A critical PHP security issue known as PHP2Shell has prompted urgent security updates for websites and servers worldwide. Disclosed on 21 October 2026, the issue involves two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could allow unauthenticated attackers to execute code remotely under certain conditions.
The PHP development team has released patched versions, and security authorities are urging organisations to identify affected systems and update them promptly. The issue is relevant to developers, hosting customers, system administrators, and owners of websites built with PHP.
If you manage a WordPress website, a custom PHP application, or a server running PHP, the first step is to check which PHP runtime is serving your website and confirm that the relevant security fix has been applied.
This guide explains what PHP2Shell is, which versions have been fixed, how to check your hosting environment, and what to do if you cannot update immediately.
What Is PHP2Shell?
PHP2Shell is the name associated with two critical PHP vulnerabilities that can lead to unauthenticated remote code execution.
Remote code execution, commonly abbreviated as RCE, means an attacker may be able to make a vulnerable system execute unauthorised code remotely. Depending on the environment and permissions available to the PHP process, a successful attack could threaten application security and sensitive data.
The two vulnerabilities are:
- CVE-2026-109618: An out of memory handling flaw that can leave internal request data in an unsafe state during request cleanup.
- CVE-2026-109619: A stale internal state flaw that can cause a later request to use data associated with memory that has already been freed.
Both vulnerabilities received a CVSS v4.0 severity score of 9.2, classified as critical.
The PHP security team published fixes on 21 October 2026. The official advisory warns that PHP installations serving web requests are at risk, including configurations using PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.
Read the official PHP security announcement for the technical details and release information.
Why Should Developers and Hosting Users Care?
PHP powers many websites, content management systems, and server side applications. A vulnerability in the PHP runtime can therefore affect multiple types of web applications, not just one CMS or plugin.
1. Websites may be exposed through the PHP runtime
A website can use an up to date CMS and still run an affected PHP version. Updating WordPress core, a theme, or a plugin does not by itself patch the underlying PHP runtime.
2. Successful exploitation can have serious consequences
Depending on the server configuration and the privileges of the affected process, remote code execution could allow an attacker to alter files, access information available to the application, or establish further access.
These are potential consequences of exploitation, not proof that every vulnerable website has been compromised.
3. Hosting providers may manage PHP separately
On shared hosting, customers may select a PHP version through a control panel, while the hosting company manages the underlying packages and security patches. Other environments use containers, custom builds, or bundled PHP runtimes.
Consequently, checking a version number alone may not always prove whether a vendor specific security fix is present.
4. Older PHP branches require additional attention
PHP 8.1 and older branches no longer receive ordinary security maintenance from the PHP project. Some operating system distributors and long term support vendors may provide backported patches, but availability depends on the product and its support policy.
Do not assume an old PHP installation is protected merely because it reports the latest version available from an outdated repository.
Which PHP Versions Have Been Fixed?
The PHP development team published the following fixed releases on 21 October 2026.
| PHP branch | Initial fixed release |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
These are the initial fixed versions, not a recommendation to remain on an old release indefinitely. Install a later security update where one is available and appropriate for your environment.
What about PHP 8.1 and older?
PHP 8.1 and older versions are no longer supported by the upstream PHP project. PHP has published limited source backports for some older branches, and certain distributors may provide their own security updates.
If you must continue running an older branch, check with your operating system vendor, hosting provider, or software distributor for an explicitly confirmed fix. Otherwise, plan to upgrade to a supported PHP release and test your application for compatibility.
Important: Do not confuse the PHP version used by your command line with the version serving your website. Different applications, domains, containers, and background tasks can use different PHP runtimes.
Sources: PHP security releases and NCSC-NL PHP2Shell operational information.
How to Check Your PHP Version
Before applying a fix, identify the PHP runtime used by your application.
Method 1: Check your hosting control panel
If your website is hosted through a control panel, look for a PHP version or PHP configuration section.
- Sign in to your hosting account.
- Open the website or domain management area.
- Locate the PHP configuration or PHP version setting.
- Check which version is assigned to your domain.
- Review the hosting provider’s security advisory or ask support whether the relevant PHP2Shell fix has been applied.
- Confirm that the live website is using the protected runtime.
The menu names vary between hosting companies. On Hostinger, look for the PHP configuration options associated with the website in hPanel.
Changing a PHP version can affect application compatibility, so make a backup and check your site’s requirements before making changes.
Method 2: Check a WordPress website
WordPress administrators can inspect PHP information from the dashboard.
- Sign in to your WordPress admin area.
- Navigate to Tools → Site Health.
- Open the Info tab.
- Expand the Server section.
- Find the PHP version information.
- Confirm the patch status with your hosting provider if the reported version or package details are unclear.
This is a useful initial check, but it does not independently verify every vendor backport or server configuration.
Method 3: Check through SSH
If you manage your own server, you can run the following command in a shell:
php -v
This reports the PHP version used by the command line environment. It may not be the same runtime used by the live website.
For example, a server may run one PHP version for command line scripts and another through PHP-FPM or a web server module. Check the actual web serving configuration and package update status before concluding that the site is protected.
Avoid creating a publicly accessible PHP information file merely to check your version. Such files can reveal unnecessary server details. If a diagnostic file is necessary, restrict access and remove it immediately afterwards.
How to Apply the PHP2Shell Security Update
The PHP security team identifies updating to a fixed release as the complete remediation. The exact process depends on whether you use shared hosting, a managed platform, a virtual private server, or a self managed server.
Step 1: Back up your application
Create a recent backup of your website files and database before changing the PHP runtime.
For a production website, confirm that the backup can be restored and that you have access to the credentials and recovery process needed to bring the site back online.
Step 2: Check compatibility
Review the supported PHP versions for your CMS, plugins, themes, extensions, and custom code.
If your current branch is supported, update it to a fixed release or a later patched release. If it is no longer supported, plan a move to a supported branch rather than staying on an obsolete runtime.
Step 3: Update through your provider
For shared hosting, follow the provider’s PHP configuration and security instructions. Some hosts let you select a PHP version directly; others apply runtime patches centrally.
For a self managed Linux server, use the supported package repository and security instructions for your operating system. Avoid downloading random packages or replacing system PHP files manually without understanding the deployment.
If your PHP runtime is bundled with a control panel, appliance, container image, or third party product, check the supplier’s own advisory as well.
Step 4: Test your website
After applying the update, check the main parts of your application:
- Homepage and important landing pages
- Login and account management
- Forms and file uploads
- Database connections
- Checkout and payment functions, if applicable
- Scheduled jobs and background processes
- Application error logs
If problems appear, investigate compatibility and configuration rather than automatically reverting to a vulnerable version on an exposed production system.
Step 5: Verify the fix
Check the runtime again and confirm that the security update is present. If your provider applies security patches behind the scenes, ask for confirmation that the affected runtime has been patched.
Record the date, affected environment, version or package details, and any additional action required. This makes future security reviews easier.
What Should Shared Hosting Customers Do?
Shared hosting customers may not have root access or direct control over the PHP packages installed on the server. You can still take practical steps to confirm your website’s security.
- Check the PHP version assigned to each relevant website.
- Review the hosting company’s security notices.
- Contact support if the patch status is not clear.
- Ask whether the fix has been applied to the web serving runtime, not just the command line.
- If you control the PHP version, select an appropriate patched version after checking compatibility.
- Keep the CMS, themes, plugins, and other software updated independently.
You can send your hosting provider a message such as:
“Please confirm whether the PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 have been patched for the PHP runtime serving my website. Please also confirm whether any action is required from my side.”
If the hosting provider cannot confirm protection, request a clear remediation plan and expected timeline. Consider the risk of leaving an internet facing service exposed while waiting for a fix.
What Should WordPress Website Owners Do?
WordPress uses PHP, so administrators should verify the runtime and ensure that the relevant security patch is present.
However, PHP2Shell is a PHP runtime issue. Installing a WordPress security plugin or updating a theme is not a substitute for patching PHP.
WordPress owners should:
- Check PHP information in Site Health.
- Confirm the hosting provider has applied the relevant security fix.
- Update WordPress core, plugins, and themes separately.
- Remove plugins and themes that are no longer needed.
- Maintain recent backups.
- Review unexpected administrator accounts, file changes, or unusual activity if the site was exposed while vulnerable.
These additional security measures improve overall resilience, but they do not replace the PHP patch.
What If You Cannot Update Immediately?
If an update cannot be applied immediately, do not assume that a security plugin or a generic firewall rule completely removes the risk.
The UK National Cyber Security Centre recommends identifying affected systems, prioritising internet facing services, applying vendor updates, and using temporary mitigations where an immediate update is not possible.
If you cannot update:
- Contact your hosting provider or software vendor for an approved temporary mitigation.
- Assess the exposure of the affected service and whether it can be restricted safely.
- If appropriate protection cannot be established, consider taking the affected system offline until it can be secured.
- Review available logs for evidence of compromise if the service was exposed.
- Arrange the full security update as soon as possible.
The appropriate response depends on the system and its role. Do not apply unverified configuration changes to a production environment without understanding their effects.
Read the UK NCSC PHP security alert for its current recommendations.
How to Check for Signs of a Possible Compromise
Applying a security patch protects against the vulnerable code, but it does not prove that an attacker did not exploit the system before the update.
If your server was exposed while vulnerable, consider reviewing:
- Web server and PHP logs for unusual requests or errors
- Unexpected changes to application files
- New or unfamiliar administrator accounts
- Unknown scheduled tasks or background processes
- Unusual outbound network connections
- Changes to access credentials or application configuration
These indicators are not definitive proof of exploitation on their own. Investigate them in context and preserve relevant logs before making changes.
If you find credible evidence of compromise, involve your hosting provider or a qualified incident response specialist. Rotate potentially exposed credentials from a clean device and follow a documented recovery process.
Frequently Asked Questions
What is PHP2Shell?
PHP2Shell is the name associated with two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Under certain conditions, they can allow unauthenticated remote code execution on affected systems.
Which PHP versions should I install?
The initial fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Install a later patched release where available. For older branches or vendor managed packages, verify the exact security status with the supplier.
Are WordPress websites affected?
A WordPress website may be exposed if its PHP runtime is affected and has not been patched. Updating WordPress core alone does not fix the PHP runtime vulnerability.
Can my hosting company fix PHP2Shell for me?
Yes, if your provider manages the PHP runtime. Ask the provider to confirm the patch status of the runtime serving your website and whether you need to change any settings.
Does php -v prove that my website is protected?
No. It reports the command line PHP version, which may differ from the runtime serving your website. You must check the web runtime and the status of any vendor supplied patches.
Is PHP 8.2 still supported?
PHP 8.2 received a fix for this incident, but its upstream security support is scheduled to end on 31 December 2026. Plan a move to a supported branch and confirm current vendor guidance before making production changes.
Should I take my website offline?
Not every website requires the same response. If you cannot apply the patch or an approved temporary mitigation, assess the exposure and consider taking the affected service offline until it is protected, following the guidance of your hosting provider and relevant security authorities.
Final Thoughts
PHP2Shell is a serious reminder that the security of a website depends on its underlying runtime as well as its application code.
Developers should identify affected PHP installations, apply the relevant security updates, test their applications, and confirm that the web serving runtime is protected. Hosting customers should ask their provider for clear confirmation when patch status is uncertain.
If a vulnerable server was exposed before the update, consider reviewing logs and investigating suspicious activity. Patching is essential, but it does not establish that an earlier compromise never occurred.
For the latest technical information, use the official PHP security release archive and the UK NCSC alert rather than relying solely on third party summaries.
Sources and Further Reading
- PHP: 2026 security release archive
- UK National Cyber Security Centre: Critical security issue affecting PHP
- NCSC-NL: PHP2Shell operational information and affected software inventory
- Ubuntu: PHP2Shell vulnerability fixes available
- How to Back Up a WordPress Website: Complete Guide
- Critical PHP Vulnerabilities Discovered With AI: Update Your Server Now
Editorial note: Security advisories and vendor packages can change after initial disclosure. This guide reflects information checked on 26 October 2026. Confirm the latest vendor instructions before making changes to a production server.
