PHP2Shell: Is Your Website Affected, and What Should You Do Today?

If your website runs on PHP, and most business websites do, two critical vulnerabilities published last month need your attention this week. Together they are known as PHP2Shell, they are being actively exploited, and the fix is a PHP update that your host or developer can usually apply in minutes. This guide explains what is affected, how to check your own site, and what to do if you cannot update straight away.

What happened

On 21 October 2026, the PHP project released security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Each is rated 9.2 under CVSS v4.0, and the PHP project's advisory says they "can allow unauthenticated remote code execution". In plain English, an attacker who can reach your website may be able to run their own code on the server behind it, without a password.

The two flaws are different in detail. According to the PHP advisory, one involves out-of-memory handling that can interrupt PHP at an unsafe moment, and the other involves internal state from one request surviving after its memory has been freed. What matters for site owners is the outcome, which is the same for both: a possible full takeover of the server.

Is it being exploited?

Yes. Security firm runZero reports that both vulnerabilities were added to the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalogue on 26 October 2026, because of evidence of active exploitation. The Dutch National Cyber Security Centre is maintaining a public list of affected software, and F5 Labs' threat bulletin of 4 November describes attackers chaining PHP2Shell with other flaws to break into larger systems.

Which PHP versions are affected

PHP2Shell: affected and fixed versions by branch

PHP branch	Fixed in	Still supported by the PHP project?
8.5	8.5.12	Yes, active support
8.4	8.4.27	Yes, active support
8.3	8.3.36	Security fixes only, until 31 December 2027
8.2	8.2.35	Security fixes only, until 31 December 2026
8.1 and older	No official release	No. Treat as vulnerable unless your host has backported the fix

Two details catch people out:

• PHP 8.2 reaches end of life on 31 December 2026. If you update to 8.2.35 today, plan the move to 8.3 or newer soon, or you will be back in the same position in January.
• Linux distributions patch differently. Ubuntu, Debian and other distributions often fix vulnerabilities without changing the main version number, so a server reporting something like 8.1.2-1ubuntu2.20 may or may not be patched. Ask your host to confirm rather than guessing from the number.

How to check your website

There are three ways, from quickest to most certain.

1. Run our free check. Our website security check reads what your site reveals about itself in about ten seconds. If your server announces its PHP version, it will tell you whether that version is affected. It also checks your SSL certificate, your WordPress version and your security headers.
2. Ask your host. Send a one-line message: "Which PHP version is my site running, and does it include the fixes for CVE-2026-109618 and CVE-2026-109619?" A good host will answer the same day.
3. Check the server yourself. If you manage your own server, the command php -v shows the version. Remember that your website may use a different PHP version from the command line, so check the version your web server actually loads too.

What to do today

1. 01Find your versionUse the free check or ask your host which PHP version the site runs.
2. 02Update PHPMove to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer. On most hosting, this is a setting in the control panel.
3. 03Test the siteLoad key pages, submit a form and test checkout or booking flows after the update.
4. 04Look for signs of compromiseIf you were exposed for weeks, review recent file changes, admin users and scheduled tasks.

If your site is on PHP 8.1 or older, the honest answer is that a version upgrade is overdue. Older PHP versions also stop receiving fixes for the next vulnerability, and the one after that. Moving to a supported version can occasionally break old plugins or custom code, which is why it is worth testing on a copy of the site first.

If you cannot update straight away

The Dutch NCSC's operational notes and F5 Labs both state that updating is the only complete fix. As a short-term measure, setting session.upload_progress.enabled = 0 in your PHP configuration is reported to mitigate CVE-2026-109619, but it does nothing for CVE-2026-109618. Treat it as a way to buy hours, not a solution.

If you are behind a web application firewall such as Cloudflare, check whether your provider has published a rule for these vulnerabilities, but do not rely on it alone.

The bigger lesson: patching is a routine, not an emergency

PHP2Shell will not be the last critical PHP flaw this year. The businesses that barely noticed it are the ones whose sites are updated every month as a matter of routine, so an urgent patch is a small job rather than a crisis. Our guide to website and web application maintenance costs shows what that routine costs, and the maintenance checklist sets out what it should cover.

WordPress sites have a second reason to update this month. WordPress 7.1.4 fixes a separate flaw in the upgrade process, covered in our guide to the WordPress 7.1.4 security update.

Need a hand?

If you are not sure which PHP version your site runs, or you would rather someone else handled the update and the testing, our managed web application services keep PHP, WordPress and certificates current as standard. Or get in touch with your website address, and we will tell you where you stand.