PHP2Shell: WordPress Security Risks for Practice Websites

If your practice website runs on WordPress, it needs attention this week. On October 21, 2026, the makers of PHP, the software every WordPress website runs on, released an urgent fix for two serious security flaws now known as PHP2Shell. The flaws can let a stranger take control of the computer that hosts your website, without a password. Amazon's security team saw someone try it on October 17, four days before the fix existed.

For a dental or medical practice, the website is not a brochure. It is where new patients find you, request appointments, fill out forms and decide whether to call. This guide explains what happened in plain language, what it means for your patients and your team, and the questions to ask whoever built or hosts your website.

What happened, in plain English

Think of your WordPress website as a building. WordPress is the building itself. Plugins are the add-ons: the appointment request form, the before and after gallery, the reviews widget. PHP is the foundation the whole building sits on.

Most website security scares are about a faulty add-on. PHP2Shell is a crack in the foundation. That is why updating WordPress or your plugins does not fix it. The fix has to be made on the computer that hosts your website, which is usually your hosting company's or your web developer's job.

The name says what an attacker gets. A "shell" is the control panel of the computer that runs your website. Whoever gets into it can change what patients see on your site, add hidden code that copies whatever patients type into your forms, or plant harmful software. And it can happen quietly. In testing by Datadog Security Labs, the website kept loading normally while the attack worked, so nobody at the front desk would notice anything was wrong.

PHP's own security team rates both flaws 9.2 out of 10 for severity. You do not need the technical details to act on this. Your web person will know them.

Attackers did not wait for the fix

The timeline is the part worth sitting with for a minute.

Amazon's advice to anyone running these websites is to check for signs of trouble going back to October 17, not just from the day the fix came out, and to treat urgent fixes like this one as a matter of hours, not weeks.

To be fair, security researchers do not agree on how easy this is to pull off. Sansec, a firm that tracks attacks on online stores, said on October 22 that an attack needs specific conditions on the target website, and that the attack code shared publicly did not work on a standard setup. Amazon and others are already seeing attempts. Both can be true at once. What nobody at a practice can do is look at their own website and tell which group it falls into. That uncertainty is the risk.

Why practices should pay attention

Your website is the one door you leave open on purpose

Your scheduling software, your patient records and your phone system all sit behind logins. Your website is built to be open to everyone on the internet, because that is how new patients find you. That makes it the easiest way in, and the one system where a flaw like this matters most.

WordPress is everywhere in healthcare websites

According to W3Techs, which tracks the technology behind websites, WordPress runs about 4 in 10 of all websites and nearly 6 in 10 of the sites built on a website platform it can identify. Dental and medical web design firms build on it constantly. If an agency built your practice website in the last decade, there is a good chance it runs on WordPress.

Many practice websites run on older software

On W3Techs' numbers, about one in three websites built on PHP still runs an older version (PHP 7 or older), and the makers of PHP released no official fix for those versions. Some hosting companies patch older versions themselves, so the only way to know where your site stands is to ask. A practice website built years ago and never rebuilt is a likely candidate.

Plugins add more doors

Every plugin is software from a different company, on its own update schedule. Patchstack, a WordPress security firm, counted 11,334 new WordPress security weaknesses in 2025, up 42% from the year before, and 91% of them were in plugins. Almost half, 46%, had no fix available when they became public. For the ones attackers went after hardest, the typical time from public to mass attacks was about five hours. And in Patchstack's tests of hosting companies, standard hosting protections blocked only 12% of WordPress attacks in one study and 26% in another.

WordPress itself had a similar problem in July

Three months earlier, WordPress fixed its own takeover flaw, nicknamed wp2shell, which let a stranger take over a standard WordPress website with no plugins at all. The fix came out July 17, 2026, and attacks were confirmed within days. So in about three months, practice websites on WordPress faced two separate takeover flaws, and neither one was caused by a plugin.

What a hacked website means for your patients and your team

Patient information and HIPAA

Practice websites collect more than most owners realize: appointment requests, new patient forms, insurance details, a "reason for your visit" box. For a practice covered by HIPAA, a patient's name next to the reason for their visit is protected health information. Many WordPress form plugins also keep a copy of every submission inside the website, so years of patient inquiries can be sitting there without anyone remembering.

If someone takes over the website, those records are exposed, and so is every new form a patient fills out. HIPAA's rules follow the information, not the technology:

• It is treated as a breach unless you can show otherwise. HIPAA presumes a breach unless a documented risk assessment shows a low chance the information was compromised.
• Patients must be told within 60 days. Notice is due without unreasonable delay and no later than 60 days after the breach is discovered. If 500 or more people are affected, HHS must be told too, and more than 500 people in one state means notifying local media.
• Your website vendors are part of it. A hosting company or web developer that looks after a system holding patient information needs to sign a Business Associate Agreement (BAA) with your practice. Many general web hosts do not offer one.

According to HIPAA Journal's analysis of federal breach reports, healthcare saw a record 772 large data breaches in 2025, affecting about 138.5 million people, and hacking was behind more than 80% of them. Most did not start at a website. But the website is the one system every practice puts on the open internet on purpose.

What it means for the people in your office

A website problem rarely stays a website problem. If patients have to be notified, the letters go out under your practice's name and the questions come to your front desk. If the website has to come down while it is cleaned up, online appointment requests stop until it is back. And Google can flag a hacked website in its search results with a "This site may be hacked" warning, right where new patients are looking for you.

What to do this week

You do not need to understand the technology to handle this. Forward this page to whoever built or hosts your website, and ask them to answer these questions in writing.

Pick one person, usually the practice owner or office manager, to own the answers and keep them on file. HIPAA already expects practices to know the risks to their patients' information, and a written answer from your host is the kind of record you want to have.

For your web person: the fixed PHP versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Some hosts apply the fix without changing the version number, so a written confirmation matters more than the number. The makers of PHP say updating is the only complete fix. Temporary settings and firewall rules buy time, but they do not make a website safe.

If your host cannot answer these questions, or will not sign a BAA, that tells you what you need to know.

The bigger question: who is actually watching your website?

Fixing PHP2Shell this week is necessary. It will not be the last time. A WordPress website is a stack of software from many different companies: PHP underneath, WordPress itself, a design theme and a set of plugins, each with its own updates. The website is only as safe as its most neglected piece, and in most practices nobody owns the job of watching all of them. The agency built the site and moved on. The host keeps it running. The office manager has the login. When something like PHP2Shell happens, the question "who fixes this, and by when?" often has no clear answer.

No website is immune to every problem, and no honest company will tell you otherwise. The difference is how the website is built and who is responsible for it. A Patientfy website does not run on PHP, so PHP2Shell, wp2shell and the steady stream of WordPress plugin problems have nothing to attack. And when an urgent fix is needed anywhere in what Patientfy runs, applying it is Patientfy's job, not a task waiting in your office manager's inbox.

How Patientfy builds practice websites

Patientfy is a platform where AI agents, supervised by a real team, run a practice's marketing: the website, search, ads, the CRM and the AI receptionist. The Website agent builds custom dental and medical practice websites, and Patientfy's engineering team looks after everything underneath them. Security is built into the platform instead of added later with plugins.

What that means for your practice:

• No PHP and no WordPress plugins. PHP2Shell and wp2shell do not apply to a Patientfy website.
• HIPAA compliant by default. Forms are encrypted in transit and at rest, and a BAA is available before launch.
• SOC 2 compliant. Patientfy and every connected system that touches patient information are covered by a BAA from day one.
• Updates are our job. Hosting, SSL and security patches are included. Nobody in your office has to track security news.
• Built for every patient. Sites meet the WCAG 2.1 AA accessibility standard and are checked at every release.

Moving off WordPress does not mean starting over. Patientfy moves your existing site over, your domain stays the same, and your search rankings transfer through redirects mapped page by page. The typical time from signed agreement to a live website is seven days.

Start with the eight questions above this week, and keep the answers on file. Then book a Patientfy demo to see your practice website rebuilt on a platform where security is built in and keeping it updated is somebody's actual job.