You may have seen it in the news this week. On October 21, 2026, the people behind PHP released emergency fixes for two critical security flaws, officially numbered CVE-2026-109618 and CVE-2026-109619, and nicknamed “PHP2Shell”.
If that sounds like a lot of jargon, you’re not alone. Here’s what it means for a therapist or practice owner, in plain words.
What happened
PHP is software that runs behind many websites. It’s what powers WordPress, Drupal and Joomla, and roughly 7 in 10 websites use it.
The two flaws let an attacker run their own instructions on a website without needing a password. In practice, that means they could read or change anything on it.
The fixes came out quickly, but the problem was serious enough that some government websites were taken offline while they were patched, and security firms reported attackers were already trying to use the flaws. The FBI also issued a warning about them.
You can read more from the original sources: PHP’s security advisories, WordPress.org’s “Critical PHP Security Release” notice, and the FBI’s warning, and reports from Wordfence, Reuters and Recorded Future.
Why it matters for a practice
A therapy website isn’t just a brochure. Think about what goes through it:
- Contact forms where people describe why they’re reaching out.
- Intake or inquiry forms that may include health details.
- Your practice’s good name. A hacked website can show strange pages or send visitors somewhere harmful.
As a therapist, you’re expected to look after your clients’ private information, and HIPAA sets clear expectations for health information. A website that hasn’t been updated puts some of that at risk, and a break-in that exposes client messages can raise HIPAA concerns. If that worries you, check with your compliance advisor.
How to tell if your website is on WordPress
You don’t need to be technical. Try these:
1. Try the login address
Type your web address followed by /wp-admin into your browser, like this: yourpractice.com/wp-admin. If you see a WordPress login page, your website is on WordPress.
2. Look for a clue in the page
On a computer, open your website, right-click on the page and choose “View page source”. Then press Ctrl+F (or Cmd+F on a Mac) and search for wp-content. If it shows up, you’re on WordPress.
3. Check your bills and emails
Look back through emails from whoever built your website. Words like “WordPress”, “theme”, “plugin” or “Elementor” are strong hints.
4. If you can log in to WordPress
Go to Tools, then Site Health, then Info, then Server. You’ll see which version of PHP your website is using. Your web person can tell you whether that version includes the October 21 fixes.
5. Or just ask us
Our free website check tells you what your website is built on, along with speed and how easy your practice is to find.
What to ask your web person
If you have someone who looks after your website, send them a short message today. You can copy this:
Hi [name], I saw the news about the PHP2Shell security flaws (October 21, 2026). Can you confirm:
- Is our website on WordPress, Drupal or Joomla?
- Has PHP been updated to a version with the October 21 fixes?
- Are WordPress, the theme and all plugins up to date?
- Where do messages from our contact and intake forms go, and are they stored on the website?
- Do we have a recent backup?
Thanks!
If you don’t have a web person, or you’re not sure who looks after the website, treat that as the first thing to fix.
The bigger picture
The October flaws will be fixed, but WordPress websites need regular updates: WordPress itself, the theme, every plugin, and the PHP underneath. Each one is a small door that has to be kept locked. Most of the time, that’s fine. But it means someone has to keep watching, and sometimes act quickly, like this week.
How Stepflow websites avoid this
The websites we build don’t use PHP or WordPress at all. Every page is prepared ahead of time and sent as a simple, finished file. There’s no software running behind the website for this kind of attack to reach, and nothing that needs an emergency update at 2am. It’s one of 12 protections built into every website we build.
If you’re on WordPress, we’ll check your website for free and move it over, keeping your words, photos and booking. There’s more detail, including a simple picture of the difference, on our WordPress security page.
Where to go from here
- Read the full WordPress security explainer.
- Get a free website check to find out what your site is built on.
- Check whether your contact form is a HIPAA risk while you’re at it.
- See the therapy website checklist for the other things clients look for.
You don’t need to panic. You do need to check. A short message to your web person today is the right first step.