PHP2Shell: What Business Site Owners Should Do Now

PHP2Shell is a pair of critical flaws in PHP, the language WordPress and many other website platforms run on, that let an attacker run their own code on a web server without signing in. The fix is a PHP update on the server, not a WordPress or plugin update, so confirm today that the PHP behind your site is patched.

PHP released the fixes on October 21, and the same day CISA urged organizations to patch immediately. Attackers are already trying. Amazon's threat intelligence team saw an exploit attempt on October 17, four days before the flaws were public, and says PHP2Shell is now being broadly exploited.

Is your website affected by PHP2Shell?

If it runs on PHP and the server hasn't been updated since October 21, assume it is. PHP's security advisory puts every common setup at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates mod_php the highest risk, because a single request can trigger the attack before the site's own code runs.

The flaws sit in PHP itself, so a carefully built site is as exposed as a neglected one. That covers WordPress and WooCommerce, Drupal, Laravel apps, and any other software built on PHP. These are the fixed versions:

• PHP 8.5: 8.5.12
• PHP 8.4: 8.4.27
• PHP 8.3: 8.3.36
• PHP 8.2: 8.2.35
• PHP 8.1 and older: no official release (see below)

Why doesn't updating WordPress fix PHP2Shell?

Because WordPress is software that runs on top of PHP, and PHP is installed on the server. Updating WordPress, a theme or a plugin changes your site's code. PHP itself comes with the server, so someone has to update it there.

Who that is depends on your hosting:

• Managed WordPress or shared hosting: the host updates PHP. Ask them to confirm in writing that your site's PHP has the PHP2Shell fixes.
• Your own server or VPS: whoever manages it installs the patched PHP package, then restarts PHP-FPM or Apache so the running workers pick up the fix.
• Containers: rebuild the image on a patched PHP base and redeploy it.

How do you check your PHP version?

In WordPress, go to Tools, then Site Health, then Info, and open the Server section. Most hosting dashboards show it too.

A version number alone can mislead. Linux distributions received the patches before the release, so a server can carry the fix under an older-looking number. Ask your host to confirm the fix by its CVE numbers, CVE-2026-109618 and CVE-2026-109619, rather than by version.

What if your site runs PHP 8.1 or older?

Then PHP2Shell won't be fixed by an ordinary update. PHP 8.1 and older no longer get releases from the PHP project. Its security team did publish source patches for 7.4, 8.0 and 8.1, and some Linux vendors backport fixes, but for most sites the answer is an upgrade. CISA's advice for unsupported versions is blunt: take those systems offline until they can be patched or upgraded.

Upgrading PHP can break old plugins and themes, so test the move on a staging copy first. This is routine development work, but it shouldn't wait. If you're on 8.2, plan the next upgrade now too: it stops getting security fixes on December 31, 2026.

Can a firewall protect your site until it's patched?

Only partly. CISA says a web application firewall may provide some protection until systems are updated. Cloudflare switched on firewall rules for its customers, and attackers changed their payloads to get around them, The Hacker News reported. PHP's advisory lists settings that reduce exposure, and says plainly that only an update is a complete fix. Treat a firewall as cover for hours, not a reason to wait.

How would you know if someone already got in?

PHP2Shell attacks can leave traces. Ask whoever manages the server to check the logs back to October 17, the earliest attempt Amazon reported, for these warning signs:

• PHP processes starting a shell or downloading tools, which CISA flags
• Bursts of HTTP 500 errors or memory-limit errors after unusual upload requests
• PHP workers restarting with no explanation

If any of these turn up, treat the server as compromised and restore from a clean backup after patching. The flaws can also expose passwords and API keys held in the server's memory, so change the ones the site uses.

Frequently asked questions

Does PHP2Shell affect WordPress sites?

Yes, if the server's PHP hasn't been updated. The flaws are in PHP, not in WordPress, so the site's own updates don't help.

Is my site safe if it's behind Cloudflare?

Safer, not safe. Cloudflare's rules block known attack patterns, and its CTO called them a stopgap and urged administrators to patch.

Will updating PHP break my site?

An update within the same branch, such as 8.3.30 to 8.3.36, is a security release and rarely breaks anything. Moving to a newer branch, such as 8.1 to 8.4, can break old plugins, so test that on staging first.

What if my host hasn't patched PHP2Shell yet?

Ask them for a date in hours, not days. If they can't give one, a web application firewall buys a little time while you plan a move to a host that patches promptly.

What to do today

Send your host or developer one message: confirm that your site's PHP includes the fixes for CVE-2026-109618 and CVE-2026-109619, that PHP was restarted after the update, and that the logs since October 17 have been checked. If nobody looks after your server, our IT services team handles updates like PHP2Shell, along with monitoring and backups.