Website security news

PHP2Shell: is your small business website affected, and what do you ask your host today?

You saw "PHP2Shell" in the news, in an email from your host, or in a worried post online. Here's what it means in plain English, how to tell if your site uses PHP, and the exact questions to send your host today.

Last updated October 23, 2026. Details may change, so check the PHP security advisory for the latest.

What is PHP2Shell? The short answer

PHP2Shell is the nickname for two critical flaws in PHP (CVE-2026-109618 and CVE-2026-109619), the software that runs many websites, including every WordPress site. They can let an attacker take control of the server without logging in. The fix is a PHP update on your server, which is your hosting company's or developer's job, so the most important step today is to ask them whether it has been applied.

(PHP is the engine behind a lot of what happens on a website: carts, blog posts, contact forms and logins.)

The PHP project announced the flaws and released fixes on October 21, 2026, in its security advisory, and asked all PHP users to update immediately. The same day the NSA issued an advisory recommending the critical patches. Europe's CERT-EU reports that technical details are being discussed publicly and early proof-of-concept attack code has begun to circulate.

Is my website affected?

Your site probably uses PHP if it runs on WordPress, WooCommerce, Drupal, Joomla, Magento (Adobe Commerce), PrestaShop or OpenCart, according to the US Chamber of Commerce. New Zealand's National Cyber Security Centre adds sites hosted by a provider that uses PHP, and web apps that depend on it. If a developer or your host built your site, ask them.

On an all-in-one website builder, ask your provider. We don't claim any specific platform is or isn't affected.

How to check your PHP version

WordPress: log in and go to Tools > Site Health > Info > Server.
Anything else: look in your host's control panel, or ask your developer.

Then compare it with the fixed versions: 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or newer in the same line). PHP 8.1 and older no longer get updates from the PHP project; they need an upgrade to a supported version or a fix backported by your host or Linux vendor.

One catch: some hosts install the fix without changing the version number you see. If yours looks old, ask your host to confirm before you panic.

Is your site showing its PHP version? Free check, 10 seconds

Our free check shows whether your site is publicly announcing its PHP version in its headers, something attackers look for. It does not test for PHP2Shell.

Why updating WordPress or plugins won't fix it

These are flaws in PHP itself, not in the website software running on top of it. The PHP project says a demonstrated exploit can trigger the attack before any of your site's own code runs (PHP advisory). The WordPress security team has said no WordPress update is needed or planned for this issue (US Chamber). Keep WordPress and plugins up to date anyway, but PHP has to be updated on the server.

What to ask your host today (checklist)

Copy these into an email to your host or developer, and get the answers in writing:

Ask which PHP version runs your site, and whether it includes the fixes for CVE-2026-109618 and CVE-2026-109619.
Ask when the fix was applied, and whether PHP and the web server were restarted afterward.
Ask whether every site is covered, including test or staging copies and old sites you no longer use.
If you're on PHP 8.1 or older, ask for the upgrade plan, and the timeline.
Ask whether they've checked for signs of attack, going back to October 17.
If the fix can't go on today, ask what protects you meanwhile, such as firewall rules or maintenance mode.
Ask what you need to do on your side, such as resetting passwords or rotating API keys.
Ask the same of vendors that run online tools for you, like booking systems, online stores or customer portals.

(Questions adapted from the US Chamber's guide and NZ NCSC's guidance.) While you're talking to them, ask about your email protection too: what DMARC is and why it matters.

If you can't get it patched today

CISA, the NSA and the FBI recommend taking vulnerable systems offline if they can't be updated right away (US Chamber). For a website, that can mean maintenance mode until the fix is in.
A web application firewall from your host can be a stopgap. It isn't a fix.

After the patch: passwords, keys and warning signs

One of the flaws can leak passwords and keys from server memory, so once the fix is in, reset your site admin and hosting passwords, ask your developer about rotating keys, and turn on two-step login (MFA).
Attack attempts may date back to October 17. Watch for admin accounts you don't recognize, unfamiliar files, odd scheduled tasks, crashes or slowness, and changes you didn't make.
If anything looks wrong, contact your host and a qualified incident-response or malware specialist, and report it (in the US, to CISA or the FBI's IC3). SiteSafeCheck doesn't do hack cleanup; that's specialist work.

Watch out for fake fixes and scam calls

Don't install "PHP2Shell fix" plugins or code snippets from forums. Security firm Patchstack has warned against these unofficial fixes, and some may contain malware (US Chamber). If someone calls or emails offering to fix it, contact your host through its official website or support line instead.

What our free check can and can't tell you

It can show whether your site's headers expose your PHP version (for example in X-Powered-By), and flag that version if it's older than the fixed releases. It also checks HTTPS, email spoofing protection and other basics. Why Chrome now asks before opening some sites.
It can't test whether your site is vulnerable to PHP2Shell or has been attacked, patch PHP, audit your code or remove malware.

Frequently asked questions

What is PHP2Shell?

The nickname for two critical flaws in PHP, CVE-2026-109618 and CVE-2026-109619, that PHP disclosed and fixed on October 21, 2026. They can let an attacker run their own code on a web server without logging in.

Does updating WordPress fix PHP2Shell?

No. The flaw is in PHP on the server, not in WordPress. The WordPress security team has said no WordPress update is needed or planned for it. PHP itself must be updated by your host or developer.

Which PHP versions are safe?

PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer. PHP 8.1 and older no longer get updates from the PHP project, so they need an upgrade to a supported version or a fix backported by your host or Linux vendor.

My PHP version looks old. Am I definitely vulnerable?

Not necessarily. Some hosts install the fix without changing the version number you see. Ask your host to confirm in writing.

Does visiting a PHP website put my computer at risk?

No. New Zealand's National Cyber Security Centre says people browsing the internet don't need to take action, and visiting a website that uses PHP doesn't put phones or home computers at risk.

Should I take my site offline?

If the fix can't go on right away, US officials (CISA, the NSA and the FBI) recommend taking affected systems offline until they're updated. Decide with your host; maintenance mode is one way to do it.

Can SiteSafeCheck tell me if I'm affected?

No. The free check only spots whether your site shows its PHP version in its headers. It doesn't test for PHP2Shell. Your host is the one who can confirm the patch.

I think my site was hacked. What now?

Contact your host and a qualified incident-response or malware specialist, and report it (in the US, to CISA or the FBI's IC3). SiteSafeCheck doesn't do hack cleanup.

Sources

PHP: Security advisory, critical remote code execution vulnerabilities (October 21, 2026)
NSA: Critical patches recommended for PHP vulnerabilities (October 21, 2026)
CERT-EU Security Advisory 2026-018
NZ NCSC: small business guidance (October 23, 2026)
US Chamber of Commerce CO—: a security flaw is affecting millions of websites