PHP2Shell: How to Check Your Website for the Critical PHP Flaw

If your website runs on PHP, which includes almost every WordPress site, there is one update to confirm with your host this week. On October 21, 2026, the PHP project released fixes for two serious flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Both can let an attacker run code on a server without logging in, and attacks have been reported. The good news is that the fix is a normal PHP update, and your host probably handles it. This post explains what happened and gives you a short list of things to ask and check.

In this article

In this article
What happened
Which versions are fixed
Check 1: Find your PHP version
Check 2: Ask your host three plain questions
Check 3: Upgrade if you are on an old branch
Check 4: Keep a temporary setting in place
Check 5: Look for signs of trouble
Check 6: Be careful with offers of help
A short checklist
Why this one is a quiet job
Sources
Also published on

What happened
Which versions are fixed
Check 1: Find your PHP version
Check 2: Ask your host three plain questions
Check 3: Upgrade if you are on an old branch
Check 4: Keep a temporary setting in place
Check 5: Look for signs of trouble
Check 6: Be careful with offers of help
A short checklist
Why this one is a quiet job
Sources
Also published on

What happened

PHP released new versions on October 21 that fix two related bugs in how the server handles web requests. In plain terms, the first one can leave a request half built when the server runs out of memory, and the clean-up code then trusts it. The second lets data from one request survive after its memory is freed, and a later request on the same worker can read it. In both cases the result can be remote code execution. Each scores 9.2 on the CVSS 4.0 scale.

Security researchers at watchTowr said they saw exploitation from October 21, and CISA added CVE-2026-109618 to its list of known exploited vulnerabilities. Cloudflare has also reported attack traffic aimed at the flaws, and public proof-of-concept scripts exist. The software that serves PHP matters here: Apache with mod_php carries the highest risk, though PHP-FPM, LiteSpeed and others are also in scope.

Which versions are fixed

The fixed releases are:

PHP 8.5.12
PHP 8.4.27
PHP 8.3.36
PHP 8.2.35

Anything newer than these is also fine. PHP 8.1 and older no longer get regular security updates from the PHP project. The project did publish limited source backports for 7.4, 8.0 and 8.1, and many hosts and Linux distributions ship their own patched packages. That means your version number can look old and still include the fix. Your host can confirm.

One useful point from the WordPress side: this is a server issue, so updating WordPress or plugins does not fix it. The WordPress security team has said no WordPress update is needed.

Check 1: Find your PHP version

In WordPress, open Tools, then Site Health, then the Info tab, and look under Server. Otherwise, check your hosting control panel. Write the version down for every site you run, including old ones and test sites.

Check 2: Ask your host three plain questions

Ask which PHP version is running, whether it includes the fixes for the two CVEs, and when the fix was applied. Also ask whether PHP and the web server were restarted afterward. Running processes keep the old code in memory until they restart, so a patch without a restart is not finished.

Check 3: Upgrade if you are on an old branch

If you are on PHP 8.1 or older and your host has no patched package, plan an upgrade to a supported branch. PHP 8.3 or newer is a sensible target. PHP 8.2 reaches the end of its support on December 31, 2026, so many people are choosing to skip it. Test your plugins and theme on a staging copy first, since a jump of several versions can break older code.

Check 4: Keep a temporary setting in place

Upgrades take time, and the PHP project suggests a few interim steps. One is switching off session upload progress, with the setting session.upload_progress.enabled=0, then restarting the workers. It reduces exposure to one of the flaws. PHP is clear that no configuration change fully fixes these bugs, so treat it as a short-term measure.

Check 5: Look for signs of trouble

Early attempts may date back to around October 17. Look for admin users you do not recognize, unfamiliar files, new scheduled tasks, and unexplained crashes or restarts of your web server. If anything looks odd, change passwords and keys, starting with hosting and admin accounts, and turn on multi-factor authentication.

Check 6: Be careful with offers of help

Every big security story brings a wave of messages offering a quick fix. Do not install a “PHP2Shell fix” plugin or paste code from a forum or social post. Contact your host through its official website or phone number instead.

A short checklist

PHP version noted for every site
Host confirms the fixed version or a backported package
PHP and web server restarted after the update
Plan in place if you are on PHP 8.1 or older
session.upload_progress.enabled set to 0 until you are patched
Admin users, files and scheduled tasks reviewed
Passwords changed and multi-factor authentication on

Why this one is a quiet job

Most of this work happens on your host’s side, so the main job is asking and getting an answer in writing. If you run a business site, a short message to your hosting provider today is a good use of five minutes. For more practical website guides, visit expertwebdeveloper.in and growsmartwithai.com.

Sources

Qualys: PHP2Shell: Find, Mitigate, and Patch Now
watchTowr: CVE-2026-109618: Exploited Remote Code Execution in PHP
U.S. Chamber of Commerce: A Security Flaw Is Affecting Millions of Websites: What Small Business Owners Need to Do
NCSC-NL: Operational information regarding the 2026 php2shell vulnerabilities