Web Security
PHP2Shell: The Critical PHP Vulnerability and What It Means for Your Website
PHP2Shell: The Critical PHP Vulnerability and What It Means for Your Website
Two critical PHP flaws, nicknamed PHP2Shell, put millions of websites at risk. Here’s how to check if yours is exposed and what to do next.
On October 21, 2026, the PHP project released emergency fixes for two critical flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell. Both let an attacker run code on a web server without an account, and both are rated 9.2 out of 10 for severity.
Why this one is different
The flaws sit in PHP itself, not in WordPress, your theme, or any plugin, so a site can have perfectly clean code and still be exposed. Details leaked a day before the planned disclosure, and Cloudflare and watchTowr have both reported attackers already trying to exploit the flaws. Some organizations took services offline as a precaution, including Dutch government and education sites. In the reports I found, no one has confirmed a break-in on a specific server yet. That could change quickly.
Is my website at risk?
If your site runs on PHP, assume yes until you’ve confirmed otherwise. That includes WordPress, Drupal, Joomla, Laravel, and most school and college sites. Updating WordPress does not update PHP. PHP comes from your hosting provider or server.
The fixed versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and older no longer get official updates, and PHP 8.2 reaches end of life on December 31, 2026. Some hosts patch older versions without changing the version number, so ask your host to confirm the fix for both CVEs. Fully hosted builders like Wix or Squarespace manage server software themselves, so patching is their job. Ask their support if you’re unsure.
Check your PHP version in two minutes
WordPress: Tools, then
Site Health, then Info, then
Server.cPanel: MultiPHP Manager.
Anything else: ask your host for your PHP version and patch status.
How I can help you find out
Send me your site and I’ll check:
- Your PHP version and server setup.
- Apache with mod_php carries the highest risk, according to the PHP advisory.
Whether your host has applied the fix.Warning signs in your logs and files. Researchers suggest watching for unusual multipart requests followed by memory-limit errors or repeated HTTP 500 errors, oddly large session cookies, and unexplained PHP worker restarts. I also look for unfamiliar admin users, modified files, and plugins you didn’t install.
You’ll get a plain-English summary: your risk level and what to fix first. Some hosts limit log access, so I’ll tell you what I could and couldn’t verify.
If you’re at risk, do this
Back up first. Save your files and database before changing anything.Update PHP through your host, then restart services and test the site.If you can’t update today, temporary settings and firewall rules help only partly. PHP says only updating fully protects a server, and Cloudflare saw attackers change their payloads to get around its stopgap rules.
Check memory settings after updating. The fix adds a hard memory limit, so confirm memory_limit and post_max_size still fit what your site needs.
If you suspect an earlier break-in, patching isn’t enough. Attackers can read memory from the PHP worker, which may hold passwords, tokens, and API keys, so rotate credentials, review users and files, and treat it as an incident.
Ways to work with me
Get a quote to cleanup, review, or update a compromised site
Advisory
Best for simple projects and updates
$100/hr
1-hour minimum A quick PHP check and a second opinion on your host
Roadmap Project
For full site remodels
$1,500 - $3,500
A full security and update audit with a prioritized plan
Part-Time Digital Team
Best for simple projects and updates
From $1,500/mo
monitoring, web updates, work orders, integrations, security
I work with small teams and tight budgets, including schools and colleges that don’t have a full-time developer or security lead.
Staying safe going forward
Steps to keep your site safe:
- Run a supported PHP version and know its end-of-life date. Plan your move off 8.2 before December 31.
- Turn on automatic updates for WordPress core, plugins, and themes, and delete what you don’t use.
- Choose hosting that lets you control the PHP version and patches quickly.
- Keep tested, off-site backups. A backup you’ve never restored is a guess dd a firewall and uptime and file-change monitoring, as a layer on top of patching.
- Use two-factor authentication and limit admin accounts.
- Name one person responsible for updates, and review the site quarterly.
Not sure where you stand? Book a free 15-minute call and I’ll tell you what I’d check first. Already seeing strange behavior? Call (949) 354-3722.
Sources: The Hacker News, WatchTowr FAQ, Tenable FAQ... Verify the current up-to-date news in the official PHP security advisory.
