PHP2Shell: the critical PHP vulnerability affecting WordPress and 7 in 10 websites (what to do)

On 21 October 2026 the PHP team shipped an urgent release fixing two critical flaws that let an attacker run code on a website's server without any username or password. The researchers who found them call them PHP2Shell, and real attacks have already been seen.

PHP runs WordPress, WooCommerce, PrestaShop, Joomla, Drupal and most small-business websites: according to W3Techs, 70 % of websites whose server language is known use it.

In short:

• What: CVE-2026-109618 and CVE-2026-109619, severity 9.2 out of 10: remote takeover without a password.
• Who: almost any PHP website, including fully updated WordPress: the bug is in PHP, not in WordPress.
• Fixed in: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are no longer supported.
• What to do: check which PHP version your site runs and update it (or ask your host to) now.
• Free check: Is your website vulnerable to PHP2Shell? (the result is in Spanish)

What PHP2Shell is, in plain words

PHP is the engine that builds your pages on the server. Both flaws are in that engine:

• CVE-2026-109618: when PHP runs out of memory in the middle of a request, it can leave data half-prepared and later treat it as valid.
• CVE-2026-109619: PHP can keep data from a previous visit that should no longer exist and reuse it in the next one.

By chaining these with a crafted request, an attacker can run their own commands on the server: install malware, steal the database, send spam from your domain or redirect your visitors. According to PHP's advisory, on the most exposed setups the attack works before WordPress or your application even runs, so no security plugin can stop it.

Who is affected

According to Wiz Research, every PHP version released in the last decade (back to PHP 5.4) has at least one of the flaws. All the usual ways of serving PHP are affected: Apache mod_php (highest risk), PHP-FPM, php-cgi, LiteSpeed and FrankenPHP. The attack was demonstrated on WordPress, Drupal and Joomla.

On shared hosting you are affected too, but it is usually your provider who updates PHP. Some providers patched every server; others let you pick the PHP version in the control panel and don't change it for you.

Fixed PHP versions

PHP branch	Fixed version	Security support
PHP 8.5	8.5.12	Yes
PHP 8.4	8.4.27	Yes
PHP 8.3	8.3.36	Until 31/12/2027
PHP 8.2	8.2.35	Only until 31/12/2026
PHP 8.1, 8.0, 7.4 and older	No official release	No

PHP published minimal source patches for 7.4, 8.0 and 8.1, but the sensible move is PHP 8.4 or 8.3. Some Linux distributions backport the fix without changing the version number, so confirm with your provider.

Is it being exploited?

Yes. Amazon saw an exploitation attempt on 17 October, four days before disclosure, and Cloudflare and hosting companies have reported attacks. Cloudflare added protection rules for all customers, including free plans, but only updating PHP fixes it completely.

How to check if your website is affected

1. Our free check: Is your website vulnerable to PHP2Shell? tells you in a minute whether your site uses PHP or WordPress and whether it advertises an unpatched version. It doesn't attack your site: it opens it like a normal visitor.
2. Your hosting control panel: look for "PHP version" or "PHP selector".
3. WordPress: Tools › Site Health › Info › Server shows the PHP version.
4. Ask your provider (message below).

What to do, step by step

1. Take a full backup (files and database).
2. Update PHP to the fixed release of your branch, or better, to PHP 8.4.
3. Update WordPress, the theme and plugins: old ones are what usually breaks on modern PHP.
4. Test the site: home page, forms, cart, customer area.
5. Hide the PHP version (expose_php = Off).
6. If you can't update today, ask your provider for PHP's temporary mitigations or put the site behind a firewall such as Cloudflare. They reduce the risk but don't remove it.

What we saw on 1,290 small-business websites in Spain

On 22 October we looked at the home page of 1,290 websites of dental clinics, hair salons, beauty centres, garages and accountancy firms, reading only what each site shows any visitor. 69 % clearly run on PHP and 65 % are WordPress. 178 publicly show their PHP version: 47 % of those run an unsupported version (8.1 or older; 28 % still on PHP 7 or even 5), 42 % a supported branch without the fix, and only 11 % were already patched.

What to ask your host

Hello: regarding the PHP2Shell vulnerability (CVE-2026-109618 and CVE-2026-109619), which PHP version does my site [yourdomain.com] use, and does it already include the fix released on 21 October 2026 (8.5.12, 8.4.27, 8.3.36 or 8.2.35)? If not, can you update it or tell me how to do it in the panel? Thanks.

We can fix it for you

Backup, PHP update to a patched version, WordPress/theme/plugin update and testing, PHP version hidden, before-and-after check. Fixed price once we've seen your site and hosting. WhatsApp us at +34 919 93 43 69.

Frequently asked questions

What is PHP2Shell? The name of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (severity 9.2/10), fixed on 21 October 2026. They let an attacker run code on a website's server without a password.

Is my WordPress site vulnerable to PHP2Shell? If it runs on PHP older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or on PHP 8.1 or older, yes. The bug is in PHP, so an up-to-date WordPress is not enough.

How do I check if my website is affected? Look up the PHP version in your hosting panel or in WordPress (Tools › Site Health › Info › Server), or use our free PHP2Shell check.

Which PHP version do I need? At least PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP 8.4 is recommended: PHP 8.2 reaches end of life on 31 December 2026.

Will my site break if I update PHP? Very old themes or plugins can. Back up, update WordPress and plugins first, then test. You can switch back temporarily while fixing anything that fails.

Sources

• PHP security release (21/10/2026)
• Wiz Research: PHP2Shell
• Qualys: PHP2Shell
• Help Net Security
• W3Techs: PHP usage