PHP2Shell: is your website affected?

What is PHP2Shell?

PHP2Shell is the name for two flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619. PHP is the language a large share of websites run on. Both flaws are rated Critical, with a CVSS 4.0 score of 9.2. They let an attacker run their own code on your server without logging in.

Every PHP version back to 5.4 is affected by at least one of the two. The news leaked on October 20, 2026. Fixed releases came out the next day, on October 21. They are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

The reach is wide. About 69 percent of websites use PHP, including every site built on WordPress, Drupal or Joomla. Some cPanel and Plesk hosting panels bundle PHP as well. Some European government portals and some Canadian government websites went offline for a while as a precaution.

Are attackers using it yet? The reports conflict. Amazon saw an attempt dated October 17, three days before the news leaked. Hosting partners reported attacks to Patchstack on October 21. Rapid7 and CISA had not confirmed any breaches as of October 21. So there are reports of attacks, and not all of them are confirmed. I updated this guide on October 23, 2026, with the reports known that day.

How can I tell if my site runs PHP?

If your site is WordPress, Joomla or Drupal, it runs PHP. If your hosting comes with a cPanel or Plesk login, your site very likely runs PHP too. Any one of the checks below is usually enough to know.

• Your site is built on WordPress, Joomla or Drupal. All three run on PHP.
• You log in at an address ending in wp-admin or wp-login.php. That is WordPress.
• Page addresses on your site end in .php. That is a strong sign the server runs PHP.
• Your host sends you to cPanel or Plesk to manage the site. Both usually show the PHP version on a page with PHP in its name.
• In WordPress, open Tools, then Site Health, then the Info tab. The PHP version is listed under Server.

One catch trips up even careful hosts. The PHP version that serves your web pages can differ from the one on the server’s command line. A host who checks the wrong one can tell you everything is current when your pages still run an old version. The server also has to restart before a patch takes effect. The message below asks about both.

What should I send my web host?

Send one short message today. It names the fixed versions, asks about the PHP that serves your pages, and asks about the restart. A good host can answer it in a few lines. Copy it, fill in your details, and send it to your host’s support address.

The same message works if a developer or an agency looks after your site. If you run your own server, those four questions are your own to-do list. For the longer set of questions worth asking after any alert, including backups and who to call, read what to ask your web host after a security alert.

What if my site runs PHP 8.1 or older?

PHP 8.1 and every older version are past end of life, so they get no new release. The PHP team posted source patches for 7.4, 8.0 and 8.1 for people who build PHP themselves. A site on 8.1 or older needs to move to a supported version. That is a job for your host or your developer. Ask them to put it first.

Some Linux distributions and long-term support vendors patch older versions on their own. Ask your host whether the server is covered by one of those, and get the answer in writing. Moving up a version can break an old theme or plugin, which is often why the site was left behind in the first place. Ask whoever looks after the site to take a backup, try the newer version on a copy, and then switch.

If nobody looks after the site at all, that is the bigger problem behind this one. I wrote about how I approach it in small business website security, and how I build with fewer ways in.

How do I know if my site was already broken into?

Security researchers point to five warning signs. Any one of them is a reason to contact your host today and ask them to look. A patch closes the hole, and anyone who got in before the patch may still be there.

• PHP files you did not add, or PHP files that changed when nobody touched the site.
• New admin users you do not recognise.
• Repeated HTTP 500 errors, where pages fail to load with a server error.
• Memory-limit errors showing up on pages or in the host dashboard.
• Restarts of the site or server that nobody can explain.

If you see any of these, the first hour matters. My guide to what to do when your website is hacked puts that hour in order, starting with your passwords.

I’m on Wix, Squarespace or Shopify. Do I need to do anything?

No. On Wix, Squarespace and Shopify, the platform company runs the servers. Owners on those platforms have nothing to update for PHP2Shell.

The usual habits still count. Use a strong password and two-step verification on your account, because that login is the part of the site you control.

What should I avoid?

Avoid unofficial “fix” plugins for PHP2Shell. The flaw is in PHP itself, which sits underneath WordPress and everything else on the server. The fix is the updated PHP release from your host, followed by a restart.

A plugin from an unknown source adds one more stranger’s code to a site that may already be a target. Wait for your host’s answer, and ask again if it does not come.

The fix lives on the server. Your job is to ask the person who runs it.

Sources and further reading

• Rapid7: critical unauthenticated remote code execution in PHP

  Checked October 23, 2026. Covers CVE-2026-109618 and CVE-2026-109619, the fixed releases, restarting every PHP worker after the update, and patches for Linux distributions and long-term support vendors.

• Patchstack: PHP major vulnerability alert, October 2026

  Checked October 23, 2026. Hosting partner reports of exploitation on October 21, the memory-limit, HTTP 500 and restart warning signs, and the advice to avoid unofficial fix plugins.

• Help Net Security: PHP2Shell vulnerabilities patched

  Checked October 23, 2026. The October 21 fixed releases: 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

• CybelAngel: critical PHP RCE vulnerabilities

  Checked October 23, 2026. Background on the two flaws, checking the PHP version the site reports while serving a request, restarting after the update, and the unexpected files and new admin users to look for.

• Wikipedia: PHP2Shell

  Checked October 23, 2026. The timeline, including the October 20 leak, the attempt Amazon saw dated October 17, the 69 percent figure, and the government websites taken offline as a precaution.

Frequently asked questions

Related pages

• Membership organization websites
• Professional services websites
• Retail and ecommerce websites