PHP2Shell: Is your site affected?
PHP2Shell is the name given to two critical vulnerabilities in PHP itself, the software that powers WordPress, WooCommerce, Joomla and Drupal. If the PHP version on the server has not been updated, a remote attacker can exploit the vulnerability without a password or an account. Check the version with your hosting provider or the company that maintains your site; updating only WordPress or its plugins is not enough.
Владислав БарковManaging Director
On 21 October 2026, PHP released emergency fixes for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. PHP Foundation and Tenable refer to them collectively as PHP2Shell. According to the CVSS v4.0 assessment, both have a severity rating of 9.2 out of 10. For a business owner, this means one practical thing: PHP on the server needs to be checked, not just the site's admin panel.
What is PHP2Shell in simple terms?
PHP is the programming environment that runs much of the code behind a website. WordPress, WooCommerce, Joomla and Drupal are systems built on PHP. When a visitor opens a page, submits a form or places an order, the server uses PHP to process the request and return a result.
PHP2Shell is a weakness in this environment itself. According to PHP, as cited by Tenable, both vulnerabilities can be exploited remotely without the attacker having a password or user account. If the attack succeeds, the attacker can execute their own code on the server. This is no longer just a problem with one page or one plugin, but with the foundation the site runs on.
According to Help Net Security, PHP installations that handle web requests are affected. This includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The owner does not need to know which of these technologies the server uses. They need to obtain the exact PHP version and check whether it has been patched.
Why does this affect WordPress, WooCommerce, Joomla and Drupal?
These platforms are not PHP itself, but they run on it. A WordPress site may have the latest core version and all its plugins, while its server is still using an old PHP version. In that case, updating the site does not solve the problem in the runtime environment.
The same applies to WooCommerce. The store may accept orders, send notifications and work normally for customers while PHP on the server remains vulnerable. A site working visibly is not proof that its foundation has been updated.
Joomla and Drupal also depend on the PHP version they are installed on. This does not mean that every site using these systems has been attacked. It means that every such site needs to be checked at server level.
Which PHP versions have been patched?
According to the fixes published by PHP, the affected branches have the following versions that close PHP2Shell:
| PHP branch | Patched version |
|---|---|
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |
If the server is running an older version in the relevant branch, it has not received the fix. According to PHP, fixes exist in the source code for PHP 7.4, 8.0 and 8.1, but no official release has been published. PHP has no fix for PHP 5.4 through 7.3.
That is why saying "the site is on PHP 8" is not enough. The exact minor version must be known, for example, whether it is 8.4.27 rather than simply 8.4. According to Tenable and the Calif study, the oldest affected code dates back to PHP 5.4, which means the weakness went unnoticed for more than ten years.
How to check whether your site is affected
- 01Find out who is responsible for the server
Check your contract or correspondence with your hosting provider, web agency or maintenance company. For some sites, one company built the site while another manages the server. It is important that the question reaches the person who can view and change PHP.
- 02Ask for the exact PHP version
Send a short question: "Which exact PHP version is running on our site's server, and has the fix for PHP2Shell been installed?" Do not accept an answer such as only "the server has been updated" or "WordPress is up to date."
- 03Compare the version with the officially fixed versions
If the version is older than 8.2.35, 8.3.36, 8.4.27 or 8.5.12 in the relevant branch, the site is exposed. According to the testing guidelines, PHP 8.1 and older versions should also be treated as exposed.
- 04Ask for a plan if the update cannot happen immediately
Sometimes an old site depends on an outdated plugin or code that does not work with a newer version of PHP. In that case, ask for a specific plan: a backup, a staging environment, compatibility testing and a deadline for the update. It is not enough to leave the issue without a date and an owner.
If you use Cloudflare, Help Net Security reports that firewall rules have been published for known attack methods, including for free accounts. This may reduce the risk from known attacks, but it does not replace updating PHP. For a system that cannot be updated immediately, NCSC recommends considering temporary shutdown.
What did we do for the sites we host and maintain?
On 21 October 2026, the day the fix was published, we updated PHP on all client PHP sites that we host and maintain. They run on PHP 8.4.27, the fixed version for this branch. On 22 October, we checked the servers again and there were no pending PHP updates.
The check covered the WordPress sites and online stores hosted on our servers. This also includes stores using WooCommerce. After the update we checked that all of these sites respond normally.
The sites, online stores and systems we build with Next.js, Node.js and .NET do not use PHP. For this specific reason, they are not affected by PHP2Shell. This does not mean that every system is protected against every future vulnerability. It only means that this PHP vulnerability does not apply to them.
For sites that we do not host or maintain, we cannot assume the PHP version. It must be checked in the actual hosting environment. If the site was built by another company but has been left without ongoing maintenance, we can start with a review and clarify what needs to be fixed. This is part of our takeover and maintenance of an existing site service.
What does “fixed” mean, and what does it not mean?
Fixed means that the specific PHP2Shell vulnerability has been closed by using a supported version or applying a fix. This is an important but limited finding.
It does not mean that the site is protected forever. Other potential problems may remain: outdated plugins, weak passwords, incorrect access permissions, vulnerabilities in the site itself, missing backups or issues with another service on the server. That is why updating PHP should be part of ongoing maintenance, not a one-time reason to stop checking.
If you have your own server or hosting managed by your team, ask who monitors urgent updates and how backup restoration is tested. If you work with an external company, ask for the same information in writing. This way, you will not have to rely on a vague assurance that “everything is fine”.
What should you do if no one gives you a clear answer?
Gather the site address, hosting details and the name of the company maintaining it. Ask which exact PHP version is in use and request confirmation after the update. If the site is old, also ask for a compatibility check before making the change.
If your site runs on PHP and you are not sure whether it has been updated, contact us. We will check the PHP version and update the server when we have access and the change is technically possible. For ongoing monitoring, backups and updates, see site maintenance, and for a managed server environment, see website hosting. You can send us your question through our contact page.
Frequently asked questions
- Does PHP2Shell affect every WordPress site?
- It affects WordPress sites running on a vulnerable version of PHP. Using WordPress alone does not prove that the issue exists, but having an up-to-date core and plugins is not enough. The PHP version on the server must also be checked.
- How can I find out which PHP version my site uses?
- Ask your hosting provider or the company maintaining the site for the exact PHP version on the server. Also ask for confirmation that a fix for PHP2Shell has been installed.
- Is updating WordPress and the plugins enough?
- No. PHP2Shell is a vulnerability in PHP itself, so the server environment must be updated to a fixed version. Updating WordPress, WooCommerce or the plugins is a separate task.
- What should I do if my site uses an old version of PHP?
- Ask for a compatibility check, a backup and an update plan. If the update cannot happen immediately, ask about temporary protective measures and whether the system should be temporarily taken offline.
