PHP2Shell explained: is your website vulnerable, and how to patch it today

If you run WordPress, Laravel, Drupal, Magento or any other PHP site, this affects you. This guide explains what happened in plain language, then walks through checking and fixing your server step by step.

What is PHP2Shell?

PHP is the programming language behind a large share of the web, including WordPress. PHP2Shell is the nickname researchers gave two flaws found in PHP itself, not in a plugin or theme.

Both flaws are rated 9.2 out of 10 on the CVSS v4.0 severity scale. Together they can allow:

• Memory disclosure: an attacker can read parts of the server's memory, which may contain secrets.
• Unauthenticated remote code execution (RCE): an attacker can make the server run their own code, with no account and no password.

"Remote code execution without authentication" is the most serious kind of web vulnerability. In practice it means a stranger on the internet could take over your server, steal your database, plant malware or use the machine to attack others.

Why this one is urgent

• It's in PHP itself. Every site running an affected PHP version is exposed, regardless of how well the site code is written.
• Attacks started fast. Security firms reported exploitation attempts very soon after the release, and national security agencies, including the US NSA, told organisations to update immediately or take vulnerable systems offline.
• Automated scanning is underway. Bots scan the whole internet for vulnerable servers, so small sites are targets too. Attackers don't need to know who you are.

Fixed PHP versions

Some Linux distributions and commercial vendors publish their own patched packages for older branches (for example AlmaLinux packages and extended-support programs). If you rely on one of those, check the vendor's advisory, because their version numbers differ from the official ones.

Step 1: find out which PHP version you're running

On a server with shell access:

php -v

The web server can use a different PHP than the command line, so also check what your site actually runs. Create a temporary file in your web root:

<?php echo PHP_VERSION;

Open it in your browser, note the version, then delete the file immediately.

On shared hosting or managed WordPress: look in your hosting control panel (cPanel "Select PHP Version", Plesk "PHP Settings", or your host's dashboard). In WordPress, go to Tools → Site Health → Info → Server.

Step 2: update PHP

Ubuntu or Debian

sudo apt update
sudo apt install --only-upgrade 'php*'
sudo systemctl restart php*-fpm apache2 nginx 2>/dev/null
php -v

If you use the popular Ondřej Surý PPA, the patched builds arrive through the same apt update.

RHEL, AlmaLinux, Rocky Linux

sudo dnf upgrade 'php*'
sudo systemctl restart php-fpm httpd nginx 2>/dev/null
php -v

Docker

Updating the host does nothing for containers. Rebuild your images on a fixed base image:

# Pin to a fixed patch release (or newer)
FROM php:8.4.27-fpm

docker build --pull -t my-app .
docker compose up -d --force-recreate

The --pull flag makes sure you get the newest base image instead of a cached, vulnerable one.

Shared hosting and managed WordPress

You usually can't patch PHP yourself. Check your host's status page or email for a PHP2Shell notice, confirm your site shows a fixed version in Site Health, and if it doesn't, open a support ticket today. Most large hosts patch their platforms centrally.

Step 3: confirm the fix

Run php -v again (and recheck through the web server). The version must be equal to or higher than the fixed version for your branch in the table above.

If you can't update right now

Updating is the only complete fix. If you're blocked for a few hours, reduce risk while you work on it:

• Put a web application firewall (WAF) in front of the site. Managed WAF services often ship rules for major vulnerabilities like this; check your provider's notes to confirm PHP2Shell is covered.
• Restrict access to admin areas and non-public apps by IP or VPN.
• Take non-essential PHP apps offline until they're patched.
• Watch your logs for unusual requests and new files in upload or web directories.

These steps lower the risk; they don't remove it.

Were you already attacked? Signs to check

Because exploitation started quickly, also look for signs that someone got in before you patched:

• New or changed PHP files in web directories, especially in uploads/ folders or with random names.
• Unknown admin users in WordPress or your app.
• Unexpected cron jobs (crontab -l) or processes using high CPU (often crypto miners).
• Outbound connections to unknown servers.
• Security plugin or host alerts about malware.

If you find anything suspicious, treat the server as compromised: restore from a clean backup taken before October 2026, patch PHP before bringing it back online, and rotate every password, API key and database credential the server could access.

Patching stops new attacks; it doesn't remove an attacker who already got in. That's why the check above matters.

Why some experts say "patch, then keep watching"

At least one security research team reported that the official release fixes the two CVEs but that related attack paths may still exist on some configurations. That's not a reason to delay updating. It's a reason to keep defence in depth: a firewall, least-privilege file permissions, up-to-date plugins and monitoring.

Checklist

• Find the PHP version your site actually runs
• Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or newer)
• Rebuild Docker images with --pull
• Move off PHP 8.1 or older
• Confirm the version after restarting services
• Check for signs of compromise
• Rotate credentials if anything looks wrong
• Keep a WAF and monitoring in place

Frequently asked questions

What is PHP2Shell?

PHP2Shell is the name for two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, patched on October 21, 2026. Rated 9.2 (CVSS v4.0), they can allow memory disclosure and unauthenticated remote code execution on servers running affected PHP versions.

Which PHP versions fix PHP2Shell?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 contain the fixes. Any newer release on those branches is also fixed. PHP 8.1 and older are end of life and receive no official patch.

Is WordPress affected by PHP2Shell?

The vulnerability is in PHP itself, so any WordPress site running an affected PHP version is exposed regardless of its plugins and theme. Check your PHP version in Tools → Site Health → Info → Server and ask your host to update it if it isn't fixed.

How do I check my PHP version?

Run php -v on the server, and also check the version the web server uses, because it can differ. On hosting panels, look in the PHP settings; in WordPress, use Site Health. Make sure it is at or above the fixed version for your branch.

Does updating my Docker host fix PHP containers?

No. Containers ship their own PHP. Rebuild your images on a fixed base image (for example php:8.4.27-fpm or newer) using docker build --pull, then recreate the containers.

What if I can't update PHP immediately?

Put a web application firewall with PHP2Shell rules in front of the site, restrict access to admin areas, take non-essential PHP apps offline and monitor logs. These steps reduce risk but updating PHP is the only complete fix.

How do I know if my site was hacked through PHP2Shell?

Look for new or modified PHP files in web and upload folders, unknown admin accounts, unexpected cron jobs, high CPU use and unusual outbound connections. If you find any, restore from a clean backup, patch PHP and rotate all credentials.

Is PHP 8.1 still safe to use?

No. PHP 8.1 is end of life and does not receive an official fix for PHP2Shell. Upgrade to a supported branch such as 8.3, 8.4 or 8.5, or use a vendor that provides extended security support for 8.1.

Sources

• Help Net Security: PHP2Shell vulnerabilities patched
• Datadog Security Labs: detection, analysis and remediation
• Qualys: PHP announces critical security release
• NCSC-NL: operational information on php2shell
• AlmaLinux: patched PHP packages
• TechCrunch: the internet is having a very bad cybersecurity day