PHP2Shell and Your Hotel Website: What Happened, and the Questions to Ask This Week

Last week, a large part of the internet quietly held its breath.

On 20 October, the team behind PHP announced two critical security flaws in the language itself. Details leaked on social media the same day, before the fixes were ready. By the following afternoon, emergency updates had been released, security firms were reporting attacks in the wild, and websites around the world were going offline whilst their servers were patched. The vulnerabilities have since been nicknamed PHP2Shell.

If you own or run a hotel, you may be wondering whether any of this has anything to do with you. In most cases, it does. Hotel website security is rarely something owners think about until something goes wrong, so I want to explain, in plain language, what happened, why it matters for hotels in particular, and the handful of questions you should be asking your website provider this week.

What PHP Is, and Why This One Matters

PHP is a programming language that runs on the server behind a website (the computer that sends your web pages to visitors). You never see it, but it’s everywhere. It underpins roughly 70% of websites, including every site built on WordPress, which on its own powers around 40% of all websites in the world. A very large number of hotel websites in Thailand are built on WordPress.

The two flaws, formally CVE-2026-109618 and CVE-2026-109619, are rated 9.2 out of 10 for severity. The reason the rating is so high is simple: they allow an attacker to run their own commands on an affected server remotely, without needing a password or a login of any kind. In practical terms, that can mean full control of the website and whatever sits on the same server.

The affected versions stretch back over a decade, to PHP 5.4. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October. On 26 October, the US Cybersecurity and Infrastructure Security Agency added both flaws to its catalogue of vulnerabilities that are known to be actively exploited. Palo Alto Networks reported more than 22 million internet-facing systems that were potentially exposed.

Updating WordPress Does Not Fix This

This is the point I most want hotel owners to understand, because it’s where confusion is most likely.

Many owners have learned, quite rightly, that keeping WordPress and its plugins updated is good practice. But PHP2Shell isn’t a WordPress problem. It sits one layer lower, in the language WordPress runs on. WordPress itself confirmed that no WordPress update is planned, because there is nothing in WordPress to fix. The fix is an updated version of PHP on your server, and that is normally installed by your hosting company or whoever manages your server, not by you.

If your site sits on a large managed platform, there is a good chance it was protected quickly. Several major hosts put mitigations in place before the fixes were even published. But if your website runs on a cheap shared host, a server set up years ago by a freelancer, or a machine nobody has looked at since the last redesign, you cannot assume anything.

There’s a related problem. One industry analysis found that more than a third of WordPress sites run a version of PHP that is no longer supported at all. Those sites don’t just need a patch. They need a proper upgrade, and that sometimes breaks older themes and plugins. It’s not a five-minute job, which is exactly why it gets postponed.

Why Hotel Websites Are Worth Attacking

It’s tempting to think a criminal wouldn’t bother with a 60-room resort in Kata. That’s the wrong way to look at it. Attacks like this are automated. Scanning tools sweep the internet looking for vulnerable servers, and they don’t care whose website it is.

And hotel websites are rather more valuable than most. Your website is where guests enter personal details, where your booking engine is linked, and where your brand’s credibility lives. A compromised hotel site can be used to:

• redirect guests to a fake booking or payment page
• insert hidden code that captures what guests type into forms
• send phishing emails that appear to come from your domain
• serve malware to visitors, which leads Google to flag the site as dangerous and can wipe out years of SEO work overnight

Any one of those is damaging. Several together can take a direct booking channel offline at precisely the moment high season begins.

What AI Has to Do With It

The most telling detail in this story isn’t the flaw itself. It’s how it was found.

These vulnerabilities had existed in PHP for more than ten years. They were discovered in August with the help of AI-assisted research by security firms. That’s encouraging in one sense, because responsible researchers found them and reported them properly. But it also tells you where things are heading. The same tools that help defenders find decade-old weaknesses in weeks are available to criminals. Amazon’s threat intelligence team spotted an exploitation attempt on 17 October, four days before the fixes were published.

The window between a flaw being discovered and a flaw being used against you is shrinking from months to days, and in some cases hours. That changes what “keeping your website maintained” needs to mean.

The Questions to Ask Your Provider This Week

You don’t need to understand servers to manage this risk. You need to ask the right questions and get the answers in writing. I’d suggest sending your website or hosting provider these four:

1. Which version of PHP is our website running today, and when was it updated?
2. Have you reviewed the server logs from 17 October onwards for signs of attempted or successful access?
3. Have any new administrator accounts, files or scheduled tasks appeared on the site since then?
4. Are there any other sites on our account, such as old staging sites or a forgotten microsite, that also need checking?

If the answer to the first question is vague, or you can’t work out who your provider actually is, that in itself is the finding. Plenty of hotels discover during incidents like this that the person who built their website left years ago and nobody holds the server login.

If you manage WordPress yourself, you can see your PHP version under Tools, then Site Health, then Info, then Server. If it doesn’t start with 8.2 or higher, speak to your host today.

The Bigger Lesson

PHP2Shell will fade from the headlines within a few weeks. The lesson shouldn’t. Over 25 years in technology, I’ve watched the gap between a weakness being discovered and a weakness being exploited narrow every year. This year it has narrowed faster than I have ever seen.

The hotels that came through last week calmly were not necessarily the ones with the biggest IT budgets. They were the ones who knew exactly who looked after their website, had a provider who acted quickly, and could get a straight answer within a day.

This is the first in a short series on cyber security for hotel owners and operators. In the coming posts I’ll cover the reservation hijack scams, how to protect your front desk and finance team from payment fraud and AI impersonation, and what to do in the first hour if you think something has gone wrong.

At The Percentage Company, we build and look after websites and booking systems for hotels across Thailand, and we take the security of those systems very seriously. If you’re unsure whether your website has been patched, or you simply can’t get a clear answer from whoever manages it, get in touch with us today!