What is php2shell (CVE-2026-109618 and CVE-2026-109619)?
Php2shell is the name researchers gave two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619. On 21 October 2026 the PHP project fixed them in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (PHP).
Both are memory-handling bugs inside PHP itself. A specially crafted web request can let an attacker run their own code on the server, without a password. That’s the worst kind of website flaw, because it can mean a defaced site, stolen customer data or a server used to attack others.
Your website code doesn’t need to have a bug for this to matter. The flaws are in PHP, so any site running an affected version is in scope.
Is your website affected?
If your site runs on PHP, assume yes until your host confirms otherwise. That includes most WordPress, Joomla, Drupal and WooCommerce sites, plus many custom sites built in the last 20 years.
Default installs from PHP 5 onwards are affected. PHP says every installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It considers mod_php the highest risk, because a demonstrated attack works before any of your site’s own code runs.
| Your PHP version | Fixed in | What it means |
|---|---|---|
| 8.5 | 8.5.12 | Update to this release or later |
| 8.4 | 8.4.27 | Update to this release or later |
| 8.3 | 8.3.36 | Update to this release or later |
| 8.2 | 8.2.35 | Update to this release or later |
| 8.1, 8.0, 7.x, 5.x | No official fix | Upgrade, or get a backported fix from your Linux vendor |
Many Linux distributions, such as Ubuntu and Debian, backport fixes into their own PHP packages without changing the version number. So a site that shows “PHP 8.1” might be patched by its host. Only your host can tell you for sure.
Not sure what your site runs? Our free website security check reads what your homepage shows the public, in about 10 seconds.
Are attackers using it?
Security firm watchTowr reports exploitation in the wild since 21 October 2026, seen in its honeypots (watchTowr). As of 22 October, the US cybersecurity agency CISA had not added either flaw to its Known Exploited Vulnerabilities list.
Government advisories in Singapore and Canada told organisations to patch immediately and to put internet-facing sites first (CSA, Cyber Centre). Treat this as urgent, not as something for next quarter.
What to do this week
- Run our free website security check on your site. It shows whether your site reveals an old PHP version, or runs PHP with the version hidden.
- Email your host or developer. Ask: “Which PHP version does our site run, and was it updated after 21 October 2026?” You want 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later, or written confirmation of a vendor backport.
- If you’re on PHP 8.1 or older, ask what it takes to move to PHP 8.2 or later. Old plugins and themes are often what stops the upgrade.
- Ask them to check the server logs for anything unusual since 21 October, especially if the site wasn’t updated quickly.
- Update WordPress, plugins and themes while you’re at it. They don’t fix this flaw, but an old site usually has more than one problem.
Patch it or rebuild it?
A patch is enough for many sites. A rebuild makes sense when the PHP upgrade is the tip of a bigger problem.
| Your situation | What we’d suggest |
|---|---|
| PHP 8.2 or later, site kept up to date | Patch. Confirm the update with your host and move on. |
| PHP 8.1 or 8.0, site works well | Upgrade PHP. Budget for a developer to fix any plugin or theme that breaks. |
| PHP 7 or 5, plugins years out of date | Get a quote for both. Upgrading an old site can cost close to a rebuild. |
| No one maintains the site, or no one has the logins | Rebuild, and make sure you own the code, hosting and domain this time. |
| You wanted a new site anyway | Rebuild on a modern stack, and retire the old server. |
We build fast, modern websites you fully own, without a PHP server to patch. If you’re not sure which way to go, request a call or quote from your check result, or get a free estimate.
Common questions
Does this affect WordPress sites?
Yes, if they run an affected PHP version, because WordPress runs on PHP. The fix is a PHP update on the server, not a WordPress update. Your host or developer applies it.
My site shows PHP 7.4. Has it been hacked?
Not necessarily. An old version number is a sign of risk, not proof of a break-in. But PHP 7.4 won’t get an official fix, so ask your host whether they backport fixes, and plan an upgrade or rebuild soon.
My host says we are patched, but the version number didn’t change. Is that OK?
It can be. Linux distributions such as Ubuntu and Debian often backport fixes into their own packages without changing the PHP version number. Ask your host to confirm in writing which package or advisory covers CVE-2026-109618 and CVE-2026-109619.
Does your website security check test for the flaw?
No. It makes a normal visit to your homepage and checks that http redirects to https. It reads what your site shows the public, such as the PHP version, platform, certificate and security headers. It never sends attack payloads or probes other pages.
Is turning off session upload progress enough?
No. It blocks one attack path for one of the two flaws. PHP says workarounds reduce exposure but don’t make an installation safe. Update PHP as soon as you can.
Sources
- PHP: security release fixing two critical vulnerabilities, 21 October 2026
- NVD: CVE-2026-109618
- NVD: CVE-2026-109619
- watchTowr: PHP CVE-2026-109618 FAQ
- Cyber Security Agency of Singapore: AL-2026-151, Critical Vulnerabilities in PHP (PHP2Shell)
- Canadian Centre for Cyber Security: AL26-026, Critical vulnerabilities impacting PHP
- Red Hat: CVE-2026-109618