PHP2Shell: what the critical PHP vulnerability means for your website, and what to do now
Two critical PHP flaws disclosed in October 2026 are being exploited. Here's who is affected — including WordPress, WooCommerce and Laravel sites — and the steps to take today.
Tech guideOn 21 October 2026 the PHP project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, now known as PHP2Shell. They let an attacker run their own code on a web server without logging in. Attacks were seen within days, and on 26 October the US cybersecurity agency CISA added both to its list of vulnerabilities known to be exploited.
PHP runs a large share of the web, including WordPress, WooCommerce, Laravel, Magento, Drupal and many custom business systems. If your website or software runs on PHP, this is worth checking today. Here is what you need to know, without the jargon.
What happened
Both flaws are in PHP itself, not in a particular plugin or theme. One involves how PHP cleans up when a request runs out of memory; the other leaves stale data behind between requests on the same server process. In the wrong hands, a specially crafted web request can turn either into a way to take control of the server. The PHP security team rated both 9.2 out of 10.
Because the problem is in the language rather than in your site's code, a well-built, fully updated WordPress or Laravel site can still be exposed if the PHP underneath it hasn't been updated. Security researchers have publicly demonstrated attacks against several popular PHP applications.
Is your website affected?
Any server using PHP to serve web pages is in scope: Apache with mod_php (which PHP considers the highest risk), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. That covers almost every WordPress and WooCommerce site, most shared hosting, cPanel and Plesk servers, and custom applications built on Laravel, Yii, CodeIgniter or plain PHP.
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or newer. Anything older on those branches is affected. PHP 8.1 and earlier are no longer supported and have no official fixed release at all — only source patches for people who compile PHP themselves — so sites still on them need to move to a supported version.
One caution: Linux distributions such as Ubuntu, Debian and Red Hat often apply security fixes to their own packaged PHP without changing the main version number. If your server uses distribution packages, check the vendor's security notice rather than relying on the version number alone.
Websites built with Next.js or as static sites don't run PHP and aren't affected, unless they connect to a separate PHP backend or a WordPress install used for content.
What to do today
If you're on shared or managed hosting: ask your host directly whether PHP on your account has been updated to a fixed version and the PHP service restarted. Many hosts are patching their servers, but don't assume — get it in writing. In your hosting panel, also make sure your site isn't set to an old PHP version such as 7.4 or 8.0.
If you run your own server or VPS: update PHP to a fixed version and then restart PHP-FPM or Apache. Installing the update doesn't protect processes that are already running. Start with servers that face the internet.
After updating, test the site properly. Some applications using SimpleXML have reported crashes on PHP 8.4.27 and 8.5.12 due to an unrelated change in the same releases; a fix has been merged for the next release. A quick check of key pages, forms and checkout catches problems before customers do.
If you can't update straight away, PHP's advisory lists temporary configuration changes that reduce the risk, and a web application firewall such as Cloudflare's may block known attack patterns. Neither is a complete fix. CISA's advice for systems that can't be patched is to take them offline until they are.
Check whether you were already targeted
Exploitation attempts were seen from 17 October, before the fixes were public, so updating alone doesn't prove nothing happened. Ask your developer or host to look for warning signs from that date onwards: unfamiliar PHP files in upload or cache folders, new administrator accounts, unexpected scheduled tasks, PHP processes starting shell commands or downloading files, and unusual outgoing traffic.
If there are signs of compromise, preserve evidence before restarting servers where possible, change every password and API key the server could access, restore from a clean backup taken before 17 October, and then update. Check Google Search Console for security warnings or spam pages added to your site.
The lesson for every business website
Most website hacks don't start with your own code. They start with something underneath it — a language, server or plugin — that nobody was responsible for updating. Know who looks after your hosting and server software, keep tested backups, and have someone watching security notices so a critical fix is applied in hours, not months.
If your website or business software runs on PHP and you're not sure it has been updated, contact us. We'll check the PHP version and configuration, apply the update, test the site and look for signs of compromise.
Frequently asked questions
Is my WordPress site affected by PHP2Shell?
If it runs on a PHP version older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or a distribution package without the fix), yes. Updating WordPress and plugins doesn't fix it — the PHP version on the server has to be updated.
Do I need to do anything if my hosting company manages the server?
Ask your host to confirm in writing that PHP has been updated and restarted on your account, and check that your site isn't set to an old, unsupported PHP version in the hosting panel.
Is updating PHP enough?
It closes the hole, but attacks began before the fixes were public. Restart PHP after updating and check for signs of compromise from 17 October 2026 onwards.
Can you check and update our server?
Yes. We review the PHP version and configuration, apply the fixed release, test the site and check for signs of compromise, for sites we built and those built by others.
Free consultation
Want a clear, itemised quote for your project?
Tell us what you need — we usually reply within one business day.
