PHP2Shell: What the Critical PHP Security Flaw Means for Your Website (and What to Do Today)
By the Web Support Team · October 22, 2026
If you tried to visit a government website this week and found it offline, you saw the effects of a major security scare. On October 21, 2026, the PHP project released emergency fixes for two critical vulnerabilities known as PHP2Shell. Agencies and organizations around the world took sites offline while they patched, and security agencies urged everyone else to update immediately.
If you own a website, here is what happened, whether you are affected, and exactly what to do about it.
What is PHP, and why does this matter?
PHP is the programming language that builds and delivers web pages on the server. According to W3Techs, it powers roughly 75% of websites whose language can be identified. That includes every WordPress site, along with many online stores, membership sites, booking systems, and custom business applications.
Because PHP is so widespread, a serious flaw in it affects a huge number of sites at once. That is why this story spread so quickly.
What is PHP2Shell?
PHP2Shell is the nickname for two critical flaws:
- CVE-2026-109618 is a remote code execution flaw caused by memory corruption when a server runs out of memory partway through handling a request.
- CVE-2026-109619 is a remote code execution flaw caused by stale internal state.
“Remote code execution” means an attacker could potentially run their own commands on your web server over the internet, in some cases without needing to log in. From there, attackers can steal data, deface pages, plant malware, or use your server to attack others.
Security researchers and vendors reported that exploitation attempts were already underway. Amazon’s threat intelligence team recorded an attempt on October 17, four days before the public disclosure. That is why some organizations took systems offline before patching.
Is my website affected?
PHP’s own advisory says all PHP installations serving web requests are at risk. That includes the common setups: Apache, PHP-FPM, LiteSpeed, and others. If your site runs on PHP and the fix has not been applied, it should be treated as exposed.
A few important points:
- This is not a WordPress problem. The fix is not a WordPress, plugin, or theme update. It has to be applied to PHP itself on the server.
- Your host may already have handled it. Many managed hosts are patching for customers. But some have only scheduled the update, and some customers are on servers that nobody actively maintains.
- Old PHP versions are the biggest worry. The PHP project released fixes for versions 8.5, 8.4, 8.3, and 8.2. PHP 8.1 and older, including 7.x and 5.x, are not receiving fixes from the PHP project. Some Linux distributions and security vendors are offering their own backported patches, but sites on unsupported versions face the highest risk.
Which PHP versions contain the fix?
The fixed releases are:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Note that PHP 8.2 reaches the end of its security support on December 31, 2026, so sites on that version should plan an upgrade soon.
If you use a Linux server with packages from your distribution, the patched package might not show these exact numbers. Some distributions apply the fix to the existing version number, so check your vendor’s security notice instead of relying on the version string alone.
How to check what PHP version your site is using
- Ask your host. Contact your hosting provider and ask: “Has the October 21 PHP security fix for CVE-2026-109618 and CVE-2026-109619 been installed on my account?” Ask for a written answer.
- Check your hosting control panel. Many panels (cPanel, Plesk, and others) show which PHP version each site uses.
- In WordPress, go to Tools > Site Health > Info > Server to see the PHP version.
- Do not rely on the command line alone. Running a version check on the server’s command line may show a different PHP than the one that serves your website.
Remember, the version number tells you which branch you are on. It does not always prove the fix is installed, so get confirmation from your host or a technician.
What to do right now
If you are on managed or shared hosting: contact your host today and ask for written confirmation that the fix is installed, not just scheduled. If they cannot confirm, ask what interim protections are in place.
If you run your own server (VPS or dedicated): install the vendor’s patched PHP packages, restart PHP and your web server so the new version is actually in use, and test your site.
If you are on an old PHP version: plan an upgrade to a supported release, or ask about a vendor-supported backport as a short-term measure. Test on a staging copy first, because older themes and plugins can break on newer PHP.
If you cannot patch right away: consider a web application firewall as a temporary layer of protection, and be prepared to take the site offline until it is fixed, as many governments did. A firewall rule is a stopgap, not a fix.
Check for signs of compromise: because attempts began before the patch existed, look for warning signs such as unknown admin accounts, recently modified or unfamiliar PHP files, unexpected scheduled tasks, and unusual activity in your logs. If you find anything suspicious, stop and call a professional before making changes.
Beware of scams
Events like this attract fraudsters. Expect fake emails claiming “your website has been hacked” or offering a “critical PHP patch” to download. Do not click links or install software from unsolicited messages. Get information from your hosting provider and from official sources such as the PHP project’s security advisory and your national cybersecurity agency.
Frequently asked questions
Do I need to do anything if I use WordPress? Yes, indirectly. WordPress runs on PHP, so the server it runs on needs the PHP fix. Updating WordPress itself does not install it.
Will my site go down while it is patched? Patching usually requires a brief restart of PHP or the web server. It is typically short, and it is best done at a quiet time with a backup in place.
Is my site already hacked? Not necessarily. But because some exploitation attempts occurred before the patch was released, a basic check for warning signs is a smart precaution.
Can I just wait and see? We do not recommend it. Critical remote code execution flaws tend to be exploited quickly and at scale once details are public.
Need help?
If you are not sure whether your site is protected, our team can help. The PHP Patch Check from Web Support Team confirms which PHP version your sites are really running, verifies that the official fix is installed, runs a basic review for signs of unauthorized access, and gives you a clear written report.
Email us at [email protected].
To keep your site updated, backed up, and monitored going forward, see our WordPress Site Care plan.
This article is for general information and reflects details available as of October 22, 2026. Security details can change as vendors release updates, so always confirm with the PHP project’s advisory and your hosting provider.
Recent Comments