PHP2Shell: The Critical PHP Vulnerability and What Your Business Should Do Now
If your business has a website, there’s a very good chance it runs on PHP. It’s the programming language behind WordPress, Joomla, most online shops and a huge share of the websites on the internet.
Today, 21 October 2026, the PHP project released emergency security updates for two critical vulnerabilities, nicknamed PHP2Shell. They allow an attacker to take control of a web server without needing a password or any login at all, and security companies are already seeing attackers trying to use them.
This guide explains what has happened, whether your website is likely to be affected, and exactly what to do.
What is PHP2Shell?
PHP2Shell is the name given to two flaws in PHP itself:
- CVE-2026-109618, a problem with how PHP handles running out of memory while processing a request.
- CVE-2026-109619, a problem where information left over from one visitor’s request can be misused by the next request on the same server.
Both are rated 9.2 out of 10 for severity. In the worst case, an attacker can send a specially crafted request to your website and run their own code on the server. From there they could steal data, install malware, deface the site or use it to attack your customers.
The flaws were found by security researchers at Wiz, Calif and OpenAI, working with the PHP security team. The fix was due out on 22 October, but details leaked online on 20 October, so it was released a day early.
Why this one matters
Most website security problems are in a particular plugin or theme. This one is different: the flaw is in PHP itself, the engine underneath your website. That means:
- Your site can be vulnerable even if WordPress and every plugin are fully up to date.
- It affects almost every version of PHP going back to PHP 5.4, released in 2012.
- On some server setups (Apache with “mod_php”), the attack can happen before your website’s own code even runs.
Security firms including watchTowr and Cloudflare reported attackers trying to exploit the flaws within hours of the release. At the time of writing, no confirmed successful break-ins have been reported, but that tends to change quickly once the details are public.
Which versions are fixed?
The fixed versions of PHP are:
| PHP version | Safe from |
|---|---|
| 8.5 | 8.5.12 or later |
| 8.4 | 8.4.27 or later |
| 8.3 | 8.3.36 or later |
| 8.2 | 8.2.35 or later |
| 8.1, 8.0, 7.4 | No official update (unsupported) |
| 7.3 and older | No fix at all |
If your website runs on PHP 8.1 or older, there is no ready-made update. Those versions are no longer supported, so this is the moment to move to a current version.
What should you do?
1. Find out who looks after your website and hosting
This is the most important step. If your website is with a hosting company such as 20i, SiteGround, IONOS, GoDaddy or similar, they control the PHP version on the server, not you.
Contact them today and ask:
- Have you updated PHP to a fixed version (see the table above)?
- Have you restarted PHP so the update has taken effect?
- Is my website on a supported version of PHP (8.2 or newer)?
Many good hosts update automatically and quickly, but don’t assume. Ask.
2. Check your PHP version
Most hosting control panels show the PHP version for each website, usually in a section called “PHP version”, “PHP settings” or “Software”. If it’s older than 8.2, ask your host or web developer to upgrade it, after checking your site works on the newer version.
3. If you run your own server, update it now
If you or your IT team manage the web server yourselves:
- Install the patched PHP version from your operating system’s updates or the PHP website. For Linux packages, check the package’s changelog mentions CVE-2026-109618 and CVE-2026-109619, rather than relying on the version number.
- Restart Apache, PHP-FPM and any other PHP services afterwards. The fix doesn’t take effect until PHP restarts.
- Updating WordPress does not update PHP. They are separate.
4. If you can’t update straight away
There are temporary settings that reduce the risk, but the PHP project is clear that only updating fully fixes the problem. If you have a developer or IT provider, they can:
- Turn off PHP’s “session upload progress” feature (
session.upload_progress.enabled=0). - Change PHP’s memory settings exactly as described in the official PHP advisory, and keep upload size limits small.
- Put the site behind a web application firewall such as Cloudflare, which has added rules to block known attack attempts.
Treat these as a short-term stopgap only.
5. Look out for signs something has already happened
Because attacks started before many sites were updated, it’s worth asking your host or developer to check the logs for:
- Sudden bursts of errors (HTTP 500) or “memory limit” errors.
- Unexpected new files, admin users or changes on the website.
- Unusual visits that upload large amounts of data.
If anything looks wrong, change your website passwords, check for unknown admin accounts, and restore from a clean backup if needed.
What about Microsoft 365, our computers and email?
PHP2Shell affects web servers running PHP. It doesn’t affect your Windows or Mac computers, Microsoft 365, or your email directly. The risk is to your website and anything connected to it, such as customer accounts, contact form submissions or an online shop.
The bigger lesson
PHP2Shell is a good example of why “set it and forget it” doesn’t work for websites. Software underneath your site needs regular updates, and someone needs to be watching for alerts like this one so they can act the same day.
That’s part of what we do for our managed IT clients: keeping an eye on security alerts, checking which systems are affected and making sure updates actually get applied. If you’re not sure whether your website is safe, or who is responsible for keeping it updated, get in touch and we’ll help you find out. You can also read more about our cyber security services.
