PHP2Shell: two critical PHP flaws, and what your website needs to do

What happened

PHP is the programming language behind WordPress, Drupal, Joomla and many other website tools. W3Techs counts it on 69.3% of websites whose server-side language is known, as of October 22, 2026.

On October 20, the PHP project warned that an urgent security release was coming. On October 21 it shipped fixes for all four supported versions of PHP:

The releases fix two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both are memory bugs in the way PHP handles a web request. Both are rated 9.2 out of 10 (critical) on the CVSS scale, and both can let an attacker run their own code on the server without logging in. That is called remote code execution.

According to PHP’s advisory, every PHP installation that serves web requests is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest on mod_php, where a working attack has been shown to run before any of your site’s own code does.

According to the PHP Foundation, the security firm Calif and OpenAI each reported the main flaw to PHP on August 11, 2026, and researchers at Wiz reported further ways to attack it on August 24. All three used AI tools in their research. Wiz says it took over test installations of WordPress, Drupal and Joomla, and that every PHP version released in the last decade, back to PHP 5.4, has at least one of the two bugs.

Is anyone using it yet?

Yes. Amazon’s threat intelligence team says one of its honeypots (decoy servers set up to catch attacks) recorded a PHP2Shell attempt on October 17, four days before the public announcement, though it says it is unclear whether those early attempts would have worked. Amazon now says the flaws are being broadly exploited, according to Infosecurity Magazine. Cloudflare says it has seen attack traffic against its customers, and its chief executive, Matthew Prince, wrote that attempts grew from thousands before the disclosure to millions after it.

Cloudflare switched on firewall rules against PHP2Shell at 3:02 a.m. UTC on October 21, nearly 11 hours before the 14:00 UTC release (Cloudflare’s post says about nine). They are on by default for every plan with its web application firewall, including the free plan. The UK’s National Cyber Security Centre advises organizations to find their PHP systems and update them. Where that isn’t possible, it says to apply the PHP Foundation’s temporary mitigations, and if those can’t be applied, to consider taking the system offline.

PHP also runs inside products that aren’t websites. Help Net Security reported that Palo Alto Networks listed all versions of its PAN-OS and Panorama software as affected, with no fix as of October 22.

What to do

If you use a hosted website builder

Squarespace, Wix, Shopify, WordPress.com and similar platforms run their own servers, so there is no PHP for you to update. Patching is the platform’s job.

If your site runs on WordPress or another PHP app with a web host

1. Check your PHP version. In WordPress, go to Tools, then Site Health, then the Info tab, and open Server. Many hosts also show it in their control panel.
2. Ask your host to confirm the fix. Some Linux distributions and long-term support vendors provide their own backported fixes, so a version below the ones in the table above may still be patched. Your host can tell you for sure.
3. If you’re on PHP 8.1 or older, plan the upgrade now. Those versions no longer get updates from the PHP project. Minimal fixes exist for 7.4, 8.0 and 8.1, but WordPress.org suggests that people who manage their own servers on these versions consider taking them offline while they upgrade. Note that PHP 8.2 itself stops getting security fixes on December 31, 2026.
4. Don’t wait for a WordPress update. WordPress.org says no WordPress update is required or planned, because the flaws are in PHP itself. Cloudflare notes that updating plugins alone won’t fix them.
5. A firewall helps but isn’t a fix. If your site sits behind Cloudflare, its rules block known attacks. Cloudflare itself says you still need to patch PHP.
6. Watch for warning signs. Wiz suggests looking for repeated server errors (HTTP 500), “memory limit” errors and unusually large session cookies in your logs. If you see them, tell your host.

What this means when you choose a platform

This is the trade-off behind self-hosted WordPress. You get full control and the best exit score, but someone has to keep the server software up to date: you, your host or the person who runs your site. A hosted builder handles that for you, in exchange for less control. We compare the routes in website builder vs WordPress vs agency, and our WordPress review covers what upkeep involves.

Sources

1. PHP: security releases, October 21, 2026
2. PHP Foundation: Today's PHP security release, and how we're strengthening PHP security (Oct 21, 2026)
3. UK National Cyber Security Centre: Critical security issue affecting PHP (Oct 21, 2026)
4. PHP security advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
5. PHP security advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
6. WordPress.org: Critical PHP Security Release (Oct 21, 2026)
7. Wiz Research: PHP2Shell (Oct 21, 2026)
8. Cloudflare: protections against php2shell (Oct 21, 2026)
9. Infosecurity Magazine: PHP2Shell exploitation attempt detected four days before disclosure (Oct 22, 2026)
10. BleepingComputer: PHP ships emergency patches for critical PHP2Shell flaws (Oct 21, 2026)
11. W3Techs: usage statistics of PHP (checked Oct 22, 2026)
12. Help Net Security: PHP2Shell, critical PHP vulnerabilities patched (Oct 21, 2026)

News on Web Building is checked against the sources listed above. Spotted something out of date? Write to [email protected].