The short answer: PHP2Shell is the name given to two critical security flaws in PHP, the software that runs WordPress and most business websites. Fixes were released on 21 October 2026. The flaws can let an attacker take over a web server with a single request, without logging in, and attacks were already being attempted before the fixes came out. Updating WordPress or your plugins does not fix it. The PHP software on the server has to be updated, which is usually your hosting provider’s job. If your website runs on a server that can no longer receive updates, it needs to move.
In this guide:
- What is PHP2Shell?
- Why it is so serious
- Is my website affected?
- Who has to fix it?
- What to do today
- Why old servers are the real problem
- Signs your server may already have been attacked
- Frequently asked questions
- Sources
What is PHP2Shell?
PHP2Shell is the nickname for two vulnerabilities in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619. PHP rates both at 9.2 out of 10 on the CVSS scale, which puts them in the critical category. Both allow remote code execution, meaning an attacker can run their own commands on the web server.
In plain terms, both are memory handling bugs. One is triggered when PHP runs out of memory part way through handling a request, leaving internal data half set up. The other leaves data from one request lying around for the next request handled by the same process. An attacker who can trigger either bug with a carefully crafted request can take control of the server.
Details leaked ahead of the planned disclosure date, so the PHP project brought its release forward and published fixed versions on 21 October 2026.
Why it is so serious
- No login needed. The PHP security team says a working exploit exists for servers using Apache with mod_php, where a single unauthenticated request can trigger the attack before any website code runs.
- It affects almost every setup. PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are all affected. Reports say nearly every PHP version going back years is vulnerable.
- Attacks started early. Cloudflare reported attack attempts before the fixes were released, and security firm watchTowr reported active exploitation attempts on the day of release.
- Your security plugin cannot see it. The attack happens inside PHP before WordPress loads, so WordPress security and firewall plugins do not stop it.
The UK National Cyber Security Centre (NCSC) told organisations to update affected systems immediately, and where that is not possible, that they “should consider taking the system offline until it can be fully mitigated”. In the Netherlands, several government services were taken offline as a precaution while systems were patched.
Is my website affected?
If your website or web application runs on PHP, assume it is affected until you have confirmed the server is running a fixed version. That includes almost every WordPress, WooCommerce, Joomla, Drupal and Laravel site, plus many customer portals and booking systems. The fixed versions are:
| PHP version | Fixed in | Notes |
|---|---|---|
| 8.5 | 8.5.12 | Supported |
| 8.4 | 8.4.27 | Supported |
| 8.3 | 8.3.36 | Supported |
| 8.2 | 8.2.35 | Security fixes only, and support ends on 31 December 2026 |
| 8.1 and older (including 7.4) | No official release | Only patched if your Linux distribution or a paid long-term support vendor provides a backport. Plan to upgrade. |
One catch: Linux distributions often fix the problem without changing the main version number, so a server can show an older-looking number and still be patched. Your host or IT provider can confirm this by checking the package changelog for the two CVE numbers.
To see which PHP version a WordPress site uses, go to Tools, Site Health, Info, Server in your WordPress dashboard.
Who has to fix it?
This depends on how your website is hosted, and it is the question most businesses cannot answer straight away.
| How your site is hosted | Who patches PHP | What you should do |
|---|---|---|
| Shared hosting or managed WordPress hosting | Your hosting provider | Ask them in writing whether the fixed PHP is installed on your server |
| A virtual private server (VPS) or dedicated server managed by your host | Usually your host, but check your agreement | Confirm who is responsible and when it was done |
| An unmanaged VPS or your own server | You, or your IT provider | Update PHP from your Linux distribution and restart PHP-FPM or Apache |
| A server on an operating system that is no longer supported | Nobody can patch it in the normal way | Protect it now and plan a move to a supported server |
Several large hosting companies have said they are patching shared hosting themselves, but that customers on a VPS or dedicated server must update PHP on their own. If you have a VPS, do not assume someone else has done it.
What to do today
- List every PHP website and web application you rely on, including your main website, any customer portal, booking system or intranet, and anything an agency built for you years ago.
- Find out who hosts each one and who is responsible for patching it. Ask for a written answer: “Is the fixed version of PHP for CVE-2026-109618 and CVE-2026-109619 installed on our server, and when was it installed?” A reply about firewall protection is not the same as a patched server.
- If you manage the server yourself, install the fixed PHP packages from your Linux distribution and restart PHP-FPM or Apache so the new version is actually running.
- If it cannot be patched today, put the site behind Cloudflare with the proxy switched on. Cloudflare has deployed firewall rules for the known attacks, and they are available on every plan, including the free one. Treat this as a stopgap, not a fix. For anything holding customer data, follow the NCSC’s advice and consider taking it offline until it is fixed.
- Check for signs of an attack (see the list below), because some servers will have been targeted before they were patched.
- Plan to move anything on PHP 8.1 or older, or on an operating system that no longer gets updates. PHP 8.2 also reaches the end of support on 31 December 2026, so it is worth moving straight to 8.3 or newer.
Why old servers are the real problem
A patched, supported server can be fixed in minutes. The businesses with a real problem are the ones whose website sits on a server running an operating system that has reached end of life. Those servers cannot receive the updated PHP packages in the normal way, so the flaw stays open.
Rebuilding on a supported operating system, such as a current Ubuntu LTS or Debian release, with a supported version of PHP is the only lasting fix. A move also gives you a chance to set up proper backups and automatic security updates, so the next PHP flaw is a routine update rather than an emergency. Ask your provider two questions: what operating system your server runs, and when it stops getting security updates.
Signs your server may already have been attacked
Patching stops new attacks but does not remove an attacker who is already in. Researchers and incident response teams suggest checking for:
- New or unfamiliar .php files, especially in upload folders such as wp-content/uploads
- Administrator accounts or plugins you do not recognise
- New scheduled tasks (cron jobs) on the server
- Spam pages appearing in Google results for your site, or malware warnings from your host or browser
- Server logs showing bursts of out-of-memory errors or repeated server errors, or PHP processes restarting for no clear reason
If you find anything, restore from a backup taken before the problem started, change every password connected to the site and server, and get help before putting it back online.
Not sure where your website is hosted, or who is meant to be patching it? Our cyber security team in Arundel and Chichester can check your websites and web applications, confirm whether they are patched and move anything that cannot be patched onto a supported server. We are Cyber Essentials certified and have supported businesses since 2015. For anything urgent, call us on 01903 255 159.
Frequently asked questions
What is PHP2Shell?
PHP2Shell is the name for two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10. They can let an attacker run code on a web server without logging in. Fixed versions of PHP were released on 21 October 2026.
Does updating WordPress fix PHP2Shell?
No. The flaws are in PHP, the software WordPress runs on, not in WordPress or its plugins. The PHP software on the server has to be updated, which is normally done by your hosting provider or whoever manages your server.
How do I know if my website is affected?
If your website runs on PHP, assume it is affected until your host confirms the server runs a fixed version: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a Linux distribution package that includes the fix. In WordPress you can see the PHP version under Tools, Site Health, Info, Server.
Is PHP 8.1 or 7.4 still safe to use?
Not without extra work. The PHP project no longer releases updates for 8.1 and older. Some Linux distributions and paid long-term support vendors have released their own fixes, but the safest route is to upgrade to PHP 8.3 or newer on a supported server.
Does Cloudflare protect against PHP2Shell?
Partly, and only for now. Cloudflare has deployed firewall rules for the known attack methods on all plans, and a site behind Cloudflare is harder to attack. Attackers have already been changing their methods to get around firewall rules, so it does not replace updating PHP.
Sources
- The Hacker News: PHP issues emergency patches for two critical PHP2Shell RCE flaws, 21 October 2026
- BleepingComputer: PHP ships emergency patches for critical PHP2Shell flaws, 21 October 2026
- Help Net Security: PHP2Shell, critical PHP vulnerabilities patched, 21 October 2026
- ITPro: Security agencies warn patch now or take systems offline, including the NCSC’s advice
- Digital Applied: PHP2Shell fixes by distribution, control panel and PHP version
- Meow Apps: PHP2Shell, what to do on your WordPress site
This article reflects what was known on 21 October 2026. The situation is moving quickly and we will update it as more is confirmed.
Free • 12 minutes • Written PDF report
Who actually holds the keys to your systems?
List the systems your business runs, answer plain-English questions about how they are controlled, and get a report with a red, amber and green rating for every area and what to fix first. Nothing on your systems is touched.
Cyber Essentials certified · Microsoft Partner · rated 5.0 on Google