PHP2Shell: What the Critical PHP Vulnerability Means for Your Website

Last updated: October 21, 2026. This story is still developing. I’ll update this post as official advisories change.

If you have a website, there’s a good chance it runs on PHP. WordPress does. So do Drupal, Joomla, most shared hosting, and a huge share of the web. On October 21, 2026, the PHP project released an emergency security update for two critical flaws in PHP itself. The flaws have been nicknamed PHP2Shell.

Here’s what happened, in plain English, and exactly what to do about it.

What happened

PHP is the engine that builds your web pages on the server. Two serious bugs were found in that engine:

• • CVE-2026-109618, which the PHP project describes as “RCE via OOM corruption”

• • CVE-2026-109619, described as “RCE via stale global state”

RCE stands for remote code execution. That’s about as bad as it gets: an attacker could run their own code on your web server. According to PHP’s advisory, it can happen without logging in. Both flaws are rated 9.2 out of 10 for severity.

The details were supposed to stay private until the fix was ready, but they leaked a day early. The PHP project moved fast and released the update on October 21. Cloudflare’s CTO has said they’re seeing early attacks.

“All PHP users are strongly encouraged to update immediately.” — PHP security advisory, October 21, 2026

Is my website affected?

Probably, until your host updates PHP. This isn’t a WordPress bug or a plugin bug. It’s in PHP itself, underneath everything. Security researchers report it affects PHP whichever way your server runs it.

These versions are fixed:

• • PHP 8.5.12

• • PHP 8.4.27

• • PHP 8.3.36

• • PHP 8.2.35

If your site runs PHP 8.1 or older, those versions are past end-of-life and don’t get official fixes from the PHP project. Some Linux vendors and long-term-support providers have released their own patches, but the safe move is upgrading to a supported version. Also worth knowing: PHP 8.2 reaches end of life on December 31, 2026, so if you’re upgrading anyway, go to 8.3 or newer.

What to do right now

1. 1. Find your PHP version. In WordPress, go to Tools → Site Health → Info, then open the Server section. Look for “PHP version.”

1. 1. Ask your host if they’ve patched. Most website owners don’t update PHP themselves. Your host does. Some hosts moved early: SiteGround, for example, says it put protection in place on all its servers before the release. Don’t assume. Ask. There’s a message you can copy below.

1. 1. If you’re on PHP 8.1 or older, upgrade. Most hosts let you switch PHP versions from the control panel (cPanel, Plesk or their own dashboard). Pick 8.3 or 8.4. Back up your site first, then check it afterward, since older plugins sometimes complain on newer PHP.

1. 1. If you use Cloudflare, you have some extra protection. Cloudflare has added firewall rules, even on the free plan, that block the known attacks. That’s a seatbelt, not a fix. It only covers traffic that goes through Cloudflare.

1. 1. Don’t rely on settings tweaks. PHP’s own advisory says the only complete fix is updating. Other measures reduce exposure but “do not make an installation safe.”

A message you can send your host

Copy, paste, and fill in your domain:

Hi, I'm checking on the critical PHP vulnerabilities released on
October 21, 2026 (CVE-2026-109618 and CVE-2026-109619).

Has the server running [yourdomain.com] been updated to a patched
PHP version (8.5.12, 8.4.27, 8.3.36 or 8.2.35) or an equivalent
vendor patch? If not, when is it scheduled?

Thanks!

If they can’t give you a straight answer, that tells you something about your host too.

After it’s patched: a quick check-up

Patching closes the door. It doesn’t tell you whether anyone got in before it was closed. Since attacks were reported before most servers were updated, take five minutes to look around:

• • Users: in WordPress, go to Users and look for any administrator accounts you don’t recognize.

• • Strange files: your wp-content/uploads folder should hold images and documents, not .php files. If you see PHP files in there you didn’t put there, ask your host or a developer to take a look.

• • Recent changes: if your host’s file manager shows recently modified files you didn’t touch, that’s worth a question.

• • Run a scan: a security plugin or your host’s malware scanner is a good extra check.

Found something off? Don’t just delete it and move on. Change your passwords, then get help from your host or a developer to clean it up properly.

If you manage sites for other people

If you’re the “website person” for a church, a nonprofit, a friend’s shop or your clients, this is a good week to check in with all of them. A lot of small sites sit on old PHP versions for years because nobody’s looking. Make a list, check each site’s PHP version, and contact each host. It’s an hour of work that could save someone a very bad month.

Not sure where to start, or want a second set of eyes on your site? Reach out. Checking this is quick, and I’m happy to help.