PHP2Shell: Is Your Website Safe? A Plain-English Guide to Fixing the 2026 PHP Vulnerability

If your website runs on PHP, this week matters.

On October 21, 2026, the PHP team pushed out emergency updates for two critical flaws now known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Both are rated 9.2 out of 10. In plain terms, they can let a stranger run their own code on your web server without logging in, guessing a password, or finding a bug in your site.

That’s a big deal, because PHP sits underneath WordPress, WooCommerce, Magento, Drupal, Joomla, PrestaShop, Laravel and a huge share of the business websites online today.

The good news? Fixing it is usually quick. Most site owners can check their status in five minutes and close the gap the same day. This guide shows you exactly how, even if you’ve never opened a server panel in your life.

The Short Answer

Your site is at risk if it runs any PHP version older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Updating WordPress, plugins or themes does not fix it. You (or your host) need to update PHP itself, restart it, and confirm the new version is live. If you’re on PHP 8.1 or older, there’s no official patch at all, so moving to PHP 8.3 or newer is the real fix.

What Is PHP2Shell, in Simple Words?

Think of your website as a shop. WordPress, your theme and your plugins are the shelves, the products and the shop sign. PHP is the building they sit inside.

Most security news is about a broken shelf: a bad plugin, a weak password, an outdated theme. PHP2Shell is different. The weak spot is in the building’s foundation. So even a shop with perfect shelves is exposed if the building hasn’t been repaired.

On the technical side, both bugs are about how PHP handles memory while it processes a web request. One appears when PHP runs out of memory midway through setting up a request. The other leaves leftover data from an earlier visitor lying around for the next request to stumble on. A skilled attacker can turn either one into full control of the server.

There’s a second risk people miss. According to the researchers, an attacker can also peek into the server’s working memory. That memory can hold passwords, login tokens, payment API keys and other secrets from your visitors’ requests.

Why This One Is More Serious Than a Normal Security Alert

A few things set PHP2Shell apart from the usual “please update your plugins” warning:

• No login needed. The attacker doesn’t need an account on your site.
• Your own code doesn’t matter. Researchers showed that even a bare “Hello World” page on an affected PHP version can be attacked.
• It affects more than a decade of PHP. Every release from PHP 5.4 up to the latest 8.5 build before the fix is affected by at least one of the two bugs.
• Details leaked early. Information spread on social media on October 20, a day before the patch was ready, so attackers got a head start.
• Attacks have already been seen. Cloudflare reported early attack traffic before the fix shipped, and the security firm watchTowr reported active exploitation attempts on release day. No confirmed break-in had been publicly reported at that point, but nobody should wait for one.

The U.S. cybersecurity agency CISA issued an alert the same day, urging organizations to patch immediately. Some organizations, including government services in the Netherlands and the HR platform BambooHR, briefly took services offline as a precaution while they patched.

One more detail is worth knowing. The flaws were found by Wiz, Calif and OpenAI’s security team, who say AI tools helped them turn decade-old weaknesses into working attacks in about a week. That speed works for attackers too. The gap between “bug announced” and “bug exploited” keeps getting shorter.

Does Updating WordPress Fix PHP2Shell?

No, and this is the single biggest misunderstanding we’re seeing.

When you click “Update” inside WordPress, you update WordPress files. The PHP engine running underneath comes from your hosting server, your control panel or your Docker image. Those are separate.

So you can have WordPress 100% up to date, every plugin patched, a security plugin installed, and still be running a vulnerable PHP version. A firewall plugin can’t repair the engine it runs on.

The same applies to Magento, Drupal, Laravel, Symfony, PrestaShop and any custom PHP application. Your app and your PHP version are two different things to update.

Which PHP Versions Are Affected?

Here is the quick reference. Find your branch, then compare your exact version.

Your PHP version	Status	What to do
8.5.x below 8.5.12	Vulnerable	Update to 8.5.12 or later
8.4.x below 8.4.27	Vulnerable	Update to 8.4.27 or later
8.3.x below 8.3.36	Vulnerable	Update to 8.3.36 or later
8.2.x below 8.2.35	Vulnerable	Update to 8.2.35, then plan a move to 8.3+ (8.2 support ends December 31, 2026)
8.1, 8.0, 7.4 or older	Vulnerable, no official fix	Upgrade to PHP 8.3 or newer

That last row is where most of the real risk sits. Industry figures based on WordPress.org data suggest roughly a third of WordPress sites still run a PHP version that no longer gets security fixes, and around one in six are still on PHP 7.4. If that’s you, a quick patch isn’t on the table. You need an upgrade.

A note for people on Linux servers: distributions such as Debian and Ubuntu sometimes ship the fix under an older-looking version number. If PHP came from your server’s package manager, check the package changelog for the two CVE numbers rather than trusting the version string alone.

How to Check Your PHP Version in 5 Minutes

Pick whichever method fits how your site is hosted.

Option 1: Inside WordPress (easiest)

1. Log in to your WordPress dashboard.
2. Go to Tools → Site Health → Info.
3. Open the Server section and look for “PHP version.”

Option 2: In your hosting control panel

In cPanel, look for Select PHP Version or MultiPHP Manager. In Plesk, open your domain and check PHP Settings. Managed hosts like SiteGround, Kinsta or WP Engine usually show it on the site’s dashboard page.

Option 3: On a server you manage

Run php -v over SSH. But be careful: the command-line PHP and the PHP serving your website are often different installs. To see the real one, check what PHP-FPM or Apache is using, or temporarily upload a phpinfo() file, read the version, and delete the file straight away.

If you see a version from the vulnerable rows above, move on to the steps below.

7 Steps to Protect Your Website From PHP2Shell

These are the steps we’d follow on any client site, in this order.

1. Take a fresh, full backup

Back up your files and your database before touching anything. Then make sure you know how to restore it. A backup you’ve never tested is a hope, not a plan.

2. Ask your host whether they’ve already patched

Many managed hosts patched their servers within hours. SiteGround, for example, confirmed fixes across all its servers on October 22. Check your host’s status page or send a short support ticket asking: “Is my server running a patched PHP build for CVE-2026-109618 and CVE-2026-109619?” Get the answer in writing.

3. Update PHP to a fixed release

If you control the version, switch to a patched build. On shared hosting this is usually one dropdown in the control panel. On a VPS or dedicated server, install the updated packages from your distribution or the official release.

4. Restart PHP and your web server

This step gets skipped a lot. A PHP process that started before the update keeps running the old, vulnerable code. Restart PHP-FPM, Apache and any long-running PHP workers. A full server reboot also works.

5. Confirm the new version is actually live

Repeat the version check from the section above. Check every site, staging copy and subdomain you own. Old staging sites and forgotten landing pages on a separate subdomain are exactly what attackers scan for.

6. Test the site properly

The fix adds a new hard memory limit, so heavy pages, imports or uploads might behave differently. Click through your key pages, submit your contact form, run a test checkout if you sell online, and check your error logs. Our website migration QA checklist works well here too.

7. Change your important passwords and keys

Because PHP2Shell can expose server memory, it’s sensible to rotate secrets on any site that ran a vulnerable version while it was public. That means admin passwords, database passwords, payment gateway API keys, SMTP passwords and any third-party tokens stored in your config.

What If You’re Stuck on PHP 8.1, 8.0 or 7.4?

This is the tough spot, and honestly, it’s where a lot of small business sites are.

The PHP project no longer releases updates for these versions. The PHP security team did publish source-code backports for 7.4, 8.0 and 8.1, but they’re meant for people who compile PHP themselves or are waiting on a vendor. Most site owners can’t use them directly.

So you have three realistic options:

1. Upgrade to PHP 8.3 or newer. This is the proper fix. On a well-maintained site it can take an afternoon. On an older site with abandoned plugins or custom code, it needs testing on a staging copy first, because some code written for PHP 7 breaks on PHP 8.
2. Use an extended-support vendor or a host that backports fixes. Some Linux vendors and managed hosts maintain patched builds of older versions. Ask your host directly.
3. Rebuild or modernize the site. If the site is old enough that a PHP upgrade breaks half of it, it’s often cheaper long-term to rebuild it on a current stack than to keep patching. That’s the conversation we usually have around application modernization or a website redesign.

Whatever you choose, don’t skip the jump to 8.2 and stop there. PHP 8.2 reaches end of life on December 31, 2026, so you’d be doing this all again in ten weeks. Going straight to 8.3 or 8.4 saves you a second upgrade.

Can’t Update Today? Reduce the Risk in the Meantime

If an upgrade has to wait a day or two, these stopgaps help. They are not a fix, and the PHP team is clear that only updating fully protects you.

• Turn on a web application firewall such as Cloudflare. Cloudflare rolled out PHP2Shell rules by default, though it also saw attackers tweaking payloads to slip past them.
• Ask your developer to set session.upload_progress.enabled = 0 and restart PHP. This blocks one confirmed attack path, not all of them.
• Keep upload and request size limits low at the server or proxy level.
• Put the site behind maintenance mode or basic auth if it doesn’t need to be public right now, such as an old staging site.

Signs Your Site May Already Have Been Targeted

If your site was on a vulnerable version between October 17 and the day you patched, it’s worth a quick look. Researchers suggest watching for:

• Bursts of HTTP 500 errors you can’t explain
• “Allowed memory size exhausted” errors in your PHP logs, especially alongside odd file-upload requests
• Unusually large PHPSESSID cookies in server responses
• PHP workers restarting on their own
• New admin users, unknown files in your uploads folder, or strange scheduled tasks

If you spot any of these, don’t just patch and move on. Get the site scanned and cleaned, rotate every password and key, and check for backdoors left behind. Patching closes the door, but it won’t remove someone who’s already inside.

Not sure where your site stands? Our PHP development team can check your PHP version, patch status and upgrade path, and tell you in plain English what needs doing. Request a free website security check.

A Quick Note for Store Owners and Agencies

Online stores carry the most risk here, because they hold customer data and payment credentials. If you run a WooCommerce shop, a Magento store, a PrestaShop site or a Drupal build, treat this as urgent, and test checkout after the update. Our PrestaShop upgrade checklist covers the checkout tests worth running.

Agencies and freelancers managing many client sites should make a simple list: every domain, its host, its PHP version, and who’s responsible for updating it. Then work from the oldest version down.

How to Avoid the Next PHP2Shell

There will be another one. The aim is to make the next fire drill a ten-minute job instead of a panic.

• Know your versions. Keep a one-page record of every site, its host and its PHP version.
• Stay on a supported PHP branch. Plan PHP upgrades yearly, not when something breaks.
• Delete what you don’t use. Old staging sites, test installs and abandoned subdomains are easy targets.
• Pick hosting that patches for you. Managed hosts that apply server-level fixes quickly are worth the extra few dollars a month.
• Have someone on call. Either an in-house person or a partner who handles WordPress maintenance and development and server updates when alerts like this land.

For more on keeping a WordPress site healthy long term, see our guide to WordPress best practices. And if your business stores customer details, our post on customer data security is a good next read.

Frequently Asked Questions

Is my website vulnerable to PHP2Shell?

If your site runs PHP and the version is older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35, assume yes until you’ve confirmed otherwise. Any PHP setup that serves web pages is affected, including PHP-FPM, Apache mod_php, LiteSpeed and FrankenPHP.

Does a security plugin like Wordfence protect me?

Not on its own. Security plugins run inside WordPress, which runs on PHP. They can’t fix a flaw in PHP itself. A server-level firewall can reduce risk for a short time, but updating PHP is the only full fix.

What PHP version is safe right now?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or any later release on those branches. For long-term peace of mind, PHP 8.3 or newer is the better choice, since 8.2 support ends on December 31, 2026.

Will updating PHP break my website?

Going from one patch release to another within the same branch, such as 8.3.30 to 8.3.36, rarely breaks anything. Jumping from PHP 7.4 or 8.0 to PHP 8.3 can break old plugins, themes or custom code. Test on a staging copy first, or ask a developer to do it.

How do I update PHP on shared hosting?

In most control panels, open Select PHP Version or MultiPHP Manager, choose the newer version for your domain, and save. If you don’t see a patched build listed, contact your host and ask when it will be available.

I’m on a managed host. Do I need to do anything?

Probably less than others, but still check. Confirm with your host that your server runs a patched build, then check your PHP version yourself. If you’re on PHP 8.1 or older, your host may not be able to patch it at all, and you’ll need to upgrade.

Your Next Step

PHP2Shell is serious, but it isn’t complicated to fix. Check your PHP version today. If it’s on the vulnerable list, update it, restart it, confirm it, and change your important passwords. If you’re stuck on an old version, plan the upgrade now rather than after something goes wrong.

And if you’d rather hand it to someone who does this every day, that’s what we’re here for. Our WordPress experts and cloud engineering team can audit, patch and upgrade your site safely, with a staging test and rollback plan in place.

Get a free PHP2Shell security check for your website →