PHP2Shell: is your website affected, and what to do today
PHP released an emergency security update today, 21 October, for two critical flaws in PHP itself. They are CVE-2026-109618 and CVE-2026-109619, and people are calling them PHP2Shell. Either one can let a stranger on the internet run their own code on your web server without logging in. The details leaked a couple of days before they were meant to, so the fix came out in a hurry.
PHP runs most of the small business web. WordPress, Laravel, Drupal, Magento and a huge number of bespoke sites sit on it. If yours is one of them and you have nobody to call, because your developer moved on, or the site was put together with AI tools and you don't know what's under it, or it's been quietly running on old shared hosting for years, this post is for you. Two minutes to find out where you stand, then what to do about it.
Need someone to sort it?
We can be on hand the next day. Send us your site and what it's built on, if you know, and we'll pick it up from there.
Get next-day help ↓Am I affected? Check in 2 minutes
You need one thing: the version of PHP your website runs on. Any of these will get it.
Your hosting control panel
Log in to your host. In cPanel look for "Select PHP Version" or "MultiPHP Manager". In Plesk it's under "PHP Settings" for the domain. Most other panels show it on the website's settings page.
WordPress
In your WordPress admin, go to Tools, then Site Health, then the Info tab, and open "Server". The PHP version is listed there.
The command line
php -vIf you or someone else can log in to the server, that prints the version. Bear in mind the command line and the website can use different PHP installs on the same machine, so if the panel or Site Health says something different, believe those.
Ask your host
If none of that makes sense, email your host's support: "Which PHP version is example.co.uk running on, and does it include the fixes for CVE-2026-109618 and CVE-2026-109619?" They'll be getting that question all week and should answer quickly.
Then compare what you've got with this.
| If you're on | You're safe from |
|---|---|
| PHP 8.5 | 8.5.12 or later |
| PHP 8.4 | 8.4.27 or later |
| PHP 8.3 | 8.3.36 or later |
| PHP 8.2 | 8.2.35 or later (8.2 itself stops getting fixes on 31 December 2026) |
| PHP 8.1, 8.0, 7.x or 5.x | No fix is coming. You need to upgrade. |
One wrinkle. Some hosts and Linux distributions patch older-looking versions themselves, so a version number that looks out of date may already have the fix in it. If yours is below the line, ask your host before you panic. If they can't say yes clearly, treat it as exposed.
What to do today
• Find your PHP version using one of the checks above.
• On 8.2 to 8.5: get the update applied. On managed or shared hosting that's your host's job, so ask them to confirm it's done. On your own server, install the patched package and restart the web server and PHP-FPM.
• On 8.1 or older: there's no patch to install. Ask your host what protection they've put in place, and start planning the upgrade now. If a site isn't earning its keep, take it offline until it's sorted.
• Don't rely on WordPress or plugin updates for this one. The flaws are in PHP, underneath WordPress.
• Have a look for anything that shouldn't be there: files in your web folder you don't recognise, admin users nobody created, new scheduled tasks. If you find something, don't delete it yet. Keep the logs and get help.
There are some settings that make the known attacks harder, and your host may already have used them. PHP is clear they don't make an installation safe. Updating is the fix.
Next-day help
Nobody to update it? We can be on hand tomorrow
We're a UK team in Stafford, and we've just spent the autumn moving our own clients onto current PHP and Laravel: our clients upgraded to Laravel 13, and six production apps moved to Laravel Cloud. Tell us what you've got and we'll get back to you to arrange the work. It doesn't matter if you don't know how it was built. Working that out is part of the job.
What the flaws do
Both are bugs in how PHP tidies up memory between web requests. An attacker sends a carefully built request, PHP gets into a muddle cleaning up after it, and the attacker ends up running code on the server with the same permissions as your website. That means your files, your database passwords and whatever else the site can reach. No login needed, and on some setups it happens before a single line of your own site's code has run, which is why nothing in WordPress or Laravel can stop it.
PHP says the risk is highest for Apache with mod_php, a very common setup on older shared hosting, where it has a working exploit. PHP-FPM, which most newer servers use, is affected too, though the attacks there need more to line up.
PHP rates both CVSS v4.0 9.2, which is critical. You may see 10.0 quoted. That came from reports doing the rounds before PHP published its own advisory, and the advice doesn't change either way.
As for whether anyone is using it yet, reports are mixed. Cloudflare and Patchstack have said they're seeing early attacks. Huntress said this morning it hadn't seen any across its customers. Code claiming to exploit it is already circulating. We'd plan as if it's being used.
If your developer has gone, or AI built it
On PHP 8.2 or newer, this is mostly a phone call to your host. The harder case is the older site. A site on PHP 7.4 or 8.1 can't be patched, and moving it to a supported version often breaks something, because code written for old PHP doesn't always run on new PHP. That's the bit that needs a developer.
Old Laravel apps have the same problem one level up. Older Laravel versions won't run on current PHP, so the PHP upgrade turns into a Laravel upgrade. We've just done exactly that across our own clients this autumn, so we know where it bites.
If your site was built with AI tools, the flaw affects it the same as anything else on PHP. How the code was written makes no difference; the PHP version on the server does. What usually differs is that nobody can say what's under it or how it's deployed, which makes the upgrade slower to start. We can work that out.
Not sure what an upgrade would involve? The legacy modernisation calculator gives you a rough plan in a couple of minutes. Or skip it and send us the site.
Common questions
What is PHP2Shell?
PHP2Shell is the nickname for two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619. Both let someone on the internet run their own code on a web server without logging in. PHP fixed them on 21 October 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Is my website affected by the PHP vulnerability?
If your site runs on PHP and the version is older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35, assume yes. That covers most WordPress sites, Laravel apps and bespoke sites on shared hosting. Your hosting control panel, the Site Health screen in WordPress, or a one-line email to your host will tell you the version.
How do I update PHP?
On shared or managed hosting, the host updates PHP. Ask them to confirm your site is on a patched release, or switch the version yourself in the control panel if it offers one. On your own server, install the patched package from your Linux distribution and restart the web server and PHP-FPM. If you are on PHP 8.1 or older there is no patch, so the fix is moving to a supported version, which can break older code and should be tested first.
Does updating WordPress or my plugins fix it?
No. The flaws are in PHP, the language WordPress runs on, so the fix is a PHP update on the server. Keep WordPress and plugins up to date anyway, but it will not close this one.
I'm on PHP 8.1 or older. What do I do?
PHP 8.1 and every version before it are end of life and PHP is not releasing a fix for them. The safe route is upgrading to PHP 8.2.35 or newer. Some Linux distributions and hosts backport fixes to older versions, so ask your host what they have done. Until it is upgraded, treat the site as exposed.
My developer has left. Who can update PHP for me?
Start with your host, who can tell you the version and may be able to switch it. If the site needs code changes to run on a newer PHP, or nobody knows how it was built, you need a developer to take it on. Codebased can be on hand the next day, from a UK team that has just moved its own clients onto current PHP and Laravel.
My site was built with AI tools. Am I affected?
If what the AI built runs on PHP, yes, in the same way as any other PHP site. How the code was written makes no difference to this flaw; what matters is the PHP version on the server. If you are not sure what your site is built on, your host can tell you.
Is the PHP vulnerability being exploited?
Reports are mixed. Cloudflare and Patchstack have said they are seeing early attacks, and Huntress said on 21 October it had not yet seen any across its customers. Code claiming to exploit the flaws is circulating. Plan as if it is being used.
Is the CVSS score 9.2 or 10?
PHP rates both flaws CVSS v4.0 9.2, which is critical. The 10.0 figure came from reports that circulated before PHP published its advisory. Either way it is the top band, so the advice is the same: update.
Sources
Things are moving quickly, so check these for anything newer than this post.
• php.net, the release announcements for 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the security advisory.
• PHP's own technical advisories for CVE-2026-109618 and CVE-2026-109619, including which server setups are most at risk.
• PHP's supported versions, for which branches still get fixes.
• Tenable's FAQ on the leak and the timeline.
• Huntress on what to look for if you think you've been hit.
• Patchstack on what it means for WordPress sites.