php2shell is the name for CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities in PHP disclosed on 21 October 2026. Both can be exploited by an unauthenticated remote attacker to run code on the server.

Which PHP versions fix php2shell?

PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 7.4 to 8.1 have source backports only, and older versions have no fix.

Is my WordPress site affected by php2shell?

If it runs on an unpatched PHP version, yes. WordPress runs on PHP, so the fix has to come from your host or server, not a WordPress update.

Can your free check tell if I am exposed to php2shell?

If your server shows its PHP version, yes. If it hides the version, we tell you the fix cannot be confirmed from outside. We never attempt the exploit.

Security guide

php2shell: is your PHP website exposed?

php2shell is the name for two critical vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619. Either lets an attacker run code on your server without logging in. PHP released fixes on 21 October 2026, and attacks were already being seen from 17 October. If your site runs on PHP, including almost every WordPress site, it needs updating now.

Run the free security check

Which PHP versions are affected

Every PHP installation that serves web requests is affected, from PHP 5.4 onwards, whether it runs as PHP-FPM, mod_php, php-cgi, FrankenPHP or LiteSpeed. The fixed releases are:

PHP 8.2: fixed in 8.2.35
PHP 8.3: fixed in 8.3.36
PHP 8.4: fixed in 8.4.27
PHP 8.5: fixed in 8.5.12

PHP 7.4, 8.0 and 8.1 are past end of life and have no official fixed release; the PHP security team published source backports only, so most hosts will need to move you to a supported version. Anything from 5.4 to 7.3 has no fix at all.

What to do today

Ask your host which PHP version your site runs and whether it is a fixed release. Most control panels show it per site.
Update to the fixed release for your branch, or move up to a supported branch if you are on 8.1 or older. Take a backup first.
Because attacks started before the fix, check for signs of compromise: unknown admin users, recently changed files, unexpected scheduled tasks or redirects.
Change admin, database and hosting passwords, and rotate API keys stored on the server.

Temporary mitigations

If you cannot update straight away, PHP lists interim settings: session.upload_progress.enabled=0, and on PHP 8.5 fatal_error_backtraces=0, set in the server configuration and followed by a restart of every PHP worker. These reduce the risk; they do not make the server safe. Updating is the only complete fix.

How our free check helps

If your server announces its PHP version, the check compares it against the fixed releases. If the version is hidden, it notes that the site runs PHP and the fix cannot be confirmed from outside. Either way the details come to you privately, not on screen.

Questions people ask

What is php2shell?: php2shell is the name for CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities in PHP disclosed on 21 October 2026. Both can be exploited by an unauthenticated remote attacker to run code on the server.
Which PHP versions fix php2shell?: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 7.4 to 8.1 have source backports only, and older versions have no fix.
Is my WordPress site affected by php2shell?: If it runs on an unpatched PHP version, yes. WordPress runs on PHP, so the fix has to come from your host or server, not a WordPress update.
Can your free check tell if I am exposed to php2shell?: If your server shows its PHP version, yes. If it hides the version, we tell you the fix cannot be confirmed from outside. We never attempt the exploit.

Check your own site in thirty seconds

Our free, passive scan gives you a security score and grade, checks for the issues on this page, and keeps the details private. If you want them fixed, the Security fix package is a fixed price agreed up front.

Run the free security check About the Security fix