctl restart php8.3-fpm nginx, using the service names on your machine) and run php -v again to confirm the new version. On AlmaLinux, Rocky or CentOS, use dnf update and take the PHP update from your PHP repository.

Docker

Updating the host does not update containers. Pull a fresh PHP base image, rebuild your image with docker compose build --pull, then recreate the containers with docker compose up -d.

Step 3: reduce your exposure while you wait

• Put the site behind a web application firewall. Cloudflare's free plan is a reasonable start for most small businesses.
• Turn off any upload or script features you do not use.
• Take a fresh backup and store a copy off the server before changing anything.
• Remove old test sites, abandoned staging copies and unused plugins. Each one is another way in.

Step 4: check whether you were already hit

Attacks may have started before the patch, so patching alone is not enough. Look for the following.

• PHP files you do not recognise in wp-content/uploads, cache folders or the site root.
• New administrator accounts you did not create.
• Pages that redirect visitors to gambling, loan or pharmacy sites, especially when opened from Google.
• Your hosting account suddenly using much more CPU or sending spam.
• Scheduled tasks (cron jobs) you did not set up.

If anything looks wrong, change your hosting, database, admin and email passwords from a clean device, and restore from a backup taken before the problem began.

The Kenyan angle

If your site stores customer names, phone numbers or order details, the Data Protection Act, 2019 applies to you. Under Section 43, if a breach puts those people at real risk of harm, you must notify the Office of the Data Protection Commissioner (ODPC) within 72 hours of becoming aware, and tell the affected people without undue delay. The Data Protection (General) Regulations, 2021 set out how to do this. If you only host the data for someone else, you must tell that business as soon as you find out. Keep a short written record of what you found and when, and send a brief first notice while you investigate if you need more time.

You can also report the incident to KE-CIRT/CC, the national cyber incident response team run by the Communications Authority of Kenya. Businesses that take M-Pesa or card payments should also tell their payment provider if customer payment data could have been reached.

We can find out which PHP version your site runs, confirm your host applied the fix, scan for signs of a break-in, and set up a firewall and regular backups. Send us your website address and we will tell you where you stand.

Sources: CISA, CERT-EU, Rapid7, watchTowr, Codeable and SiteGround advisories published between 21 and 23 October 2026. Details may change as the situation develops. This article is general guidance and not legal advice.