Here is what happened, how to tell if your website is affected, and what to do about it, in plain language.
PHP is the programming language running behind a large share of the world's websites. You never see it, but it is what builds your pages, processes your contact forms, and talks to your database. Think of it as the engine under the hood of your website. Your website's software (WordPress, for example) sits on top of PHP. Your web host or IT provider usually manages PHP on the server. That separation is exactly why this vulnerability is easy to miss: the people who update your website content are often not the people who update the server.
On October 21, 2026, the PHP project released emergency security updates for two critical flaws:
Both are rated 9.2 out of 10 for severity. Neither requires a password or login. Researchers also showed the flaws can be used to read sensitive data from server memory, such as passwords, API keys, and security tokens. Most importantly, these are flaws in PHP itself, not in your website's code. A well-built, fully updated website is still exposed if the PHP underneath it has not been patched.
Yes, attackers are actively trying. Security companies reported exploitation attempts the same day the patch came out, and Cloudflare reported attempts growing from tens of thousands to millions within a day. On October 26, CISA added both flaws to its Known Exploited Vulnerabilities catalog, which is the government's list of security holes that need to be fixed right away. Some organizations, including large payroll and government services, took websites offline as a precaution while they patched.
You do not need to be technical to start. Work through these steps, or hand this list to whoever manages your website.
This is the single most important fact. Ways to find it:
| If your PHP version is... | You are safe at or above... | What to do |
|---|---|---|
| 8.5.x | 8.5.12 | Update now |
| 8.4.x | 8.4.27 | Update now |
| 8.3.x | 8.3.36 | Update now |
| 8.2.x | 8.2.35 | Update now, and plan an upgrade. PHP 8.2 reaches end of life on December 31, 2026. |
| 8.1, 8.0, 7.x or older | No official fix | Upgrade to a supported version. CISA advises taking these systems offline until they are upgraded. |
One wrinkle: some Linux server vendors add the fix to an older-looking version number. If your version is lower than the table but your host says it is patched, ask them to confirm the fix for these two CVEs specifically.
PHP often hides inside other things: an old marketing microsite, a customer portal, a staging copy of your website, an intranet, or software bundled with a network appliance. CISA specifically warns that PHP is often a component of other software and may not be obvious. List every website and web-based tool your business owns, not just the main one.
Because attacks started before many people patched, it is worth checking. Warning signs your IT provider or host can look for include sudden bursts of server errors (HTTP 500s), "memory limit" errors in logs, unexplained restarts of PHP processes, and unfamiliar files or programs on the server.
Proof-of-concept attack scripts for these flaws are circulating online. Security researchers warn against running them against a live website: they can crash the site, leave attacker-style data on your server, and some may be malicious themselves. Leave active testing to professionals who use trusted tools.
Update PHP on every server to the fixed version for its branch, then restart the web server and PHP services so the new version actually loads. The PHP project has said plainly that updating is the only complete fix.
If you are on PHP 8.1 or older, there is no patch coming from the PHP project. You will need to move to a supported version. That can affect older plugins, themes, or custom code, so it should be tested on a copy of the site first.
If you cannot patch today, your provider can reduce risk with a web application firewall, tighter server settings, or by restricting access to the site. These buy time. They do not replace patching, and attackers have already changed their techniques to get around some firewall rules.
Because these flaws can leak data from memory, if your site was unpatched and internet-facing after October 21, consider changing database passwords, API keys, and admin credentials stored on that server after you patch.
If you suspect your site was actually compromised, read What to Do in the First 24 Hours After a Cyberattack.
Keeping WordPress and plugins updated is good practice, but PHP2Shell is a reminder that the server underneath needs care too. If you don't know who is responsible for patching PHP on your website, that gap is the real vulnerability.
No. WordPress, Laravel, and other applications run on top of PHP. Updating them does not update PHP. The fix has to come from your web host, server administrator, or IT provider.
Not automatically. Many hosts patch quickly, but some let customers pick an older PHP version. Check your version and ask your host to confirm they have applied the fix.
That is a separate, narrower PHP issue disclosed on October 23, 2026. The PHP project describes it as an unlikely risk that only affects unusual configurations, and no attacks have been reported. It will be fixed in a routine PHP release. A setting change your provider may already have made for CVE-2026-109619 also covers it.
Now. These flaws are on CISA's actively-exploited list and are being scanned for at massive scale. Treat any unpatched, internet-facing PHP site as urgent.
Cloud Cover can check every website and web application your business runs, confirm which PHP versions are in use, patch or upgrade them safely, and look for signs of compromise. If you're on an older PHP version, we'll handle the upgrade and testing so your site keeps working.
Schedule a call with Cloud Cover, or tell us a little about your website below and we'll follow up.