On 21 October 2026, PHP released fixes for two critical flaws, nicknamed PHP2Shell, that can let attackers take over a website. Whether your site needs action depends on how it's hosted and how old its software is.
PHP2Shell is the nickname for two critical security flaws in PHP, the software behind many websites, including every WordPress site. PHP released fixes on 21 October 2026.
For most websites, the fix is updating PHP on the server, not changing the website itself. On shared and managed hosting, your hosting provider controls PHP and applies the update; if you run your own server, your server administrator does. The fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
Government cyber security agencies are urging action. Australia's Australian Signals Directorate (ASD) has told organisations and individuals using PHP to follow PHP's official guidance and apply security patches. In the US, CISA advises updating immediately and taking systems offline if they can't be updated straight away or still run PHP 8.1 or older.
PHP 8.1 and older no longer receive updates from the PHP project, so there is no official release with the fix to update to. Sites on these versions likely need an upgrade, not just a server update. As of 21 October 2026, more than a third of WordPress sites that report to WordPress.org ran PHP 8.1 or older.
The quickest way to find out where you stand is to ask your hosting provider. Copy one of these messages into an email or support ticket and add your website's address.
Ask whether PHP has been updated
Use this one if you're not sure how old your site is.
Subject: PHP security update for CVE-2026-109618 and CVE-2026-109619
Hello,
On 21 October 2026, PHP released fixes for two critical security flaws, CVE-2026-109618 and CVE-2026-109619 (known as PHP2Shell).
My website is [your website address]. Could you please tell me:
1. Has the PHP on the server running my site been updated to a fixed version (8.2.35, 8.3.36, 8.4.27 or 8.5.12), or patched by your Linux vendor?
2. Which PHP version is my site currently running?
Thank you.
Use this one if your site is several years old, or you know it runs PHP 8.1 or older.
Subject: Which PHP version is my website on? (CVE-2026-109618 / CVE-2026-109619)
Hello,
After the PHP security fixes released on 21 October 2026 for CVE-2026-109618 and CVE-2026-109619 (known as PHP2Shell), I'd like to check on my website, [your website address].
Could you please tell me:
1. Which PHP version is my site running?
2. Does that version still receive security fixes, from the PHP project or from you, including for these two flaws?
3. If it doesn't, what would you recommend?
Thank you.
Check who you pay for hosting: their name is usually on your invoices or receipts, and their website will have a support page. If you're not sure, ask your website manager, who will know where your site is hosted.
Frequently asked questions
What is PHP2Shell?
PHP2Shell is the nickname for two critical security flaws in PHP, the software behind many websites, including every WordPress site. Their official names are CVE-2026-109618 and CVE-2026-109619.
They can let an attacker run their own code on a web server without logging in. PHP released fixes on 21 October 2026.
Every WordPress site runs on PHP, so it depends on which PHP version your server runs and whether your hosting provider has updated it. The flaws are in PHP itself, so updating WordPress or its plugins doesn't fix them.
PHP2Shell is also different from wp2shell, a separate WordPress flaw from July 2026.
What's the difference between my hosting provider and my website manager?
Your hosting provider is the company whose servers run your website. On shared and managed hosting, they control PHP and update it.
Your website manager is the person or agency who looks after your site's content, theme and plugins. For PHP2Shell, the fix is usually your hosting provider's job, or your server administrator's if you run your own server.
PHP 8.1 and older no longer get updates from the PHP project, so there's no fixed version on those branches to update to.
Older versions of WordPress and other website software often don't support newer PHP, so the site itself may need upgrading first. Some Linux distributions and long-term support vendors offer their own fixes for older PHP, so it's worth asking your hosting provider.
No. The scan loads your homepage and a couple of public pages your site already publishes, just as an ordinary visitor's browser would.
It never sends attack-like requests and never tries to log in.
How accurate is it?
It's an estimate based only on what your website publicly reveals, such as software versions and server details.
Many servers hide their PHP version, and some show an old version number even after a fix has been applied. That's why results say "appears" or "likely" rather than a definite answer: treat yours as a starting point for a conversation with your hosting provider.
We don't keep a history of scans or link them to you. We count only anonymous totals, such as how many scans had each result.
To read your homepage, we send the address to Firecrawl, a web scraping service, and keep the scan's results for a few hours so repeat scans are quick.