php2shell: what the critical PHP vulnerabilities mean for your website, and what to do now
Two critical PHP flaws, nicknamed php2shell, can let an attacker take over a website without logging in. Here's who's affected, how to check your site, and how to fix it.
On October 21, 2026, the PHP project released urgent security updates for two critical vulnerabilities that security researchers have nicknamed php2shell. They affect PHP itself, the language that runs WordPress and a large share of the business websites and web applications on the internet.
If your website or web app runs on PHP, it needs the update. Here’s what php2shell is, how to tell whether you’re affected, and what to do about it.
For our clients: we updated every client site and application we look after to the patched PHP versions on October 21, the day the fix was released. There’s nothing you need to do.
What php2shell is
php2shell is the nickname for two separate flaws, both rated 9.2 out of 10 for severity on the CVSS v4 scale:
- CVE-2026-109618: when PHP runs out of memory at the wrong moment, it can be left with partly set-up internal data that it later treats as valid.
- CVE-2026-109619: some internal data from one web request can survive after its memory has been freed, and a later request handled by the same server process can use it.
The danger is in what an attacker can do with them: run their own code on your server without logging in. That’s the “shell” in php2shell. Someone who can do that can change your website, plant malware, steal data or use your server to attack others.
Who is affected
According to the PHP project, every PHP installation that serves web requests is at risk, whatever the setup: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team considers Apache with mod_php the highest risk, with a demonstrated attack that works before any of the website’s own code runs.
That includes:
- WordPress, WooCommerce, Drupal and Joomla sites
- Laravel, Symfony and other PHP applications
- custom PHP sites, portals and tools
Several security firms have reported public exploit code and attempts to exploit php2shell since the fix was released, so this isn’t a “get to it eventually” update.
The fix: update PHP
There’s no complete workaround. Updating PHP is the only real fix. The patched versions are:
| If you’re on | Update to |
|---|---|
| PHP 8.5 | 8.5.12 or later |
| PHP 8.4 | 8.4.27 or later |
| PHP 8.3 | 8.3.36 or later |
| PHP 8.2 | 8.2.35 or later |
Updating WordPress, your theme, your plugins or your app’s code does not fix php2shell. The flaws are in PHP itself, which runs underneath all of those. Your site can be fully up to date and still be vulnerable.
What to do now
1. Find out which PHP version your site runs
- WordPress: go to Tools → Site Health → Info → Server. The PHP version is listed there.
- Hosting control panels like cPanel or Plesk usually show it under a “PHP version” or “Select PHP version” setting.
- Not sure? Ask whoever hosts or manages your site. It’s a quick question for them.
2. Update, or make sure your host has
- Managed or shared hosting: many hosts patch PHP for you. Don’t assume it; ask them to confirm that your site is running one of the patched versions above.
- Your own server or VPS: install the updated PHP packages from your Linux distribution (they received the patches in advance), then restart PHP and your web server so every worker picks up the new version.
- Containers or a platform like Docker: rebuild your images on the patched PHP version and redeploy.
3. If you’re on PHP 8.1 or older
PHP 8.1 and older no longer get official updates from the PHP project. Because php2shell is so serious, the PHP team did publish minimal patches for PHP 7.4, 8.0 and 8.1 for people who build PHP themselves, and some long-term support vendors offer their own fixes. The real answer, though, is to upgrade to a supported version.
Plan ahead for PHP 8.2 too: it reaches end of life on December 31, 2026, and gets no security fixes after that.
4. If you can’t update right away
The PHP project lists temporary measures that reduce exposure to specific attack paths, but it’s clear that they do not make an installation safe. Treat them as a stopgap for a day or two, not a fix. They include:
- turning off session upload progress (
session.upload_progress.enabled=0) in your server’s PHP configuration and restarting every PHP worker - setting a lower
post_max_sizeand limiting request sizes at the web server or proxy - on PHP 8.5, turning off fatal error backtraces (
fatal_error_backtraces=0)
On October 23 the PHP team also recommended keeping session upload progress turned off until the next regular PHP release, to block one more, less likely, attack path. If you already turned it off, leave it that way.
The settings need care to apply correctly, so if you manage your own server, read the official PHP security advisory for the details.
5. Check for signs of trouble
If your site ran an unpatched version after October 21, it’s worth a look: unexpected new admin users, files you don’t recognize, unusual traffic or emails from your server, or changes to your pages. If anything looks off, get help before it spreads.
How we fixed it for our clients
We patched the same day the update dropped. As soon as the fixed PHP releases were available on October 21, we updated PHP on every client site and application we host or maintain, so our clients were protected without having to do anything themselves.
This is what a support and maintenance contract is for. When a critical issue like php2shell lands, someone is already responsible for your site, already knows how it’s set up and can act the same day. We offer those contracts to our clients at discounted rates.
Need help with php2shell?
Whether or not you’re already a client, we can help:
- Check whether your site is affected and which PHP version it’s running.
- Apply the update, or work with your host to make sure it’s done properly.
- Upgrade old PHP versions (8.1 and older, or 8.2 before its end of life) and test that your site still works afterwards.
- Look for signs of compromise and clean up if something got in.
- Keep it from happening again with an ongoing support and maintenance contract.
Worried your site is exposed? Contact us and tell us your website address. We’ll let you know where you stand and what it will take to fix it. You can also read more about our custom software and support work.