PHP2Shell: what the new PHP flaw means for your business website

On 21 October 2026, PHP fixed two serious flaws, nicknamed PHP2Shell, that let an attacker take over a web server without logging in. If your website runs on WordPress, WooCommerce, Drupal or Joomla, it runs on PHP, so it needs this fix. Updating WordPress won't help, because the flaw sits in PHP itself, so the fix has to come from whoever runs your server.

This post reflects what was public on 24 October 2026, when we last checked every source. Reports about attacks are changing every day, so check the date before you act on the details.

What to do right now

You can protect your website today in three steps, and none of them require technical knowledge.

1. Open your WordPress dashboard and check your PHP version under Tools, then Site Health. Version 8.5.12, 8.4.27, 8.3.36, 8.2.35 or anything newer already includes the fix.
2. If it's older or you're unsure, email your host using the template below and ask for written confirmation.
3. If you don't know who manages your server, or your host can't confirm the fix, contact us and we'll check it for you.

The rest of this post explains each step in detail and shows how to tell whether the flaws affect your website. It also includes a technical checklist to forward to your developer.

What is PHP2Shell?

PHP is the language that runs most websites, and W3Techs finds it on 69.3% of the sites where it can tell what the server runs. WordPress uses PHP, and so do the plugins and themes that most small business sites depend on.

PHP2Shell is the name for two flaws, CVE-2026-109618 and CVE-2026-109619. A CVE number is the public ID that security teams use to track one specific flaw. PHP rates both flaws 9.2 out of 10 for severity, because an attacker who uses them can run their own code on your server. From there, they could copy customer data, add spam pages or use your site to attack other people.

A team at Wiz, a security firm, found the flaws in August and showed the attack works on the latest WordPress, Drupal and Joomla. They also found that every PHP version going back to 5.4, which came out in 2012, has at least one of the two flaws.

Is my website affected?

It depends on what your site runs on and who manages its server, so find your situation in the table below.

If you're not sure what your site runs on or who hosts it, check your hosting invoice or ask whoever built the site.

Are attackers using it yet?

Attackers started early, before the fix even came out. Amazon's security team says a decoy server caught an attempt to use the flaws on 17 October, four days before PHP made them public. Amazon now sees broad attempts to use them, though it says it's unclear whether any of those attempts would work on real websites. Cloudflare has also reported early attempts against sites on its network.

CISA, the US government's cybersecurity agency, hadn't seen the flaws used in real attacks when it put out its alert on 21 October. As of 24 October, it still hadn't added them to its list of flaws known to be used in attacks.

Now that the details are public, more attackers can try them, so treat this as urgent even if nothing has happened to your site yet.

How to fix it, step by step

1. Check which PHP version your site uses

In your WordPress dashboard, go to Tools, then Site Health, and open the Server section on the Info tab to see your PHP version. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or anything newer.

If you don't use WordPress or can't reach the dashboard, run our free Website Security Check instead. When your server shows its PHP version, the check reads it and tells you whether a newer release is out. Many hosts hide the version, and some add the fix without changing the number, so ask your host to confirm either way.

An older number doesn't always mean you're at risk, because many hosts add the fix to your current version and keep its number the same. Hostinger, for example, says the number may not change on its managed plans, which is why the next step matters more.

2. Ask your host whether the fix is in place

Send your hosting company a short message like this one, which you can copy as it is:

Hi, my website is [your domain]. Have you applied the 21 October 2026 PHP security release (PHP2Shell) to my server? It covers CVE-2026-109618 and CVE-2026-109619. If my PHP version is no longer supported, please tell me which version I should move to.

Many large hosts have already answered this question on their status pages. Hostinger, for instance, says it finished installing the fix on every plan except VPS on 22 October. If your host can't give you a clear yes, move on to the next step.

3. If you manage your own server, update PHP now

If your site runs on a VPS or a cloud server that you or your developer look after, nobody else will patch it for you. PHP's own advisory says that updating PHP and restarting it is the only complete fix. Send the developer section at the end of this post to whoever manages the server.

4. Upgrade if you're on PHP 8.1 or older

PHP no longer fixes version 8.1 or anything older, yet W3Techs finds that about a third of PHP sites still run version 7 or older. Some hosts and Linux vendors are adding the fix to these old versions themselves, so ask yours first. If they aren't, plan a move to PHP 8.3 or newer, since 8.2 also stops getting fixes on 31 December 2026. Test your theme and plugins on a copy of the site before you switch, because older plugins can stop working on a newer PHP version.

CISA goes further and tells organizations to take servers on PHP 8.1 or older offline until someone can fix them. For a small business, the practical version of that advice is to make the upgrade this week rather than this quarter.

5. Put Cloudflare in front of your site as a stopgap

Cloudflare says it has added firewall rules that block the known attacks, and those rules cover its free plan too. If your site already runs through Cloudflare, you have some protection while you wait for your host. It isn't a fix, though, because a firewall rule only stops the attack patterns that are already known.

Signs your site may already have been broken into

Most attacks leave signs you can spot without technical knowledge, so if you see any of these, call your host or developer, or contact us.

• Someone has added administrator accounts in WordPress that nobody on your team created.
• Your site shows pages, links or redirects to sites you don't recognize, often selling pills, gambling or cheap goods.
• Google shows a "This site may be hacked" warning next to your site in its search results.
• Your website slows down for no obvious reason, starts showing error pages, or your hosting company suspends it.

If you see any of these, don't just delete the strange files and carry on. Ask your host or developer to apply the fix first, then restore a clean backup from before the attack. Once that's done, change all the passwords for your site, from your host's login to your WordPress one.

Forward this to your developer

This part is for whoever manages your server, and it sums up the technical steps from PHP's security advisory.

• Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install your distribution's patched package, then restart every PHP worker.
• PHP rates Apache with mod_php as the highest risk. There, a single request can trigger the attack before any of your site's code runs.
• Check the version your web server runs, such as PHP-FPM or mod_php, because php -v only reports the command-line build.
• Your Linux vendor's package may keep the old version number, so search its changelog for the two CVE IDs to confirm the fix. On Debian and Ubuntu, use apt changelog, and on Red Hat, use rpm -q --changelog.
• PHP 8.1 and older get no official release, but the PHP security team put small source fixes for 7.4, 8.0 and 8.1 on GitHub. Some vendors also ship their own patched packages.
• If you can't update today, set session.upload_progress.enabled=0 in php.ini or the FPM pool, then restart every worker. Setting it with ini_set() or .user.ini won't work. This only blocks the known paths for CVE-2026-109619, so treat it as a stopgap.
• For CVE-2026-109618, a low post_max_size and request size limits at the web server or proxy lower the risk. Even so, PHP is clear that no setting makes an installation safe.
• Watch your logs for multipart requests that hit the memory limit and for bursts of HTTP 500 errors. Very large PHPSESSID cookies are another warning sign, and so are PHP workers that start shells or download tools.

Fix it today, or let us handle it

Start today by checking your PHP version and emailing your hosting company, then follow up until they confirm the fix.

If you'd rather hand it off, contact us and we'll find out who manages your server and confirm whether the fix is in place. If it isn't, we'll explain exactly what needs to happen and who is responsible for doing it.

For the longer term, our maintenance plans cover your server and hosting as well as WordPress. When a security release like this one comes out, we confirm it's in place, so you don't have to chase anyone. We also look after sites we didn't build, and we start with a free audit so we know what we're taking on.