Howdy,

Larry has been relieved of the drawer key and handed a fresh Monster. He's drinking it. That's progress. He's still not making eye contact with anyone, but that's normal for Larry.

Here's what happened.

On 21 October 2026 the PHP team released emergency fixes for two critical security flaws in PHP, the language that runs WordPress and most of the web. They're tracked as CVE-2026-109618 and CVE-2026-109619, and security researchers have nicknamed them PHP2Shell.

They allow an attacker to run their own code on a web server without logging in. You can read the PHP team's advisory here.

What we've done

Every Linuxweb server has been patched. Our servers get regular updates as routine, and this round went out the same day the fix was released.

Our servers were also in a better position than most to begin with. The PHP team rates one common server setup as the highest risk for these flaws. We don't use it, and every website runs in its own separate process, walled off from everyone else's.

We're also moving all websites to PHP 8.3, which we've been doing since it was released.

What you need to do

A patched server doesn't make an outdated website safe. Old WordPress and old plugins have holes of their own, and no amount of server work patches those.

Update WordPress core, your theme and every plugin, as soon as you can. Take a backup first.

While you're in there, delete any plugins you don't use. A deactivated plugin is still code on your server, and it can still be exploited. That plugin you installed in 2019 to add snowflakes to your homepage? It's time.

Don't know how, or don't have the time?

We'll do it for you. Our website tech stack update service starts at R650.00 per website, once off. The final cost depends on how old the site is and what needs updating.

Log a ticket and we'll take it from there.

Larry will be fine once your plugins are.