In this article
A critical PHP bug lets strangers run code on a website's server. Security firms report the attacks are ongoing.
The short answer: In October 2026, two critical PHP bugs (nicknamed PHP2Shell) let attackers take over a web server without a password. WordPress runs on PHP, so any WordPress site on an unpatched server is at risk, and only the host can fix it by updating PHP. A website with no PHP, like the ones Launch VRO builds, has nothing for this attack to grab.
This week, a big hole was found in the software that runs most WordPress websites. Hackers did not wait. They started using it right away.
If your rental website is on WordPress, a stranger could take it over. No password needed.
What is the PHP attack, and what happened?
WordPress runs on something called PHP. On 21 October 2026, the people who make PHP released a rush fix for two serious bugs. Security researchers at Wiz call the pair PHP2Shell.
With these bugs, a hacker can send a request to a website and take control of the computer it lives on. Patchstack reports the attacks are ongoing, and Recorded Future says copies of the attack code were shared online quickly.
Updating WordPress does not fix it. Updating your plugins does not fix it. Only your web host can fix it. Do you know if they did?
What does a hacked rental website really cost you?
- Guests land on a broken or fake page and book somewhere else.
- Your site goes offline in your busiest week. Some sites were taken offline just to be safe.
- Google can mark your site as unsafe, and guests stop trusting your name.
- Hackers can send your guests to a fake payment page and steal their money.
- You pay someone to clean it up, and you still do not know if it is really gone.
You work hard for direct bookings. One bad day on a weak website can undo months of it.
This is not a one-time thing
A WordPress site is made of many pieces: PHP, WordPress, a theme, and often 20 to 40 plugins. Each piece needs updates forever. Miss one, and the door is open.
This week it was PHP. Next month it will be a plugin. Then something else. That is just how WordPress works, and it is not your fault. But it is your risk.
If you stay on WordPress, ask your host today
- Have you fixed PHP on my server?
- Is my WordPress up to date?
- Do I have a backup from before 20 October?
If they cannot answer fast, you have your answer. Some hosts have already done the work for you. Some large hosts say they have already patched PHP on their managed WordPress plans. WordPress also has a free guide to locking down your site.
Or move to a website that does not have this problem
We build your booking website a different way, with Next.js. There is no PHP on it, so this attack has nothing to grab. There is no WordPress and no plugins to forget to update.
- No PHP. No WordPress. No plugin pile.
- No admin login page for hackers to keep hitting.
- Your pages load fast, from a network around the world.
- Guests pay on Stripe. Your site never sees their card.
- We keep it updated. If something new appears, we fix it. You never have to.
- To date, none of our client sites has been hacked.
We will not tell you any website is 100% safe, because none is. But a site with almost nothing to attack is a much harder target. And if something new appears, we fix it, so you do not have to.
Here is the easy way out
Move off WordPress this week, before attackers find your site. Security firms such as Patchstack report the attacks are ongoing.
- Pay your first installment. That is half of the setup. Launch Pad starts at $999.
- Send us your listing links.
- In 7 working days your new website is ready. If it is not, it is free.
- Pay the other half only when you go live.
Your website is where guests book you directly and you skip the big booking site fees. See what those fees cost you with our fee calculator, or read how it works.
Not sure what is possible for you? Ask us
On a call, we will:
- Check your current website: which PHP version it runs, which plugins it uses, and whether your logins and backups are in order.
- Tell you whether it is safer to patch your site or to move to one with no PHP.
- Explain what we can and cannot promise. No website is 100% safe.
We will tell you honestly what is realistic. We do not promise results, because nobody honest can.
Common questions
- What is the PHP2Shell vulnerability?
- PHP2Shell is the nickname for two critical bugs in PHP, CVE-2026-109618 and CVE-2026-109619. They let an attacker run code on a web server without logging in. PHP released fixes on 21 October 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- Is my WordPress site affected by the PHP attack?
- If your site runs on a server with an old version of PHP, yes. The bug is in PHP, not in WordPress, so updating WordPress or plugins does not fix it. Ask your host which PHP version your site runs and whether it has been updated.
- How do I protect my vacation rental website from PHP attacks?
- Ask your host to update PHP, keep WordPress, plugins and themes up to date, delete the ones you do not use, turn on two-step login and keep a recent backup. WordPress has a free hardening guide. Or use a website with no PHP at all, which removes this kind of attack.
- Is there a WordPress alternative for vacation rental booking sites?
- Yes. Launch VRO builds direct-booking websites on Next.js, with no PHP, no WordPress and no plugins. Plans start at $999, the site is ready in 7 working days or it is free, and you pay half to start and the other half when you go live.
Sources and helpful links
- PHP: supported versions — which PHP versions get security fixes
- Patchstack: major PHP vulnerability alert — the attacks that are going on
- Wiz: PHP2Shell — how the bugs work
- Recorded Future: PHP2Shell exploitation — who is using them
- WordPress: hardening WordPress — free steps to lock down a WordPress site
