PHP2Shell: what a company running WordPress or a PHP shop should do now
Critical PHP flaws CVE-2026-109618 and CVE-2026-109619: how to tell if your website is affected, whose job the fix is, and what to ask your host or agency.
Islam Zoukhaiev··4 min read
If your company website or shop runs on PHP on its own hosting (WordPress, WooCommerce, Drupal, Joomla, Magento, PrestaShop, Laravel), check your PHP version today. Two flaws known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619) let an attacker run code on the server without logging in. Fixes have been available since 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are protected. On a hosted platform such as Shopify or Wix, the fix is the provider’s job.
You can check for free whether your website is affected. This guide covers what a non-technical owner should do, step by step.
What happened?
On 21 October 2026, PHP — the language behind roughly 70% of websites — shipped an emergency security release for two critical bugs in how it handles fatal errors, especially running out of memory. The researchers who found them (Calif, Wiz and others) demonstrated server takeover without login on current WordPress, Drupal, Joomla and Magento.
- Severity: critical, CVSS 9.2 for both.
- Affected: practically every PHP version from 5.4 onwards.
- Server setups: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed — any PHP serving web pages.
- Exploitation: details leaked before the planned disclosure; Cloudflare and watchTowr reported attack attempts.
- Memory leak: even without running code, the flaw can expose passwords, API keys and session tokens from server memory.
Is my website affected?
If your site runs on PHP and the version is older than the patched release, yes. Your WordPress or plugin versions don’t matter here: the bug is in PHP itself.
| Your situation | Affected? | Whose job is the fix? |
|---|---|---|
| WordPress / WooCommerce on shared hosting | Probably | Your host updates PHP, but you often choose the version |
| Your own VPS or server (any PHP app) | Yes, unless updated | Yours or your developer’s |
| Site run by an agency | Yes, unless updated | The agency’s — but ask |
| Shopify, Wix, Shoprenter, Unas | Their servers, yes, but… | …the provider patches them; nothing to do on PHP |
| Static site, Next.js, Astro (no PHP) | No | — |
How do I find my PHP version?
- Hosting control panel: in cPanel, usually under “Select PHP Version” or “MultiPHP Manager”; elsewhere, in the PHP settings.
- WordPress admin: Tools → Site Health → Info → Server.
- Command line:
php -von the server. Careful: that’s the command-line PHP, which can differ from the one serving your website.
Then enter it in our checker for an instant verdict.
One exception: if the server runs PHP from an Ubuntu, Debian or Red Hat package, the version number doesn’t change with the fix (for example 8.1.2-1ubuntu2.x). What matters then is whether the distribution’s security update is installed.
What if it’s vulnerable?
- Update. On supported branches (8.2–8.5), install your branch’s patched release. According to PHP, this is the only complete fix.
- Upgrade old PHP. PHP 8.1 and older get no official release. Move to 8.3 or 8.4 — with old plugins or custom code, that takes testing.
- Every instance. Staging sites, old subdomains, forgotten blogs and admin panels may run old PHP too.
- Follow-up. If the site was exposed before the patch, review the logs, check admin users and rotate passwords and API keys.
What should I ask my host or developer?
If you don’t run the server yourself, send this:
Subject: PHP2Shell (CVE-2026-109618, CVE-2026-109619) — patch status
Hello, could you confirm whether the server hosting [domain] has PHP’s security release of 21 October 2026 installed (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, or your distribution’s patched package)? Which PHP version does the site use in the web context? If it’s 8.1 or older, what is the upgrade plan? Please also let me know if you saw suspicious activity in the logs before the patch. Thank you.
No clear answer within a working day is a signal in itself.
Is Cloudflare or a security plugin enough?
No. Cloudflare deployed rules for the known attack patterns, even on the free plan, but they’re a stopgap that only counts if your server accepts traffic from Cloudflare alone. WordPress security plugins don’t help either: the bug triggers before WordPress even starts. For the same reason, maintenance mode doesn’t protect you. And don’t install “fix” plugins or snippets from unknown sources.
How IZ Labs helps
IZ Labs is a technology partner based in Budapest. We fix PHP2Shell at a fixed price agreed before we start: we inventory every PHP instance, update or upgrade to a supported version (testing your plugins), set up stopgap protection if the update can’t happen right away, review the logs, rotate keys, and hand you a written report. For partners — the monthly tech partnership starts at €3,000 per month — security updates are part of the fee.
Check your website for free or request a fix. We reply the same day.