PHP2Shell: what the October 2026 PHP vulnerability means for your website

The short answer: if your website runs on WordPress, WooCommerce, Joomla, Drupal or Magento, it runs on PHP, and it was exposed to two of the most serious PHP flaws ever found until your host installed the fix released on 21 October 2026. Ask your host, in writing, to confirm your site is on a patched version. If it runs on PHP 8.1 or older, it needs upgrading, not just patching.

The flaws are known together as PHP2Shell, and officially as CVE-2026-109618 and CVE-2026-109619. Below is what happened, how to check your own site in a few minutes, and what to do if you’re not sure.

Last checked 25 October 2026. This is still developing; the sources at the end have the latest.

What happened

PHP is the programming language underneath most of the web. W3Techs puts it behind about 69% of websites whose server language is known, which includes nearly every WordPress site.

Researchers found two memory-safety bugs in PHP itself. Both let an attacker run their own code on your web server, with no password, using a specially crafted request. PHP rates both 9.2 out of 10 (critical). Code going back to PHP 5.4, released in 2012, is affected.

Security firms including Amazon, Cloudflare and watchTowr have seen attackers trying it. CISA, in an alert last updated on 23 October, says it hasn’t yet seen a successful attack. Waiting to find out is the wrong bet: one analysis counted 2.24 million internet-facing PHP servers, 59% of them on versions with no fix coming.

Why this one is different

Updating your plugins doesn’t fix it. Most WordPress security news is about a plugin or theme. This bug is in PHP, the layer underneath WordPress. Your site can have every plugin up to date and still be exposed.

It doesn’t need a login. An attacker doesn’t need a password or an admin account. On some server setups the attack works before WordPress has even started.

It isn’t limited to one kind of server. According to CISA, every PHP installation that serves web pages is affected, whichever way it is connected to the web server.

How to check your site

1. Find out whether your site uses PHP. If it’s built on WordPress, WooCommerce, Joomla, Drupal, Magento or OpenCart, it does. Most shared hosting with a cPanel login also runs PHP. If you’re on Wix, Squarespace or Shopify, they look after their own servers and there’s nothing for you to patch.

2. Find your PHP version. In WordPress, go to Tools → Site Health → Info → Server. In cPanel, look for Select PHP Version or MultiPHP Manager. Then compare it with the fixed versions:

3. Don’t rely on the number alone. Hosting companies and Linux distributions often build the fix into an older-looking version, so a lower number doesn’t always mean you’re exposed, and a matching number doesn’t prove the server was restarted onto it. Only your host can confirm it, which is why the next step matters.

What to do this week

1. Ask your host to confirm the fix in writing. On shared or managed hosting, they patch PHP, not you. A short email is enough (there’s one below).
2. If you’re on PHP 8.1 or older, plan the upgrade now. The PHP project published source-code fixes for 7.4, 8.0 and 8.1 but no official releases, and some hosting control panels have backported fixes of their own. The safe route is moving to PHP 8.3 or newer. Test the site on a copy first: old plugins and themes sometimes break on a newer PHP.
3. If your site is on a server you or your developer manage, such as a VPS, install the update and restart PHP-FPM or Apache. The fix only takes effect after a restart. CISA’s advice for anything that can’t be patched straight away, or that runs PHP 8.1 or older, is to take it offline until it can.
4. Update WordPress, plugins and themes anyway. It won’t fix PHP2Shell, but an attacker who gets in looks for the next weakness.
5. Check you have a recent backup from before 17 October, stored somewhere other than the hosting account.

If your site sits behind Cloudflare, it already has some protection: Cloudflare added firewall rules for the known attack, free plans included. That buys time; it isn’t a fix.

An email to send your host

Hi,

Please confirm that the server hosting [your domain] has been patched for the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and that PHP was restarted afterwards. Which PHP version is my site running, and is it a supported version?

Thanks,

A good host replies within a day with a clear yes. A vague answer is useful information too.

Signs your site may already have been broken into

Amazon recommends looking back to at least 17 October, not 21 October. Things a site owner can notice:

• Administrator accounts in WordPress that you didn’t create.
• Plugins, files or pages you don’t recognise.
• Visitors (often only phone visitors) being redirected to other sites.
• A “This site may be hacked” warning in Google results.
• Your host telling you the account is sending spam or using unusual resources.

If you see any of these, tell your host straight away, change every password (hosting, WordPress, database and email), and ask about restoring from a clean backup. Removing a visible symptom rarely removes the intruder.

Is this a reason to leave WordPress?

No, not on its own. A WordPress site on a well-run, patched host is fine. What PHP2Shell shows is that every website needs someone responsible for keeping the server underneath it up to date. If nobody is, that’s the thing to fix.

For transparency: this site doesn’t use PHP (it’s built with Next.js and runs on Cloudflare), so it wasn’t affected. I build sites that way because there’s less server underneath them to keep patched, but plenty of good sites are built on WordPress.

If you’d like a second opinion on your own site, send it through the free website check. Along with speed and how it looks to Google, I’ll tell you what I can see about its PHP setup from the outside and what to ask your host.

Sources

• CISA: Critical vulnerabilities in PHP require immediate patching (updated 23 October 2026)
• Tenable: PHP2Shell frequently asked questions
• Help Net Security: PHP2Shell vulnerabilities patched
• CybelAngel: what we know about php2shell