PHP2Shell: what small businesses should do this week

On October 21, 2026, the PHP project released emergency security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. If your business website runs on WordPress or anything else built with PHP, here is what it means and what to do. Most of it is one email to your host.

Everything below comes from the PHP project’s advisories, the CVE records, the UK NCSC, Cloudflare and other sources listed at the end. For a fixed versions table and a free check, see the PHP2Shell exposure check page.

What PHP2Shell is, in plain English

PHP is the language that runs behind WordPress, Joomla, Drupal, Magento and a great many other websites. PHP2Shell is a problem in PHP itself, not in a plugin or a theme, so keeping WordPress and plugins updated does not cover it. The server has to run a fixed PHP version.

The PHP security team rates both flaws critical, 9.2 on CVSS v4.0, in the CVE-2026-109618 and CVE-2026-109619 records. Neither requires the attacker to log in, and both can lead to remote code execution with the privileges of the web worker account. In everyday terms: on an unpatched server, someone could send crafted requests to your website and, in the worst case, run their own commands on the machine that hosts it.

Is my website affected?

According to the php.net security advisory, all PHP installations that serve web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The team considers the risk highest for mod_php, where a demonstrated exploit runs before any application code.

That covers businesses of every kind, from a dental office to an online shop. What matters is the software on the server, not the industry. The UK NCSC puts it the same way for organisations: find every system running PHP, internet-facing ones first, and update to the latest fixed version.

The good news: many managed hosts update PHP for their customers, and Linux distributions and LTS vendors received the patches ahead of publication. Your site may already be fixed; you just need someone to confirm the version. To look yourself, see how to check your PHP version in WordPress or cPanel.

Which PHP version is safe?

The fixed releases are:

• PHP 8.5.12 or later on the 8.5 branch
• PHP 8.4.27 or later on the 8.4 branch
• PHP 8.3.36 or later on the 8.3 branch
• PHP 8.2.35 or later on the 8.2 branch

PHP 8.1 and older no longer receive updates from the PHP project; php.net lists PHP 8.1 as end of life since December 31, 2025. Some distributions and LTS vendors provide backported fixes; otherwise, move to a supported version. Our note on PHP 8.1 end of life and upgrading PHP safely walks through it.

How to fix PHP2Shell

Both PHP advisories say that updating is the only complete mitigation; the temporary configuration measures they list do not fully protect a server. Cloudflare says it observed attack traffic targeting its customers after details leaked before the official release; it deployed firewall protections on all plans with its WAF, including Free, and still tells customers to patch PHP. Huntress said on October 21 that it had not yet seen exploitation across its partner base, while others were reporting attacks emerging.

So the fix for a business owner is not technical. It is a question to the person who runs your server:

• Which exact PHP version is my website running right now?
• Is it at or above 8.5.12, 8.4.27, 8.3.36 or 8.2.35?
• If we are on PHP 8.1 or older, do we have a vendor backport, and when do we move to a supported version?
• Was PHP restarted after the update, so the fixed version is the one serving pages?
• Do we run PHP anywhere else, such as a staging copy, an old subdomain or a control panel?
• Can you confirm by email, with the date of the update?

A good host can answer in minutes. If they confirm a fixed version, you are done with PHP2Shell. If the answer is vague, ask again for the exact version number.

Want a second pair of eyes?

Pixelmosa offers a free PHP2Shell exposure check within 24 hours. We look only at what your website shows publicly, such as the PHP version it reports, if it reports one. No login, no scanning for weaknesses, no exploit testing, and we do not change servers. Many sites hide their PHP version, which is good practice; then we say so. Request the free PHP2Shell exposure check.

Sources

• php.net security advisory, October 21, 2026
• PHP advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618) and GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
• CVE records: CVE-2026-109618, CVE-2026-109619; NIST NVD: CVE-2026-109618, CVE-2026-109619
• UK NCSC: Critical security issue affecting PHP and CERT-EU advisory 2026-018
• Cloudflare: protections against php2shell, Huntress rapid response, BleepingComputer
• php.net end of life branches