PHP2Shell: What the New PHP Vulnerability Means for Your Website (and How to Fix It)

PHP2Shell is the name for two critical security flaws in PHP, the programming language that runs WordPress and most small business websites. They were disclosed on 21 October 2026, and they can let an attacker take over a web server without logging in. The fix is simple: make sure your site runs PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer, and if it runs anything older than PHP 8.2, upgrade.

You do not need to be technical to handle this. Below we explain what PHP2Shell is, how to check your PHP version in about two minutes, and what to say to your hosting company.

What is PHP2Shell, in plain English?

PHP is the engine under the hood of your website. When someone visits a page, PHP builds that page on your server. WordPress, WooCommerce, Drupal and Joomla all run on it. According to Imperva, PHP is used by over 69% of websites whose server-side language is known.

PHP2Shell is a pair of bugs in how PHP cleans up after a request goes wrong. The official PHP security announcement describes them like this:

• CVE-2026-109618: when PHP runs out of memory, it can be stopped halfway through setting up a request, and later clean-up code may treat that half-finished data as valid.
• CVE-2026-109619: some data from one request can survive after it should have been thrown away, and a later request on the same server process may use it.

In simple terms, an attacker can send specially crafted traffic that confuses PHP’s memory. In the worst case, that lets them run their own code on your server. That is called PHP remote code execution, and it is the most serious kind of web flaw. The researchers behind the PHP2Shell disclosure site also warn that attackers could read passwords, API keys and other secrets from server memory, sometimes without taking full control first.

The flaws were found by researchers at Wiz, OpenAI and Calif, and coordinated with the PHP security team. Details leaked online on 20 October, a day before the planned release, according to Huntress. That is why the patches came out in a rush.

One thing to clear up: PHP2Shell is not the same as WP2Shell, a separate WordPress core flaw fixed in July 2026 in WordPress 7.0.2, 6.9.5 and 6.8.6. The names are similar, but the fixes are different.

How serious is this PHP vulnerability?

Very. The PHP project rates both flaws 9.2 out of 10 (critical) on the CVSS v4.0 scale. Most sources, including Imperva and watchTowr’s FAQ, use that 9.2 score. You may also see 10.0 quoted. The Wikipedia summary attributes a 10.0 rating to watchTowr. Either way, the message is the same: treat it as urgent.

Reports on attacks also differ, which is normal in the first days of a big disclosure:

• Cloudflare said it was seeing early attack attempts before the patches were public, as reported by BleepingComputer.
• watchTowr reported exploitation in its honeypot network on 21 October.
• Huntress said it had not seen attacks across its customers as of the afternoon of 21 October.
• The UK’s National Cyber Security Centre urged organisations to update immediately or consider taking unpatched systems offline, according to Help Net Security.

Imperva notes that turning these bugs into a full takeover is technically hard. But a working exploit has been shown, and attackers scan the whole internet automatically. Small sites are not too small to be hit.

Is my website affected by PHP2Shell?

Probably, until you check. The PHP announcement says every PHP installation that serves web requests is at risk. That includes the common setups hosts use: PHP-FPM, Apache with mod_php, php-cgi, LiteSpeed and FrankenPHP.

Sources disagree a little on how far back the problem goes. The researchers and Cloudflare say PHP 5.4 and later. watchTowr and some news reports say PHP 5 onward. For a business owner the difference does not matter: if your site runs any PHP version below the fixed releases, assume it is affected.

Your site is not affected if it is a fully hosted platform where you never deal with PHP, such as Wix or Squarespace. Those companies manage their own servers. If you have a WordPress site, a WooCommerce store or a custom PHP site, read on.

Which PHP versions are fixed?

Here is every PHP branch and its status, based on the PHP security announcement and the PHP supported versions page.

Some Linux vendors and long-term support providers also ship their own patched packages for older branches. If your host says your PHP 8.1 is “patched”, ask them to confirm it in writing. Even then, plan your upgrade, because no one will patch end-of-life PHP forever.

How do I check my PHP version in WordPress?

It takes about two minutes:

1. Log in to your WordPress dashboard.
2. Go to Tools, then Site Health.
3. Click the Info tab.
4. Open the Server section and look for PHP version.

Compare the number with the table above. For example, 8.3.35 is not safe, but 8.3.36 is. If you do not use WordPress, your hosting control panel (cPanel, Plesk or your host’s own dashboard) usually shows the PHP version too. Our step-by-step guide on how to check and update PHP in WordPress has screenshots for the most common hosts.

A quick note from our own research. In October 2026 we ran a passive audit of 94 local business websites in Dallas and Houston. Only 7 showed their PHP version publicly, and 2 of those were on end-of-life PHP (7.4 and 8.0). Most hosts hide the version, so we cannot say how common old PHP is. But it shows that old PHP is still out there on real business sites.

What should I do right now?

What you do depends on how your site is hosted. Here are the three common cases.

Shared or managed WordPress hosting

This is most small businesses. Your host controls PHP, and many large hosts patch their servers for you. But do not assume. Check your PHP version in Site Health. If it is not a fixed version, send your host a short message:

“Hi, please confirm my site is running a PHP version patched for PHP2Shell (CVE-2026-109618 and CVE-2026-109619): 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer. If my site is on PHP 8.1 or older, please tell me how to move to a supported version.”

Many hosts also let you pick the PHP version yourself in the control panel. If you switch, take a backup first and check your site afterwards, because very old themes and plugins sometimes break on newer PHP.

VPS or your own server

If you or a developer manage the server, install the patched PHP package from your Linux distribution or your PHP source. Then restart Apache, PHP-FPM or any long-running PHP workers, because the old code stays in memory until you do. The researchers stress this restart step on the PHP2Shell site.

Docker or containers

If your site runs in a container, updating the server is not enough. Rebuild your image on a patched PHP base image (for example, the 8.3.36 or newer tag), then redeploy. Old containers keep running old PHP until they are replaced. Our guide to installing BillionMail on a Hostinger VPS shows this rebuild-and-redeploy process on a real Docker app.

If you are on PHP 8.1 or older

This is the hard case. There is no simple patch to click. You need to move to PHP 8.3 or 8.4, which may mean updating old themes and plugins first. If your site was built years ago and nobody has touched it since, this is where things can break. A developer can test the upgrade on a copy of your site before touching the live one. If the site is too old to upgrade cleanly, it may be time for a website redesign on a modern, supported setup.

Does Cloudflare or a firewall protect me from PHP2Shell?

Partly. Cloudflare says it deployed web application firewall (WAF) rules about nine hours before public disclosure, and they are on automatically for all plans with the WAF enabled, including the free plan. Imperva says its Cloud WAF customers are also covered.

But Cloudflare itself calls the WAF a layer of defence, not a fix. It reported that attackers were already changing their attacks to try to get around the rules. A firewall only helps if all traffic goes through it, and it cannot fix the bug inside PHP. Use it to buy time, then update PHP anyway.

How can I tell if my site was hacked?

The researchers and security firms list some technical warning signs, such as repeated “500” server errors, unexplained PHP crashes and new files in your website folders. Huntress also flags new scheduled tasks and new user accounts. For a business owner, watch for these:

• New admin users in WordPress that you did not create.
• Your site redirecting visitors to spam, gambling or fake shop pages.
• Google showing “This site may be hacked” next to your listing.
• Your host emailing you about malware, or suspending your account.
• Strange files or folders you did not add, or a site that suddenly slows down or shows errors.

No warning signs does not prove you are safe. If your site ran unpatched PHP during the attack window, it is wise to change your WordPress, hosting and database passwords after you update, because the flaws can expose secrets from memory. Our WordPress security checklist covers the rest of the basics.

What should I do if my site has been hacked?

Do not panic, and do not just delete the strange files you can see. Attackers often leave hidden back doors. In short:

1. Contact your host and tell them you suspect a compromise. Ask them to keep the server logs.
2. Update PHP to a fixed version, or have your host do it.
3. Restore a clean backup from before the attack, if you have one, then update everything.
4. Change all passwords: WordPress users, hosting, database, email and any API keys stored on the site.
5. Scan the site again and ask Google to review it if it was flagged.

Our full guide on what to do when your WordPress site is hacked walks through each step in detail. If Google already shows a warning next to your site, see how to remove the “This site may be hacked” label.

Frequently Asked Questions

Want us to check your site?

If you are not sure which PHP version your site runs, or you are worried an upgrade will break something, we can help. We will check your site for free and tell you whether you are affected. If you need it, we can update PHP safely, testing on a copy of your site first, or move an older site to a modern, supported WordPress build. Get in touch for a free website check, and we reply within 24 hours.