PHP2Shell: Is Your Website Vulnerable, and How Do You Fix It?

If your website runs on WordPress, Drupal, Joomla, Magento, Laravel, or almost any custom-built site, it probably runs on PHP. In October 2026, two critical security flaws in PHP were made public, and attackers started scanning for them within hours.

Here is what happened, how to tell if your website is affected, and what to do about it, in plain language.

Key Takeaways: PHP2Shell

• Two critical PHP flaws, nicknamed "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619), let an attacker run code on a web server without logging in.
• The fix is to update PHP itself to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 or newer. Updating WordPress or your plugins does not fix this.
• Older PHP versions (8.1, 8.0, 7.x and earlier) are affected and have no official fix. They need to be upgraded.
• CISA, the U.S. cybersecurity agency, added both flaws to its Known Exploited Vulnerabilities list on October 26, 2026.
• If you don't know which PHP version your site runs, that is your first question to answer this week.

What Is PHP, and Why Does It Matter?

PHP is the programming language running behind a large share of the world's websites. You never see it, but it is what builds your pages, processes your contact forms, and talks to your database. Think of it as the engine under the hood of your website. Your website's software (WordPress, for example) sits on top of PHP. Your web host or IT provider usually manages PHP on the server. That separation is exactly why this vulnerability is easy to miss: the people who update your website content are often not the people who update the server.

What Happened With PHP2Shell?

On October 21, 2026, the PHP project released emergency security updates for two critical flaws:

• CVE-2026-109618: a memory-handling bug that an attacker can trigger with a specially crafted web request, leading to code running on your server.
• CVE-2026-109619: a bug where PHP keeps using data after it has been thrown away, which researchers also showed can be turned into code running on your server.

Both are rated 9.2 out of 10 for severity. Neither requires a password or login. Researchers also showed the flaws can be used to read sensitive data from server memory, such as passwords, API keys, and security tokens. Most importantly, these are flaws in PHP itself, not in your website's code. A well-built, fully updated website is still exposed if the PHP underneath it has not been patched.

Is Anyone Actually Attacking This?

Yes, attackers are actively trying. Security companies reported exploitation attempts the same day the patch came out, and Cloudflare reported attempts growing from tens of thousands to millions within a day. On October 26, CISA added both flaws to its Known Exploited Vulnerabilities catalog, which is the government's list of security holes that need to be fixed right away. Some organizations, including large payroll and government services, took websites offline as a precaution while they patched.

How to Tell If Your Website Is Vulnerable

You do not need to be technical to start. Work through these steps, or hand this list to whoever manages your website.

1. Find out which PHP version your site runs

This is the single most important fact. Ways to find it:

• WordPress: log in as an administrator and go to Tools > Site Health > Info > Server. The PHP version is listed there.
• Hosting control panel: most hosts show the PHP version under a "PHP Settings," "Select PHP Version," or similar menu.
• Ask your host or developer: email them and ask, "What exact PHP version is running on our web server, and has it been patched for CVE-2026-109618 and CVE-2026-109619?"

2. Compare it to the fixed versions

One wrinkle: some Linux server vendors add the fix to an older-looking version number. If your version is lower than the table but your host says it is patched, ask them to confirm the fix for these two CVEs specifically.

3. Don't forget the PHP you can't see

PHP often hides inside other things: an old marketing microsite, a customer portal, a staging copy of your website, an intranet, or software bundled with a network appliance. CISA specifically warns that PHP is often a component of other software and may not be obvious. List every website and web-based tool your business owns, not just the main one.

4. Look for signs something already happened

Because attacks started before many people patched, it is worth checking. Warning signs your IT provider or host can look for include sudden bursts of server errors (HTTP 500s), "memory limit" errors in logs, unexplained restarts of PHP processes, and unfamiliar files or programs on the server.

A word of caution on "free scanners"

Proof-of-concept attack scripts for these flaws are circulating online. Security researchers warn against running them against a live website: they can crash the site, leave attacker-style data on your server, and some may be malicious themselves. Leave active testing to professionals who use trusted tools.

What to Do If Your Site Is Vulnerable

Patch PHP (the real fix)

Update PHP on every server to the fixed version for its branch, then restart the web server and PHP services so the new version actually loads. The PHP project has said plainly that updating is the only complete fix.

Upgrade if you're on an old version

If you are on PHP 8.1 or older, there is no patch coming from the PHP project. You will need to move to a supported version. That can affect older plugins, themes, or custom code, so it should be tested on a copy of the site first.

Use temporary protections only as a bridge

If you cannot patch today, your provider can reduce risk with a web application firewall, tighter server settings, or by restricting access to the site. These buy time. They do not replace patching, and attackers have already changed their techniques to get around some firewall rules.

Rotate secrets if you were exposed

Because these flaws can leak data from memory, if your site was unpatched and internet-facing after October 21, consider changing database passwords, API keys, and admin credentials stored on that server after you patch.

If you suspect your site was actually compromised, read What to Do in the First 24 Hours After a Cyberattack.

In Conclusion: Your Website Is Only as Safe as What's Under It

Keeping WordPress and plugins updated is good practice, but PHP2Shell is a reminder that the server underneath needs care too. If you don't know who is responsible for patching PHP on your website, that gap is the real vulnerability.

FAQs About the PHP2Shell Vulnerabilities

Does updating WordPress fix PHP2Shell?

No. WordPress, Laravel, and other applications run on top of PHP. Updating them does not update PHP. The fix has to come from your web host, server administrator, or IT provider.

My site is on shared hosting. Am I safe?

Not automatically. Many hosts patch quickly, but some let customers pick an older PHP version. Check your version and ask your host to confirm they have applied the fix.

What about CVE-2026-115560? I've seen that mentioned too.

That is a separate, narrower PHP issue disclosed on October 23, 2026. The PHP project describes it as an unlikely risk that only affects unusual configurations, and no attacks have been reported. It will be fixed in a routine PHP release. A setting change your provider may already have made for CVE-2026-109619 also covers it.

How quickly should we act?

Now. These flaws are on CISA's actively-exploited list and are being scanned for at massive scale. Treat any unpatched, internet-facing PHP site as urgent.

Need Help Finding and Fixing PHP Vulnerabilities?

Cloud Cover can check every website and web application your business runs, confirm which PHP versions are in use, patch or upgrade them safely, and look for signs of compromise. If you're on an older PHP version, we'll handle the upgrade and testing so your site keeps working.

Schedule a call with Cloud Cover, or tell us a little about your website below and we'll follow up.