Quick answer: PHP2Shell is the name given to two critical flaws in PHP, published on 21 October 2026 as CVE-2026-109618 and CVE-2026-109619. They can let someone on the internet run their own commands on your web server without logging in. If your website runs on PHP, as WordPress, Drupal, Joomla, Magento and WooCommerce sites do, it is exposed until the PHP on its server is updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to a patched package from your host or Linux distribution. The fix is in PHP itself, so updating WordPress or a plugin does not fix it. Ask whoever runs your server, today, whether it has been patched. If your site is on a hosted builder such as Wix, Squarespace or Shopify, or does not run PHP at all, there is nothing for you to update.
This page is not security advice. It sets out what the PHP project, government security agencies and security firms published, each source opened on 22 October 2026, and what that means for a business that owns a website. This is a developing story, so the sources may have moved on since. Whoever runs your server decides what to change on it.
What is PHP2Shell?
PHP is a programming language that runs on web servers: when a visitor opens a page, PHP on the server builds it. WordPress, for one, is built in it (WordPress). PHP2Shell is two flaws in PHP itself, not in any plugin, theme or website.
In plain English: a stranger can send your web server a specially made request and get it to run their own commands, with no password, and before your website's own code has even started (Help Net Security). Security people call this unauthenticated remote code execution. Whoever can run commands on your server can read what it holds, change your pages and use it to attack others.
| CVE-2026-109618 | CVE-2026-109619 | |
|---|---|---|
| PHP's name for it | RCE via OOM corruption | RCE via stale global state |
| What goes wrong | Running out of memory can interrupt PHP while a request's data is only half set up | Data from one request can outlive its memory and be picked up by the next request |
| Rating | Critical, 9.2 (CVSS v4.0) | Critical, 9.2 (CVSS v4.0) |
| Login needed | No | No |
| Advisory | PHP project | PHP project |
Every PHP installation that serves web requests is affected, whichever way the server runs PHP: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP or LiteSpeed. Apache with mod_php carries the highest risk (Tenable). You do not need to know which of these your site uses. The people who run your server do.
Is my website affected by PHP2Shell?
It depends on whether your site runs PHP, and on who looks after the server it runs on. Find your kind of site in the left-hand column. "Your host" means the company you pay for hosting; if you rent a server and run it yourself, it means you or your developer.
| Your site | Runs PHP? | Who patches PHP | What you do |
|---|---|---|---|
| WordPress | Yes | Your host | Check Site Health, then ask the question below |
| Drupal | Yes | Your host | Ask the question below |
| Joomla | Yes | Your host | Ask the question below |
| Magento or WooCommerce shop | Yes | Your host | Ask today: a shop holds customer details |
| cPanel or other shared hosting | If your site does | Your host. A version you pick in the panel is yours | Check the panel's PHP setting, then ask |
| Hosted builders (Wix, Squarespace, Shopify) | The platform runs the servers | The platform | Nothing to update. See the provider's status page |
| A site with no PHP | No | Not affected | Keep the software it does run up to date |
Is WordPress affected by PHP2Shell?
Yes, wherever the PHP underneath it has not been patched. WordPress itself has no bug here: the flaw is in PHP, which WordPress runs on, so a WordPress, theme or plugin update does not fix it. Tenable reports that Calif, the security firm whose write-up it cites, confirmed the attack working before login against specific versions of WordPress, Drupal, Joomla and Magento (Tenable).
On most WordPress hosting, patching PHP is the host's job, not yours. Your job is to make sure it has been done.
How do I check whether my site has been patched?
Start with the version, then ask.
- On WordPress, go to Tools > Site Health > Info and open the Server section, which shows your server's PHP details, including its version (WordPress).
- On other hosting, look for the PHP version setting in your hosting control panel.
- Then ask your host or developer this exact question, by email so you have the answer in writing:
Which PHP version is my site on, and has it been patched for CVE-2026-109618 and CVE-2026-109619?
Asking beats checking the number, because the number can mislead in both directions. Linux distributions often fix an older version in place rather than move to the new one, a practice called backporting. Red Hat says plainly that "just looking at the version number of a package will not tell them if they are vulnerable or not" (Red Hat). For PHP2Shell, distributions and long-term support vendors received the patches before the public release, and some offer fixes for PHP 8.1 and earlier (Help Net Security). So an old-looking number can already be patched, and only the people who run the server know which you have.
Which PHP versions fix PHP2Shell?
The PHP project released fixes for the four versions it still supports. Older versions get partial help or none.
| Your PHP version | Fix from the PHP project | What it means for you |
|---|---|---|
| 8.5 | 8.5.12 | Update to it, or to your distribution's patched package |
| 8.4 | 8.4.27 | As above |
| 8.3 | 8.3.36 | As above |
| 8.2 | 8.2.35 | As above |
| 7.4, 8.0 and 8.1 | No release. Minimal source patches, for people who build PHP themselves | Your host's or distribution's patched package, or an upgrade |
| 5.4 to 7.3 | None | Upgrade, or ask your distribution or long-term support vendor |
Sources: the two PHP advisories linked above, Tenable and Help Net Security.
What if my site is on PHP 8.1 or older?
There is no official fixed release for it, and two government agencies say the same hard thing.
- CISA, the US cybersecurity agency, says organisations that cannot update right away, or that still run PHP 8.1 or earlier, "should take PHP-based systems offline until they can be patched or updated" (CISA).
- The UK's NCSC says that if you cannot apply the update or PHP's temporary mitigations, "you should consider taking the system offline until it can be fully mitigated", and check it for signs of compromise (NCSC).
Then ask why your site is on an old version. If the answer is that the theme or a plugin breaks on newer PHP, that is the real business risk, and it is bigger than this one flaw: your website cannot take a security fix, and PHP2Shell will not be the last flaw that needs one. The choices are a patched package from your host as a stopgap, replacing the parts that break, or a new site.
While your host works on it, the PHP project lists temporary settings that reduce the risk. They are not fixes, and the PHP project says updating is the only complete one. They are for whoever runs your server:
- memory_limit=-1, set so that no site or app on the server can change it (CVE-2026-109618)
- session.upload_progress.enabled=0, and on PHP 8.5 also fatal_error_backtraces=0 (CVE-2026-109619)
- Restart every PHP worker after any change (Tenable)
Is PHP2Shell being exploited?
The sources say different things, partly because they spoke at different times and saw different things. Here is each one's claim, in its own terms. We are not merging them into one verdict.
| Who | What they said |
|---|---|
| Amazon Threat Intelligence | Its honeypot recorded an exploitation attempt on 17 October, four days before the flaws were made public, and more on 21 October. Amazon says it is "now being broadly exploited in the wild", while also saying it is unclear whether the 21 October attempts would have worked against real systems (Tenable, Help Net Security) |
| The PHP Foundation | The proof-of-concept exploits its team inspected were not working exploits at the time of the release (Tenable) |
| CISA | "CISA has not observed exploitation of these vulnerabilities as of the time of publication", on 21 October (CISA) |
| watchTowr | Reproduced both flaws and is seeing exploitation attempts against both (Tenable) |
| Cloudflare | Its CTO says it is "seeing early attacks emerging" (Tenable) |
| UK NCSC | Says the flaw could allow unauthenticated remote code execution, and does not say whether it has seen attacks (NCSC) |
Whichever source you read, the fix is the same: update PHP.
Would a different kind of website have avoided PHP2Shell?
This flaw, yes: it only affects PHP. This site runs on Next.js and has no PHP in it, so PHP2Shell does not touch it (how it's built).
But no kind of website is immune. On 3 December 2025, React disclosed CVE-2025-55182, a flaw in React Server Components rated 10.0 that let attackers run code on the server without logging in, and Next.js was among the frameworks affected (React). It became known as React2Shell (Rapid7). Choosing a different technology swaps one set of risks for another. It does not remove them.
What actually protects a website is how it is looked after:
| What protects a site | Why it matters this week |
|---|---|
| Someone accountable for updates | A named person who hears about a flaw like this the day it is published, and knows whether your site is affected |
| A small attack surface | Fewer plugins, and no admin panel open to the whole internet, leave fewer ways in |
| A host that patches the runtime for you | The fix for PHP2Shell was on the server, not in the website. A host that updates PHP, or Node.js, for you does it without waiting for you to ask |
At SBW Labs we do not claim the sites we build cannot be hacked. Nobody honestly can. What we can say is who is responsible for what, before anything goes wrong.
What should I do about PHP2Shell this week?
- Find out whether your site runs PHP, using the table above.
- If it does, send your host or developer the question above, today, and keep the reply.
- Do not count a WordPress or plugin update as the fix. The fix is in PHP.
- If your site is behind Cloudflare, its rules for the known attacks are free to every customer, and its CTO calls them "a STOPGAP only" (Tenable). Patch anyway.
- If you are on PHP 8.1 or older with no patched package, read what CISA and the NCSC say above about taking the site offline, and plan the upgrade.
- If your site was exposed, ask your host to check it for signs of compromise, as the NCSC advises.
- Write down who is responsible for your site's updates from now on, so the next flaw is one email.
Not sure where your site stands? Ask for a free website audit: every finding is checked by a person.
What else are people asking about PHP2Shell?
Is PHP2Shell rated 10.0?
No. The PHP project rates both flaws 9.2 on CVSS v4.0. Identifiers that circulated before the release carried a 10.0, which the PHP Foundation called incorrect (Tenable). Either way, both flaws are rated critical.
Is it only websites that are affected?
No. Anything that runs PHP to serve web pages can be, including products that bundle PHP inside them. Palo Alto Networks says all versions of its PAN-OS and Panorama are affected (Help Net Security), and the NCSC asks organisations to watch for updates from the vendors of such products (NCSC).
Does Cloudflare protect my site from PHP2Shell?
Partly, for a while. Cloudflare has put rules in front of PHP sites for the known ways of attacking these flaws, free to every customer. They cover only traffic that passes through Cloudflare, and Cloudflare itself calls them a stopgap (Tenable). The server still needs patching.
Is my Wix, Squarespace or Shopify site affected?
There is nothing for you to update. On a hosted builder the platform runs the servers, so patching anything under your site is its job. If you want to know where it stands, check the provider's status page or security notices.
Do I need to take my website offline?
Only if it runs PHP and cannot be patched or protected yet. That is what CISA advises for unpatched systems and for PHP 8.1 or older, and what the NCSC asks organisations to consider where neither the update nor the temporary settings can be applied. If your host confirms your site is patched, it can stay up.
Every business deserves a website that someone is looking after. If yours runs on PHP, the question above is the most useful email you can send this week. How we build websites sets out who looks after what, and a free website audit will tell you honestly where your site stands today.