PHP2Shell · CVE-2026-109618 & CVE-2026-109619

Is your website affected by the PHP flaw?

Two critical PHP security flaws were made public on 21 October 2026, and attackers started using them the same day. PHP runs most WordPress, WooCommerce, Drupal, Joomla and Magento sites. Check whether yours uses it, then get it patched without breaking anything.

Get help with my site Check my site
  • Fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12
  • PHP 8.1 and older get no official fix
  • Plain-English advice, no scare tactics

What's happened

Two serious flaws in PHP itself

This isn't a plugin or theme problem. The flaws are in PHP, the language most websites run on, so any site that handles requests with an unpatched version is exposed.

  • 01

    What it is

    Nicknamed PHP2Shell, the two bugs are rated 9.2 out of 10. They can let an attacker run their own code on your web server without logging in.

  • 02

    Who's at risk

    Any site running an unpatched PHP version. PHP powers around 7 in 10 websites, including most WordPress and WooCommerce sites.

  • 03

    Is it being used?

    Yes. Attacks were seen on 21 October, before the fixes were out, and automated scanning for vulnerable sites followed within hours.

  • 04

    Why sites went offline

    Government departments, hospitals and businesses across Europe took sites offline as a precaution while they patched. Most were back within a day or two.

What to do now

Five steps, in this order

  1. 01

    Find out if your site runs PHP

    Use the quick check above, or ask whoever built or hosts your site.

  2. 02

    Check which PHP version it's on

    In WordPress, go to Tools → Site Health → Info → Server. Otherwise, look in your hosting control panel or ask your host.

  3. 03

    Get on a fixed version

    You need PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer. Many hosts patched automatically, but ask yours to confirm the version in writing.

  4. 04

    On PHP 8.1 or older? Plan the upgrade

    Old versions get no official fix, so the site has to move to a newer PHP. That's where outdated themes and plugins break, so back up first and test on a copy.

  5. 05

    Check nothing got in

    Look for admin users you don't recognise, unfamiliar files, redirects or spam pages, then change your passwords.

How I can help

Patched properly, without breaking your site

Updating PHP on an older site is rarely a one-click job. I can do the careful version: back up, update, fix what breaks and check it over before it goes live.

I can:

  • Confirm whether your site is affected and which PHP version it runs
  • Update PHP safely, with a full backup first
  • Fix themes, plugins and code that break on newer PHP
  • Check for signs of compromise and clean up if needed
  • Rebuild very old sites as fast static sites, with no PHP left to patch

Common questions

PHP2Shell, answered plainly

Does my website use PHP?

If it's built on WordPress, WooCommerce, Drupal, Joomla, Magento, PrestaShop or OpenCart, yes. Sites on Shopify, Squarespace, Wix or Webflow don't run your own PHP, so the platform looks after this for you.

My host says they've patched it. Am I safe?

For PHP itself, probably, as long as you're on a supported version. Ask them to confirm the exact version number. It's still worth updating WordPress, plugins and themes, and checking nothing got in before the patch.

I'm on PHP 7.4, 8.0 or 8.1. What now?

There's no official fixed release for these versions, so plan a move to a supported one. PHP 8.3 or newer is the better target, as security fixes for 8.2 end on 31 December 2026.

Will updating PHP break my site?

On older sites, it can. The usual causes are outdated themes and plugins. Test on a copy first, and make sure you have a backup you know you can restore.

Is Cloudflare enough?

Cloudflare added firewall rules that block known attacks, but it calls them a stopgap. You still need to update PHP.

I've had an email saying my site is affected. Is it real?

Be careful. Scammers use news like this for phishing. Don't click links or log in from the email; go to your host's website directly instead.

Not sure where you stand?

Let's find out together.

Start with a free call. Tell me your website address and I'll explain plainly whether it's affected and what needs doing.

Start with a FREE call Request my rates

Sources

Last updated 28 October 2026.