Schedule Free Demo

PHP2Shell: What Website Owners Need to Do This Week

PHP2Shell: What Website Owners Need to Do This Week

On 21 October 2026 the PHP team released emergency security updates
for two critical flaws in PHP itself, now widely called
PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Both
are rated 9.2 out of 10. They let an attacker run code on a web server
without logging in, and attacks have been reported. If
your website runs on PHP (that includes every WordPress, WooCommerce,
OpenCart and Laravel site), the fix is a PHP update on the server, not a
plugin update.

What happened

According to the PHP security
advisory, both flaws are in the PHP engine, not in WordPress or any
plugin:

  • CVE-2026-109618: memory corruption when PHP runs
    out of memory part-way through setting up a request, leading to remote
    code execution.
  • CVE-2026-109619: request data left accessible in
    memory after it has been freed, leading to remote code execution and
    leaks of data held in memory, such as passwords and keys.

The PHP team says the highest risk is on Apache servers running PHP
as a module (mod_php), where a single request can trigger the attack
before your website’s own code even runs.

Which versions are fixed

PHP branch Fixed version Status
8.5 8.5.12 Patched 21 Oct 2026
8.4 8.4.27 Patched 21 Oct 2026
8.3 8.3.36 Patched 21 Oct 2026
8.2 8.2.35 Patched 21 Oct 2026
8.1, 8.0, 7.4 and older No official release End of life. The PHP team published source-only fixes for 7.4, 8.0
and 8.1; some hosting platforms ship their own patched builds

If your site runs on PHP 8.1 or older, assume it is exposed until
your host confirms otherwise. The lasting fix is to move to a supported
version.

Step 1: find
out which PHP version your site uses

  • In cPanel: open MultiPHP Manager
    (under Software) to see the version set for each domain. On CloudLinux
    servers it is called Select PHP Version.
  • In WordPress: go to Tools → Site Health →
    Info → Server    . It shows the PHP version.
  • No access? Ask your hosting company directly:
    “Which PHP version is my site on, and has it been updated to the 21
    October security release?”

Step 2: get the server
patched

The update is installed on the server, so for most shared and managed
hosting it is your host’s job. Ask them to confirm the exact version now
running (for example 8.3.36, not just “8.3”). If you manage your own VPS
or dedicated server, update PHP from your distribution or control panel
and restart the web server and PHP-FPM.

A workaround has been circulating: turning off
session.upload_progress. It blocks only one of the two
flaws (CVE-2026-109619), so it is not a substitute for updating.

Step 3:
if you are on PHP 8.1 or older, plan the upgrade

Older sites often stay on old PHP because something breaks when the
version changes: an outdated theme, an abandoned plugin, or custom code
written years ago. Moving up usually means:

  1. A full backup of files and database.
  2. A copy of the site on the new PHP version, to find what breaks.
  3. Fixing or replacing incompatible code, themes and plugins.
  4. Switching the live site over, then watching the error logs for a few
    days.

For a typical WordPress site with maintained plugins this is quick.
Custom PHP applications and stores built years ago take longer, because
the code itself needs changes.

Step 4:
check whether anything was already compromised

Attacks were reported before many servers were patched, so a quick
check is worth it:

  • New administrator users you did not create (in WordPress: Users →
    filter by Administrator).
  • Recently changed or unknown .php files in your web
    folder, especially in upload folders.
  • Scheduled tasks (cron jobs) you do not recognise.
  • Redirects to strange sites, or spam pages appearing under your
    domain in Google.
  • Unexpected spikes in outgoing email from your server.

If you find any of these, change all passwords (hosting, database,
WordPress admins, FTP), restore from a clean backup where possible, and
have the site cleaned before you update anything else.

Frequently asked questions

Is WordPress itself vulnerable? The flaws are in
PHP, the language WordPress runs on, so any WordPress site on an
unpatched PHP version is exposed. Updating WordPress or plugins does not
fix it; updating PHP on the server does.

Is there a plugin that fixes PHP2Shell? No. A
security plugin can help you spot signs of an attack, but the fix is the
PHP update.

My host says I am on PHP 8.3. Am I safe? Only if it
is 8.3.36 or later. Ask for the exact version number.

I am on PHP 7.4 or 8.1. What now? Ask your host
whether they run a patched build of your version. Either way, plan the
move to PHP 8.2 or newer: those branches receive official security
fixes.

Need help?

Global IT Vision maintains and upgrades PHP websites for clients
worldwide: WordPress, WooCommerce, OpenCart, Laravel, CodeIgniter and
custom PHP. We can check your PHP version, upgrade older sites to a
supported release, and look for signs of compromise. See our website
maintenance plans or our WordPress
maintenance services, or contact us for a quote.