PHP2Shell: is your website affected, and what to do about it

What PHP2Shell is

PHP2Shell is the name given to two related vulnerabilities in the PHP language runtime, tracked as CVE-2026-109618 and CVE-2026-109619. Rated 9.2 out of 10 on the CVSS severity scale, they are what security people call unauthenticated remote code execution: someone on the internet, with no account and no password, can make the server run code of their choosing. That is the worst class of web flaw there is, because from there an attacker can read the database, plant a backdoor, deface pages, or use the server to attack others.

The flaw is in PHP itself, not in WordPress, a theme or a plugin. That matters for two reasons. First, keeping WordPress and its plugins up to date does not fix it; only a PHP update does. Second, it affects every PHP website at once, which is why it is being treated as an emergency: in our own check of New York business websites, about four in ten run PHP.

It is being attacked now. Details leaked before the planned release, so PHP brought the fix forward a day. Cloudflare said it was seeing early attacks before the fix shipped, and the security firm watchTowr reported active exploitation attempts against both flaws on release day. A working exploit has been demonstrated, so don't wait for news of a break-in before updating.

Affected and fixed versions

The PHP project released fixes for the four branches it still maintains. Anything older is “end of life” and gets no official fix.

Backports. Some Linux distributions and hosts apply security fixes to an older-looking version number (Debian's 7.4.33-1+deb11u5, for example). The version your server reports may then look affected while it is not. Your host can confirm either way; that is the one question worth asking.

Who is affected, and who isn't

• Affected: any site served by PHP: WordPress, WooCommerce, Joomla, Drupal, Magento, PrestaShop, OpenCart, Laravel and other PHP frameworks, and custom-built PHP sites, on any host, unless PHP has been updated to a fixed release.
• Not affected: sites built on hosted platforms that run their own servers: Wix, Squarespace, Shopify, Webflow, GoDaddy Website Builder, Weebly, Duda. There is nothing for the owner to update. Also unaffected: static sites and sites built on other languages (Node, Python, Ruby, .NET, Go).
• Depends on the host: managed WordPress hosting (WP Engine, Kinsta, GoDaddy Managed WordPress, Bluehost, SiteGround, Hostinger and the rest) runs PHP, but the host controls the version and most are rolling the fix out. Confirm with them rather than assuming.

Which server setups are exposed

Every way of running PHP for a website is at risk: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP rates Apache with mod_php the highest risk, because a demonstrated exploit works there with a single unauthenticated request, before any of the site's own code runs.

PHP also ships inside other products: hosting control panels, network and storage appliances, Windows software and Docker images. Those copies are updated by their vendors, not by your host's PHP setting, so check them separately. The Dutch National Cyber Security Centre keeps a list of affected products.

How to check your site

The fastest way is our free checker: it visits your homepage once and reads what the server reports.

Check my PHP version →

If you prefer to look yourself, here are the ways to find your PHP version: WordPress's Site Health screen, your hosting control panel, or a one-line question to your host.

How the check works

The checker loads your homepage the way a browser does (over https, then plain http if https fails), looks at the first answer from http://your-site/ to see whether it redirects to https, and reads the three public files every search engine reads: robots.txt, sitemap.xml and llms.txt. From the homepage response it reads the PHP version some servers announce in an X-Powered-By or Server header, a PHP session cookie, and the platform the page was built with (WordPress, Wix, and so on). It reports one of five results: at risk with no official fix (PHP 8.1 or older), at risk with an update available, runs PHP but hides its version, reports a fixed release, or no PHP seen. It never logs in, never submits anything, never fetches any other page and never tries to trigger the flaw. Because it reads only what the server says, it cannot see a backported fix; it will tell you to confirm with your host, and you should.

What to do

1. Find out your PHP version. Run the PHP vulnerability checker, look in WordPress Site Health, or ask your host. If the version is hidden, asking is the only way.
2. If it's 8.2, 8.3, 8.4 or 8.5: update to the fixed release. On most hosting this is a setting in the control panel (cPanel's MultiPHP Manager, GoDaddy's PHP version setting, SiteGround's PHP Manager, Hostinger's PHP Configuration). Managed hosts usually do it for you; ask them to confirm it's done.
3. If it's 8.1 or older: move to a supported branch. There is no fix for the old branch. Switch to 8.3 or 8.4, which almost every modern WordPress site handles fine (8.2 also has the fix, but its security support ends on December 31, 2026). Very old themes or plugins may need updating first, so take a backup, switch, and click through the site.
4. Then update everything else. WordPress core, themes and plugins. They are not the PHP2Shell fix, but an old plugin is the next way in.
5. If nobody maintains the site, or you can't reach whoever built it, ask us. We'll confirm the version with your host, do the update, and if you'd like, take over keeping it current.

Confirm the fix is in place

• Check the version again after the update. WordPress Site Health, your control panel, or php -v on the server should show 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer.
• Restart PHP. A running PHP-FPM pool or Apache server keeps using the old code until it restarts. Managed hosts do this for you.
• Rebuild containers. If the site runs in Docker, pull the fixed image (for example php:8.4.27-fpm) and rebuild; restarting an old image changes nothing.
• Backported fixes keep the old number. Linux distributions received the patches in advance and some apply them without changing the version. If your version looks old, ask your host or vendor whether their package includes the fix.

If you can't update today

PHP is clear that only an update is a complete fix. If you run your own server and need a few hours or days, PHP's advisory lists settings that block the known attack paths. They work in php.ini, the PHP-FPM pool or the web server configuration; not in .user.ini or with ini_set(). Restart every PHP worker afterwards.

• Against CVE-2026-109619: set session.upload_progress.enabled = 0. On PHP 8.5, also set fatal_error_backtraces = 0. These block the confirmed attack paths, not every variant.
• Against CVE-2026-109618: set memory_limit = -1 in a way the site can't override (for example php_admin_value in the FPM pool or Apache configuration), and lower post_max_size to 8M, or 32M if the site takes file uploads, with upload_max_filesize below it. Because this removes PHP's own memory cap, put a memory limit on the container or service instead.
• Limit who can reach the site. CERT-EU advises taking internet-facing PHP sites off the public internet until the fix is applied. Cloudflare has firewall rules for the known attacks, but they only protect traffic that goes through Cloudflare, and attackers have already changed their requests to get around them.

On shared or managed hosting? You usually can't change these settings, and you shouldn't need to: ask your host when PHP will be updated, and whether they've applied these measures in the meantime.

Step-by-step for common setups

Rather hand it over? We'll confirm your PHP version with your host, make the update, check that the site still works and, if you like, keep it maintained so the next flaw is our problem, not yours. See website maintenance and security, book a free discovery call or call (914) 222-3310.

Timeline

• October 20, 2026: the two CVE numbers become public ahead of the planned October 22 release. PHP announces an emergency security release for the next day.
• October 21, before the release: Cloudflare switches on firewall rules by default and reports early attacks.
• October 21, about 14:00 UTC: PHP releases 8.2.35, 8.3.36, 8.4.27 and 8.5.12, plus source patches for 7.4, 8.0 and 8.1. CERT-EU publishes advisory 2026-018. watchTowr reports active exploitation attempts against both flaws.
• By October 22: technical details and proof-of-concept code are public. The flaws were found by Wiz Research, Calif and OpenAI's Codex Security team.

Questions we're getting

Sources

• PHP's security advisory, including the interim measures: php.net, October 21, 2026; technical advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp.
• PHP release announcements and change logs: php.net ChangeLog; supported versions.
• National Vulnerability Database entries: CVE-2026-109618, CVE-2026-109619.
• CERT-EU security advisory 2026-018; affected-products list from the Dutch NCSC.
• Exploitation reports and timeline: The Hacker News; Tenable FAQ.
• Our own data: 10,226 New York business websites, checked October 21, 2026.

This page is kept current as the story develops; the “updated” date above changes when the content does. Something wrong or missing? [email protected].