PHP2Shell: What the Critical PHP Flaw Means for Your Website

The PHP2Shell vulnerability lets a stranger run code on your web server with a single request, no password required. If your website runs on WordPress, WooCommerce or any other PHP software, consider this your sign to check your PHP version today, not "sometime after the weekend".

Table of Contents:

• What Is PHP2Shell?
• Why Is PHP2Shell So Dangerous?
• When Did Attacks Start?
• Does PHP2Shell Affect Your Site?
• How to Check PHP Version?
• Can Security Plugins Stop PHP2Shell?
• What Did MPiFY Do?
• How to Protect Your Site?

What Is PHP2Shell?

PHP2Shell is the nickname for two critical security flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, that let an attacker run their own code on a server without logging in. PHP is the language behind WordPress and roughly 70% of websites whose server-side language can be identified, so this is not a niche problem.

In plain English, PHP can be tricked into reusing memory it should have cleaned up. An attacker sends a carefully built request, PHP trips over its own leftovers, and the attacker's code runs. The PHP project shipped fixes on 21 October 2026.

Why Is PHP2Shell So Dangerous?

It is dangerous because it needs no login and it triggers before WordPress, your security plugin or your firewall rules even wake up. The flaws carry a CVSS severity score of 9.2 out of 10, which is the security world's way of saying "drop your coffee".

Think of a burglar who skips the front door, ignores the alarm and is already on your sofa before you hear a sound. That is why the usual protections never get a look at the attack, and why this PHP flaw is a server problem rather than a WordPress problem.

When Did Attacks Start?

Earlier than anyone would like: Amazon's security team spotted the first attempt on 17 October, four days before the fix went public. Details leaked on 20 October, PHP warned that an emergency release was coming, and working attack code started circulating within hours of the patch on 21 October.

The numbers got loud fast. Cloudflare's CEO said the company saw thousands of exploitation attempts in the 10 hours before the patch was announced. Most attempts have reportedly failed so far, but "most" is not a security strategy, and anyone investigating a server should look back to 17 October, not 21.

Does PHP2Shell Affect Your Site?

Yes, if your site runs on PHP and the server has not been updated since 21 October. PHP says every installation serving web pages is at risk, whatever the setup, and the fix is a PHP update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on your branch.

How to Check PHP Version?

In WordPress, go to Tools, then Site Health, then Info, open the Server section and look for "PHP version". If you cannot see it, ask your host or your web agency, because it is a one-line answer for them.

Do not settle for a vague "yes, the server's updated". Ask for the exact version number, in writing, and compare it with the table above. If your site also needs a proper tune-up while you are at it, our web design and development guide explains what a healthy build looks like.

Can Security Plugins Stop PHP2Shell?

Not reliably, because the attack lands before WordPress loads, so plugins like Wordfence or All-In-One Security never get to see it. Firewalls can block some known attack patterns, but attackers have already been adapting payloads to dodge firewall rules, and PHP is clear that only the update fixes the flaw.

Keep your plugins, by all means. They are a seatbelt, and the PHP update is the brakes.

What Did MPiFY Do?

Malta-based digital agency MPiFY went through every server and site it looks after on 22 October, so if we host or manage your website, it is protected and you do not need to do anything. We checked that every PHP version is on the fixed release, and got written confirmation from our hosting partner for the older versions that rely on their own patch.

We also switched on the emergency settings PHP recommends for unpatched servers as a second layer, and searched every client site for files planted since 17 October. We found none, and we removed a handful of old diagnostic and backup files that could have given an attacker a head start. Sites still on PHP 8.1 are moving to 8.3, tested one by one so nothing breaks.

That is the day-to-day work behind our SiteCare and web hosting service. A hacked site is also bad news for rankings, which is why security and SEO belong in the same conversation, and why a full-service digital agency can save you from juggling five suppliers during a security scramble.

How to Protect Your Site?

MPiFY's advice for self-managed sites is simple: start with the update, and treat everything else as a backup plan. Check your PHP version, ask your host to confirm in writing that it runs a fixed release, and if you are on PHP 8.1 or older, plan a move to 8.3 or newer. Update your plugins and theme first, then test the switch on a staging copy before touching the live site.

If your host has switched off a setting called session.upload_progress, leave it off. WordPress itself does not need it, and PHP repeated that advice on 23 October for a separate follow-up flaw, CVE-2026-115560. Then look for signs of a break-in going back to 17 October: admin users you do not recognise, .php files inside wp-content/uploads, or pages you never changed.

While you are in there, update WordPress, plugins and themes, because an outdated plugin is still the most common way into a WordPress site. If the audit shows your site is past its sell-by date, our web design team can rebuild it on a stack that is easier to keep safe.

Not sure where your site stands?‍

Send MPiFY your website address and we will check its PHP version and tell you, in plain English, whether you are exposed. No charge, no sales pitch.

See also: What Is PHP2Shell? PHP Security Issues Explained Like You’re 5

FAQ

What is PHP2Shell?

It is the name for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, fixed on 21 October 2026, that let an attacker run code on a web server without logging in.

Is WordPress affected by PHP2Shell?

Yes, because WordPress runs on PHP, but the flaw is in PHP itself, so updating WordPress alone will not fix it.

Will my security plugin protect me?

No, as the attack happens before WordPress loads, so only a PHP update closes the hole.

Is PHP2Shell being used in real attacks?

Yes, Amazon recorded the first attempt on 17 October 2026, four days before the fix, and reports broad exploitation attempts since.

Which PHP versions fix the PHP2Shell vulnerability?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 or later.

My site runs on PHP 8.1. Is it safe?

Only if your host has applied its own patch, so ask for confirmation in writing and plan a move to PHP 8.3 or newer.

I'm an MPiFY client. Do I need to do anything?

No, we have patched and checked every site we host and manage, and we will contact you directly if anything needs your input.

Key Takeaways

• The PHP2Shell vulnerability is rated 9.2 out of 10 for severity and needs no login to exploit.
• PHP runs roughly 70% of websites with an identifiable server-side language, so the exposure is huge.
• Amazon spotted the first attack attempt on 17 October 2026, four days before the fix.
• Cloudflare reported thousands of exploitation attempts in the 10 hours before the patch announcement.
• The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
• Security plugins cannot stop it, so only a PHP update closes the hole.
• Ask your host for the exact PHP version in writing, or let MPiFY check it for you.

‍