PHP2Shell is the name given to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, fixed on 21 October 2026. The fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older have no official fix from the PHP project. If you are unsure which PHP version your site runs, ask your web company or host now.
This article explains what PHP2Shell is in plain terms, how to find out which PHP version your site runs, which versions fix it, whether a firewall helps, and what to ask your web company or host if you are not sure you are covered.
What PHP2Shell Is, in Plain Terms
PHP2Shell is the industry name for two memory safety defects in the PHP interpreter itself - not in your website's code, your CMS or your plugins. The PHP security team published a security advisory on 21 October 2026, rating both flaws at CVSS v4.0 9.2. An unauthenticated attacker can send a crafted web request that exploits the flaw and, on affected setups, run their own code on the server. No login is required. In security terms, that is unauthenticated remote code execution.
The PHP project confirmed all PHP installations serving web requests are in scope - including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The highest risk is with mod_php, where the flaw can be triggered before any application code on your site has run at all.
Is Your Website Affected by PHP2Shell?
Your site is affected if it serves web requests using a PHP version below the fixed releases. All PHP versions on the 8.2 line below 8.2.35, on 8.3 below 8.3.36, on 8.4 below 8.4.27, and on 8.5 below PHP 8.5.12 are affected. PHP 8.1 and older have no official patch at all.
The PHP project puts the scope broadly: any PHP installation handling live web traffic on one of those lines needs attention. A brochure site, a booking form and a custom web app are all in the same position if they run an unpatched PHP version.
Does This Affect WordPress Sites?
Yes. WordPress is built on PHP, so any WordPress site running an unpatched PHP version is in scope. Keeping WordPress and its plugins updated is good practice, but it does not fix PHP2Shell. The flaw is in the PHP interpreter on the server, not in WordPress itself. The PHP version your web server is running is what matters here, not which plugins you have installed.
Which PHP Versions Fix PHP2Shell
The PHP project's security advisory lists four fixed releases. The table below shows each supported PHP line, the version that fixes PHP2Shell, and when security support ends - taken from the PHP supported versions page.
| PHP line | Fixed version | Security support ends |
|---|---|---|
| PHP 8.5 | 8.5.12 | 31 December 2029 |
| PHP 8.4 | 8.4.27 | 31 December 2028 |
| PHP 8.3 | 8.3.36 | 31 December 2027 |
| PHP 8.2 | 8.2.35 | 31 December 2026 |
| PHP 8.1 and older | No official fix | End of life |
PHP 8.2 deserves a separate note. PHP 8.2.35 fixes the flaw, but PHP 8.2 security support ends on 31 December 2026 - two months away. A site that updates to 8.2.35 today still needs a plan to move to a supported version before the year ends.
What If Your Site Is on PHP 8.1 or Older?
The PHP project has not issued an official fix for PHP 8.1 or older PHP versions. PHP 8.1 reached end of life on 31 December 2025. Some Linux distributions and long-term support vendors have backported patches for their own supported releases - ask your host or vendor whether one is available for your specific setup.
The real fix is moving to a supported version. Upgrading from older PHP versions can break plugins, themes or legacy code that was written for an earlier release, so it needs to be tested on a staging copy before going live. If your site cannot easily move, that is the conversation to have with your web company now.
How to Check Which PHP Version Your Website Uses
The most direct route depends on your setup. Your hosting control panel usually shows the PHP version under PHP settings, software or server configuration - look there first. On a WordPress site, go to Tools > Site Health > Info > Server and look for the PHP version row.
If neither of those works, ask your host directly. One point worth raising with them: the PHP version on the command line can be different from the one your web server uses to serve the site, as the security firm watchTowr points out. Ask your host to confirm the version that handles your site's live traffic, instead of the account's default.
Do not upload a phpinfo file to your server to check. There are cleaner routes, and exposing that output creates its own risks.
Is PHP2Shell Being Exploited?
Reports differ, and the picture was changing quickly in the days after disclosure. watchTowr reports seeing exploitation in the wild through its honeypots from 21 October 2026 - the same day the PHP project published the fix. Amazon recorded an exploitation attempt on 17 October 2026, four days before public disclosure. As at 22 October, CISA had not added CVE-2026-109618 or CVE-2026-109619 to its Known Exploited Vulnerabilities catalogue. The PHP project's advisory makes no statement either way about attacks in the wild.
However the reports settle, the advice doesn't change. The flaw is public, fixed versions exist, and waiting to see whether attacks grow only leaves an unpatched site exposed for longer.
Can a Firewall or Security Plugin Stop It?
A web application firewall, or a WAF rule targeting known attack patterns, can reduce your exposure - but it cannot fix PHP2Shell. The PHP project is clear that there are no complete mitigations and that updating is the only safe choice. The temporary measures it lists reduce exposure on some configurations; they do not make a PHP installation safe. Configuration changes that lower the risk are for your host or developer to apply, not something to adjust without guidance.
Treat a WAF rule as a short-term layer while a PHP update is arranged. It does not close the underlying flaw, and attack patterns change as attackers adapt to what defences are blocking.
What to Ask Your Web Company or Host
If someone else manages your site, these questions cut to what matters:
Which PHP version is currently serving my live website?
Has that version been updated in response to the PHP2Shell security advisory?
If my site is on PHP 8.1 or older, is a backported patch available from my host or distribution vendor?
If a PHP version upgrade is needed, what does testing involve and what is the timeline?
Is there a WAF rule or other temporary measure in place while the update is arranged?
A useful answer gives you a version number and a clear next step. "We handle security" without specifics is not enough - ask for the version that is actually serving your web requests.
If Your Site Was Unpatched: Check for Signs of a Hack
If your site ran an affected PHP version in recent weeks and has only just been updated, check whether anything changed while it was exposed. Remote code execution flaws of this class can leave traces - unexpected files, changed scripts, new admin accounts, or pages you did not create.
Our guide to signs your website has been hacked covers what to look for and how to check. If you find something you cannot explain, our hacked website recovery service covers sites built on PHP, Node.js or JavaScript, including WordPress, and generally costs around £300 depending on whether usable backups are available. That service is for sites not on our platform.
Keeping PHP Up to Date Without Chasing It
The PHP project gave one day's notice before the PHP2Shell fix. Flaws like it will come again, and each one means updating PHP on the server as well as the website itself. For most small businesses, the practical answer is a managed website where the server-level PHP version, security patches and updates are handled for you.
Our guide to cyber security for small businesses covers the wider set of measures worth reviewing alongside PHP.
On our platform, security patches and updates are handled as part of your plan. Every plan includes backups, restoring from a backup is included at no extra cost, and if a site on our platform is compromised, putting it right is included in the plan. Our managed websites page sets out what each plan covers.
PHP2Shell FAQs
If you want hosting where security patches and updates are handled for you, our managed websites plans set out what is included. Or get in touch to talk through your site's PHP version and what needs to happen next.
Do I need to update PHP if my WordPress plugins are up to date?
Yes. PHP2Shell is a PHP vulnerability in the PHP interpreter itself, not in WordPress or its plugins. Keeping plugins updated is always a good idea, but no plugin update touches the PHP version running on the server. That PHP version is what needs to change to fix this flaw.
Will updating PHP break my website?
It can, particularly if your site uses plugins, themes or legacy code written for an older PHP version. A jump from PHP 8.1 to a current PHP 8.3 or 8.4 carries more compatibility risk than a minor update within the same line, such as 8.2.34 to 8.2.35. Your web company should test on a staging copy before updating the live site.
Is PHP 8.2 still safe after the fix?
PHP 8.2.35 patches the flaw, so yes - a site running 8.2.35 is on the fixed version. The separate issue is that PHP 8.2 security support ends 31 December 2026. After that, the PHP project will not issue further security updates for PHP 8.2. If your site is on that line, plan a move to PHP 8.3 or newer before the end of the year.
What are CVE-2026-109618 and CVE-2026-109619?
CVE-2026-109618 and CVE-2026-109619 are the two critical vulnerabilities grouped under the PHP2Shell name. Both were rated 9.2 out of 10 (CVSS v4.0), which counts as critical. The PHP security team published the security advisory and the fixed releases on 21 October 2026.
Callum Robley
Founder & Lead Developer, Tea Powered Projects
Callum is a full-stack developer and the founder of Tea Powered Projects, a web design, development, and hosting company based in Nottingham, UK. With over 15 years of industry experience, he specialises in building reliable, scalable digital solutions for businesses of all sizes.
