PHP2Shell: is your website affected, and what to do about it
A critical flaw in PHP, the software behind WordPress and about four in ten business sites, fixed on October 21, 2026. Here is what it is, which versions are safe, how to check yours in seconds, and the exact question to ask your host.
PHP2Shell is a critical security flaw in PHP, the software that runs WordPress and about four in ten business websites. It lets an attacker run their own code on a site's server without logging in. It was fixed on October 21, 2026 in PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12; every earlier release is affected; PHP 8.1 and older get no official release, only source patches and some distribution backports.
If your site runs PHP and nobody has updated it since October 21, assume it is affected and ask your host today. Check your site with the PHP vulnerability checker in a few seconds.
What PHP2Shell is
PHP2Shell is the name given to two related vulnerabilities in the PHP language runtime, tracked as CVE-2026-109618 and CVE-2026-109619. Rated 9.2 out of 10 on the CVSS severity scale, they are what security people call unauthenticated remote code execution: someone on the internet, with no account and no password, can make the server run code of their choosing. That is the worst class of web flaw there is, because from there an attacker can read the database, plant a backdoor, deface pages, or use the server to attack others.
The flaw is in PHP itself, not in WordPress, a theme or a plugin. That matters for two reasons. First, keeping WordPress and its plugins up to date does not fix it; only a PHP update does. Second, it affects every PHP website at once, which is why it is being treated as an emergency: in our own check of New York business websites, about four in ten run PHP.
Affected and fixed versions
The PHP project released fixes for the four branches it still maintains. Anything older is “end of life” and gets no official fix.
| PHP branch | Affected? | First fixed release | What to do |
|---|---|---|---|
| 5.x, 7.0 – 7.4, 8.0, 8.1 | Yes | none — source patches / distro backports only | Move to 8.2 or newer |
| 8.2 | Below 8.2.35 | 8.2.35 | Update to 8.2.35 or newer |
| 8.3 | Below 8.3.36 | 8.3.36 | Update to 8.3.36 or newer |
| 8.4 | Below 8.4.27 | 8.4.27 | Update to 8.4.27 or newer |
| 8.5 | Below 8.5.12 | 8.5.12 | Update to 8.5.12 or newer |
Backports. Some Linux distributions and hosts apply security fixes to an older-looking version number (Debian's 7.4.33-1+deb11u5, for example). The version your server reports may then look affected while it is not. Your host can confirm either way; that is the one question worth asking.
Who is affected, and who isn't
- Affected: any site served by PHP: WordPress, WooCommerce, Joomla, Drupal, Magento, PrestaShop, OpenCart, Laravel and other PHP frameworks, and custom-built PHP sites, on any host, unless PHP has been updated to a fixed release.
- Not affected: sites built on hosted platforms that run their own servers: Wix, Squarespace, Shopify, Webflow, GoDaddy Website Builder, Weebly, Duda. There is nothing for the owner to update. Also unaffected: static sites and sites built on other languages (Node, Python, Ruby, .NET, Go).
- Depends on the host: managed WordPress hosting (WP Engine, Kinsta, GoDaddy Managed WordPress, Bluehost, SiteGround, Hostinger and the rest) runs PHP, but the host controls the version and most are rolling the fix out. Confirm with them rather than assuming.
How to check your site
The fastest way is our free checker: it visits your homepage once and reads what the server reports.
If you prefer to look yourself, here are the ways to find your PHP version: WordPress's Site Health screen, your hosting control panel, or a one-line question to your host.
How the check works
The checker loads your homepage the way a browser does (over https, then plain http if https fails), looks at the first answer from http://your-site/ to see whether it redirects to https, and reads the three public files every search engine reads: robots.txt, sitemap.xml and llms.txt. From the homepage response it reads the PHP version some servers announce in an X-Powered-By or Server header, a PHP session cookie, and the platform the page was built with (WordPress, Wix, and so on). It reports one of five results: at risk with no official fix (PHP 8.1 or older), at risk with an update available, runs PHP but hides its version, reports a fixed release, or no PHP seen. It never logs in, never submits anything, never fetches any other page and never tries to trigger the flaw. Because it reads only what the server says, it cannot see a backported fix; it will tell you to confirm with your host, and you should.
What to do
- Find out your PHP version. Run the PHP vulnerability checker, look in WordPress Site Health, or ask your host. If the version is hidden, asking is the only way.
- If it's 8.2, 8.3, 8.4 or 8.5: update to the fixed release. On most hosting this is a setting in the control panel (cPanel's MultiPHP Manager, GoDaddy's PHP version setting, SiteGround's PHP Manager, Hostinger's PHP Configuration). Managed hosts usually do it for you; ask them to confirm it's done.
- If it's 8.1 or older: move to a supported branch. There is no fix for the old branch. Switch to 8.3 or 8.4, which almost every modern WordPress site handles fine (8.2 also has the fix, but its security support ends on December 31, 2026). Very old themes or plugins may need updating first, so take a backup, switch, and click through the site.
- Then update everything else. WordPress core, themes and plugins. They are not the PHP2Shell fix, but an old plugin is the next way in.
- If nobody maintains the site, or you can't reach whoever built it, ask us. We'll confirm the version with your host, do the update, and if you'd like, take over keeping it current.
Step-by-step for common setups
Update PHP on a WordPress site
Check the version in Site Health, switch it at your host, and make sure nothing broke.
Update PHP in cPanel
MultiPHP Manager, the setting behind Bluehost, HostGator, A2, Namecheap and many others.
Update PHP on GoDaddy
Three different GoDaddy products, three different places to look.
What PHP version is my site running?
Four ways to find out, from easiest to most certain.
Wix, Squarespace, Shopify: affected?
What a hosted platform means for PHP2Shell, and the one thing still worth checking.
The New York report
We checked 10,226 local business websites. Here is what they report.
Questions we're getting
Is my WordPress site affected by PHP2Shell?
If it runs on a PHP release older than 8.2.35, 8.3.36, 8.4.27 or 8.5.12, yes. WordPress itself is not the flaw; PHP underneath it is. Your host controls the PHP version. Check Site Health (Tools → Site Health → Info → Server) for the version, or ask your host directly.
My site is on Wix, Squarespace, Shopify or Webflow. Do I need to do anything?
You should not need to. Those platforms run and patch their own servers; you cannot change the PHP version yourself. Our checker reports them as “no PHP seen”.
The checker says my version is hidden. Is that bad?
No, hiding the version is a sensible setting and most sites do it. It just means the only way to know is to ask your host whether PHP has been updated to a fixed release since October 21, 2026.
My host says they patched PHP but the checker still says “at risk”.
That can be true. Some hosts and Linux distributions apply security fixes without changing the version number the server reports (a “backport”). The checker reads only that reported string. If your host confirms in writing that the fix is applied, trust them over the checker.
Can PHP2Shell be fixed without updating PHP?
The fix is in PHP itself, so updating PHP is the real fix. Web application firewalls and host-level rules can reduce exposure in the meantime, but they are a stopgap, not a solution. If your site is on an end-of-life branch (8.1 or older), the move to a supported branch is the only lasting fix.
Does this check hack or test my site?
No. It makes one ordinary visit to your homepage, exactly like a browser, and reads what the server says about itself. It never tries to trigger the flaw, never logs in, and never sends anything else.
Sources
- PHP release announcements and change logs: php.net ChangeLog; supported versions.
- National Vulnerability Database entries: CVE-2026-109618, CVE-2026-109619.
- Our own data: 10,226 New York business websites, checked October 21, 2026.
This page is kept current as the story develops; the “updated” date above changes when the content does. Something wrong or missing? [email protected].