Breaking: PHP2Shell PHP Security Vulnerability Puts Millions of Websites at Risk

Last updated: 22 October 2026. This is a developing story, and we will update this page as new information comes out.

PHP2Shell is a critical PHP security vulnerability in the programming language that runs most of the web, including every WordPress site. The fix came out on 21 October 2026, and security companies are already reporting attacks. If your website runs on PHP, you need to act this week.

This guide explains this PHP security vulnerability in plain English: what it is, what it means for the web, how to fix it, and what happens if you wait.

What Is PHP, and Why Should You Care?

PHP is the language that builds your web pages behind the scenes. When a visitor opens your site, PHP fetches your content from the database, puts the page together and sends it to their browser.

PHP powers about 70% of all websites whose server language is known, according to W3Techs. WordPress, the world’s most popular website platform, is written in PHP. So a serious PHP security vulnerability is not a problem for one plugin or one theme. It is a problem for a large share of the internet at once.

What Is the PHP2Shell PHP Security Vulnerability?

PHP2Shell is the nickname for this PHP security vulnerability, which is really two separate bugs. Both are rated 9.2 out of 10 (Critical) by the PHP security team. The name comes from what attackers can get: a “shell”, which means remote control of your server.

Think of your web server as a busy restaurant kitchen. Each visitor’s request is an order slip, and PHP is the cook working through the slips one by one.

Flaw 1: The Half-Written Order Slip (CVE-2026-109618)

Sometimes the kitchen runs out of counter space while a new order slip is still being written. The cook stops halfway. Later, when cleaning up, the cook treats that half-written slip as if it were complete and acts on it.

An attacker can deliberately send a request that causes this “out of space” moment, then fill the gaps in the slip with their own instructions. PHP ends up following the attacker’s instructions as if they were genuine.

Flaw 2: Leftover Notes From the Last Customer (CVE-2026-109619)

The cook is supposed to clear the counter between orders. Because of this bug, some notes from the previous order can stay behind, even after they were meant to be thrown away. The next order may pick up those leftover notes before the counter is wiped.

An attacker can use this to read information left over from other visitors’ requests, or to slip in their own instructions. The PHP team confirms both outcomes: leaking memory contents and running attacker code.

The worst part is that the attacker does not need a login, a password or any special access. Sending the right kind of web request is enough.

What Happened and When

Because the details leaked before the fix was ready, attackers had a head start. That is why this PHP security vulnerability needs faster action than a normal update.

Which Websites Are Affected by This PHP Security Vulnerability?

According to PHP’s advisory, every PHP installation that serves web pages is at risk, whatever server setup it uses. That includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Researchers trace the oldest affected code back to PHP 5.4, released in 2012.

The flaw is in PHP itself, not in your website software. Researchers have confirmed working attacks against WordPress, Drupal, Joomla and Magento sites. The same applies to custom PHP applications.

What Is the Impact on the Web?

Most website security problems affect one plugin or one platform. This PHP security vulnerability is different because it sits underneath all of them. A single flaw in PHP puts millions of sites at risk at the same time, from small blogs to online stores.

Once an attacker controls the server, they can do anything your website can do, and often more:

• Steal data: customer names, email addresses, order details, and the passwords and keys stored in your site’s settings.
• Read sensitive leftovers: the second flaw can expose passwords, tokens, API keys and certificates left in server memory.
• Plant hidden backdoors: small files that let them come back later, even after you update.
• Inject malware or spam: redirect your visitors to scam sites, or add hidden spam links that damage your Google rankings.
• Use your server against others: send spam email, mine cryptocurrency, or attack other websites.

Shared hosting makes this worse. Many websites can run on one server, so one unpatched PHP installation can put many sites at risk. Older PHP flaws have already been used in ransomware attacks, according to the US cybersecurity agency CISA.

What Happens If You Don’t Fix It?

Attackers do not pick targets by hand. They use automated tools that scan the internet for vulnerable servers, day and night. A site left exposed to a known PHP security vulnerability is likely to be found, even if it is small.

If your site is compromised, here is what typically follows:

• Google warnings: visitors may see “This site may be hacked” in search results, or a red warning screen in their browser.
• Lost rankings and traffic: spam injections and malware can push your pages down or out of search results.
• Hosting suspension: many hosts take infected sites offline to protect their other customers.
• Legal duties: if customer data is stolen, privacy laws in many countries require you to report the breach and notify the people affected.
• Cleanup costs: professional malware cleanup usually costs far more than an update. See our comparison of WordPress security services for typical prices.
• Lost trust: customers who see a warning screen often do not come back.

Updating PHP usually takes minutes. Recovering from a hacked site can take days.

How to Fix the PHP2Shell PHP Security Vulnerability

1. Check which PHP version you use. In WordPress, go to Tools > Site Health > Info > Server and look at “PHP version”. In cPanel, open MultiPHP Manager or Select PHP Version.
2. Compare it with the table above. If you are below 8.5.12, 8.4.27, 8.3.36 or 8.2.35 on your branch, you need to act.
3. Update PHP, or ask your host to. On managed or shared hosting, your host controls PHP. Send them the message below. If you manage your own server, install the patched packages from your Linux vendor or php.net, then restart PHP.
4. Pick the right version. If you are moving anyway, choose PHP 8.3 or 8.4 rather than 8.2, which reaches end of life on 31 December 2026. After switching, check that the PHP extensions your site needs are still turned on. Our guide on enabling PHP modules in cPanel shows how.
5. Take a backup and test your site. Back up first, then open your homepage, contact forms, checkout and admin area after the update. Older plugins can break on newer PHP versions.
6. Check for signs of a break-in. Amazon recommends looking back as far as 17 October. Look for admin users you did not create, unfamiliar files, and unexpected redirects. If anything looks wrong, follow our WordPress malware removal guide.
7. Add a firewall as a safety net. Cloudflare has added rules for known PHP2Shell attacks, including on its free plan. This only helps if your traffic runs through Cloudflare, and it does not replace the update.

Message to Send Your Hosting Company

Hello, please confirm whether the PHP version on my account is patched against PHP2Shell (CVE-2026-109618 and CVE-2026-109619). PHP fixed these in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If my server is not patched yet, when will it be? Thank you.

Will Updating WordPress or My Plugins Fix It?

No. PHP2Shell is a flaw in PHP, the software underneath WordPress. Updating WordPress, your theme or your plugins is still good practice, but it does not fix this PHP security vulnerability. Only a patched version of PHP does.

A security plugin cannot fully protect you either, because the attack can happen before WordPress even starts. Keep following the basics in our WordPress security checklist, but update PHP first.

A side benefit: newer PHP versions are also faster. Our guide to PHP performance optimization explains why.

PHP2Shell: Frequently Asked Questions

What is PHP2Shell?

PHP2Shell is the name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, fixed on 21 October 2026. They can let an attacker run their own code on a web server without logging in.

Is my WordPress site affected by PHP2Shell?

Probably, unless your host has already patched PHP. The flaw is in PHP itself, so it affects WordPress sites of any version. Check your PHP version under Tools, Site Health, Info, Server, and compare it with the fixed versions.

Which PHP versions fix PHP2Shell?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 contain the fixes. PHP 8.1 and older do not get an official release, so upgrade to a supported version or get a patched build from your host or Linux vendor.

Are attackers already using PHP2Shell?

Yes. Amazon and Cloudflare have both reported attack attempts, and Amazon saw the first attempt on 17 October 2026, four days before the fix was released. Treat this as urgent.

I am on shared hosting. What should I do?

Your host controls PHP on shared hosting. Ask them to confirm in writing that your server is patched against CVE-2026-109618 and CVE-2026-109619. If they cannot confirm a date, consider moving to a host that can.

Does a firewall protect me from PHP2Shell?

Only partly. Cloudflare has added rules that block known attack patterns, but new variations can get past firewall rules. A firewall buys you time. Updating PHP is the only complete fix.

Sources: PHP.net security advisory and release notes, Tenable PHP2Shell FAQ, Rapid7 analysis, Huntress rapid response, Infosecurity Magazine.