If your website runs on PHP, this week matters. On 21 October 2026, the PHP team released emergency updates for two critical flaws now known as PHP2Shell. They can let an attacker run code on a web server without logging in.
After all, PHP powers WordPress, Drupal, Joomla and a huge share of the web. So, even if you have never written a line of code, your site may depend on it. In this guide, you will learn what PHP2Shell is, who is affected, which versions fix it and the exact steps to protect your site today.
Quick answer: PHP2Shell is the name for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. If you use shared hosting, check that your host has patched PHP. If you manage your own server or VPS, update it yourself now.
What is PHP2Shell?
PHP2Shell is a pair of memory safety bugs in the core of PHP. Both carry a CVSS v4.0 score of 9.2, which is rated critical. In simple terms, a specially crafted web request can confuse PHP’s memory handling and let an attacker run their own code on the server.
In fact, that is the worst kind of bug for a website. For instance, an attacker who can run code can steal data, plant malware, add spam pages or take over the whole site.
The two flaws work like this:
- CVE-2026-109618: an out of memory error can leave request data half set up, which can corrupt memory.
- CVE-2026-109619: PHP can keep using request data after its memory has been freed.
According to PHP’s official release notes, updating PHP is the only complete fix.
Who found the flaws?
Researchers from Wiz, Calif, Areion and OpenAI reported the flaws. Wiz says it found them on 19 August and showed a working attack against WordPress two days later. After that, it reported them to PHP on 24 August.
Interestingly, AI played a big part. OpenAI says its models helped uncover the bugs as part of its “Patch the Planet” effort. Wiz added that frontier AI models made it much easier to turn a very old weakness into a working exploit.
Timeline of events
| Date | What happened |
|---|---|
| 19 Aug 2026 | Wiz finds the flaws |
| 24 Aug 2026 | Flaws reported to the PHP team |
| 20 Oct 2026 | PHP posts advance notice; details start to leak |
| 21 Oct 2026 | Cloudflare deploys firewall rules for all plans |
| 21 Oct 2026 | Security firms report the first attack attempts |
| 21 Oct 2026 | PHP releases fixed versions |
Is your site affected by PHP2Shell?
Most likely, yes, until you update. Specifically, PHP says every installation that serves web requests is affected. This includes PHP FPM, Apache with mod_php, php cgi, FrankenPHP and LiteSpeed. Of these, PHP rates Apache mod_php as the highest risk.
Some researchers say versions as old as PHP 5.4 are affected too. As a result, old and forgotten servers are at serious risk.
Here are the fixed versions by branch:
| PHP branch | Fixed version |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
| PHP 8.1 and older | No official update |
Therefore, if you still run PHP 8.1 or older, you should move to a supported version. The PHP team did share small source fixes for 7.4, 8.0 and 8.1, but only for people who build PHP themselves. Also note that PHP 8.2 reaches end of life on 31 December 2026, so plan your next upgrade now.
How to check your PHP version in WordPress
You can check your PHP version in under a minute:
- Log in to your WordPress dashboard.
- Go to Tools, then Site Health.
- Open the Info tab.
- Expand the Server section and look for the PHP version.
Alternatively, open your hosting control panel and look for a PHP settings page. Keep in mind that some hosts patch older branches without changing the version number. So, if you are unsure, ask your host directly whether PHP2Shell is fixed.
How to protect your site from PHP2Shell
Follow these steps in order.
- Update PHP. Move to one of the fixed versions above, or ask your host to confirm the patch.
- Check your host’s notice. Many hosts patched shared plans for you. For example, Hostinger says it rolled out patched PHP builds on all plans except VPS and added firewall rules, with no action needed from shared hosting customers. VPS owners must update PHP themselves.
- Turn on a web firewall. Cloudflare’s firewall rules for PHP2Shell went live on 21 October on all plans, including the free plan. Its PHP2Shell post explains the protection.
- Look for signs of a break in. Above all, check for unknown admin users, new plugins you did not install, strange files in your uploads folder and sudden spam pages.
- Change passwords. If anything looks odd, reset your WordPress, hosting, database and FTP passwords.
- Keep a clean backup. Make sure you have a recent backup stored off the server, so you can restore quickly if needed.
Do temporary workarounds help?
Only a little. PHP lists a few settings that reduce risk, such as turning off session upload progress in php.ini and restarting PHP. However, PHP is clear that these do not make a site safe. In other words, they only buy time until you update.
Similarly, updating WordPress plugins does not fix PHP2Shell, because the bug sits in PHP itself, not in WordPress. Even so, keep plugins updated, since attackers often combine weaknesses.
Are attackers using it yet?
Yes, attacks have started. For example, Cloudflare says it has seen attack traffic, and security firm watchTowr reports exploitation in the wild. When we checked on 22 October, the flaws were not yet in CISA’s list of known exploited bugs. Still, waiting is risky, because public exploit code is already spreading.
Why PHP2Shell matters for every site owner
PHP2Shell is a reminder that your site’s safety depends on more than your theme and plugins. Equally, the server software underneath matters just as much. Moreover, as AI helps researchers and attackers find bugs faster, the gap between disclosure and attack keeps shrinking.
So, treat server updates as routine, not optional. For more ways to stay safe online, see our guide to iPhone scam protection in iOS 27, and learn how to keep your data private with our AI training opt out guide.
Frequently asked questions
What is PHP2Shell?
PHP2Shell is the name for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619. They can let attackers run code on a web server without logging in.
Which PHP versions fix PHP2Shell?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 contain the fix. PHP 8.1 and older get no official update.
Do I need to do anything on shared hosting?
Usually your host patches PHP for you, but you should still confirm it. Hostinger, for example, patched all plans except VPS.
Does a WordPress update fix PHP2Shell?
No. The flaw is in PHP, not in WordPress. You need a patched PHP version from your host or server.