PHP2Shell: What Happened with PHP and What to Ask Your Web Host Today

On October 21, 2026, the PHP project released a security update that fixes two critical flaws, known as PHP2Shell. If your website runs on PHP (and that includes WordPress, WooCommerce and many other sites), what you need to do today is short: check which PHP version your site uses, ask your web host to confirm it's already updated and, if they don't answer, ask whoever built your site. You don't need to switch platforms or rebuild anything.

This guide explains, without jargon, what happened, who it affects and how to do those three steps in a few minutes.

What happened with PHP?

PHP is the language that quietly powers a large share of websites: WordPress, WooCommerce, Drupal, Magento, Laravel and many custom builds. You rarely see it, but it's there.

On October 20, the PHP security team announced an upcoming update for two critical vulnerabilities, both rated 9.2 out of 10 on the CVSS v4.0 severity scale. On October 21 it was released. According to the official php.net advisory, the two flaws (CVE-2026-109618 and CVE-2026-109619) can allow unauthenticated remote code execution. In plain terms: under certain conditions, someone on the internet could make the server run their own instructions without a username or password.

According to php.net, these are the versions that fix the problem (or any newer version in the same branch):

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

php.net itself says there's no measure that replaces the update: some settings reduce exposure in the meantime, but updating is the only complete fix.

Who does it affect? Only WordPress?

No. It affects any server running PHP to serve web traffic, not just WordPress. The php.net advisory refers to "all PHP installations serving web requests" and lists several common hosting setups, including one that's very common on shared hosting, where it considers the risk highest.

It doesn’t matter whether your site runs PHP 8.2, 8.3, 8.4 or 8.5. Any installation that doesn’t have the October 21 security update yet is exposed, including the newest versions. The only thing that settles it is confirmation that the update has been applied.

The WordPress.org announcement from October 21 is clear: the flaws aren't specific to WordPress, they affect any server hosting a PHP application, and no WordPress update is required or planned for this. Keeping WordPress and your plugins up to date is still good practice, but it doesn't fix PHP2Shell. What needs updating is PHP, and in most cases your web host does that.

If your site doesn't use PHP, this particular flaw doesn't apply to you. If you don't know what your site is built with, that's exactly the third step in this guide.

How serious is it today?

It's serious and worth acting on now, without panicking. The US Cybersecurity and Infrastructure Security Agency (CISA) urged immediate patching and, in its alert, said it had not observed successful exploitation of these flaws as of publication. That's not a reason to wait: it's the window to update calmly.

Your web host is probably already working on this, too. WordPress.org notes that many hosts are updating PHP and adding firewall rules to block attacks in the meantime. Your job is to confirm it.

What are the 3 steps to check your website today?

1. Check which PHP version your site uses. If you have WordPress, go to your dashboard and open Tools > Site Health > Info > Server. The PHP version is listed there. It's the same path WordPress.org points to. Many hosts also show it in their admin panel.
2. Ask your web host to confirm it has applied PHP’s October 21 security update, whatever version you’re on. Look at the full number, not just "8.3": 8.3.36 is fixed; an earlier release in that same branch isn't. If you're on managed hosting, your host may have applied the fix even if the panel only shows a short number. That's why the safest move is to ask in writing.
3. If they don't answer, ask whoever built your website. The agency, freelancer or team member who manages the site should be able to tell you which server it's on, which PHP version it uses and who's responsible for updating it.

If it helps, you can send this to your host's support chat or email:

Hi. I'd like to confirm whether my site [your domain] is already protected against the PHP vulnerabilities known as PHP2Shell. Which exact PHP version does my site run today, and does it include the fix released on October 21, 2026? If it runs an unsupported version, what options do you offer to move to a supported one? Thanks.

If you have a VPS or your own server, the update is usually up to you or whoever manages that server.

What if my site runs an old PHP version?

According to php.net's supported versions page, branches 8.2, 8.3, 8.4 and 8.5 currently receive fixes. PHP 8.1 and older no longer receive updates from the PHP project. Even so, given how severe PHP2Shell is, the PHP security team published minimal source backports for 7.4, 8.0 and 8.1, meant for people who build PHP themselves, and some distributions and long-term support vendors offer their own fixes. Ask yours, but treat it as an emergency fix: the recommended path is moving to a supported version.

If your site runs an unsupported version, moving to a newer one is the recommended path, but do it in order, because it can break old plugins or themes:

• Make a full backup (files and database) before touching anything.
• Update WordPress, your theme and your plugins so they're compatible with the new version.
• Switch the PHP version, ideally on a staging copy first, if your host offers one.
• Check that what matters still works: forms, cart, checkout and payments.

One date to plan around: php.net lists security support for the 8.2 branch until December 31, 2026. If your site is on a patched 8.2, it's still worth planning the next upgrade.

If you can't update right away, WordPress.org relays advice from several national cyber security agencies: consider taking the site offline until it can be fixed. That's a decision to make with whoever manages your site. If you do, Google's John Mueller recommended on Bluesky (as reported by Search Engine Roundtable) serving an HTTP 503 response from outside PHP, for example from your CDN, instead of letting pages time out or return a 404 or 500. That way Google understands it's temporary.

What does PHP2Shell leave behind?

This alert will pass, like all of them do. What it leaves is a useful question for any business with a website: who is making sure your site stays up to date today?

In many small businesses, the honest answer is "nobody in particular." The site was built a while ago, it works, and no one checks which PHP version it runs, when the plugins were last updated or where the latest backup is. You don't notice until a flaw like this one shows up. We go deeper into this in The hidden cost of "we'll fix it later".

Having a maintained website doesn't mean constantly updating things. It means knowing who checks for updates, where the backup is and who to contact when an alert like this one comes out. Because a website needs maintenance, not just a launch.

If after checking you still aren't sure which version your site runs, or your host didn't give you a clear answer, get in touch and we'll look at it with you.