TL;DR
- PHP2Shell is two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) that let attackers take over a web server with one request and no password.
- Any site running PHP 5.4 or later is affected, which includes most WordPress sites.
- Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. On PHP 8.1 or older, upgrade to 8.2+.
- Check your version in WordPress under Tools → Site Health → Info → Server.
- If you can’t update yet, set session.upload_progress.enabled = Off and turn on your firewall. That’s a stopgap, not a fix.
If your website runs on PHP, and that includes most WordPress sites, you need to act on PHP2Shell. These two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) affect PHP 5.4 and later, which means nearly every PHP site online. They can let an attacker take over a web server with a single request and no password.
Public exploit code is already circulating, according to the Dutch National Cyber Security Centre, so the time to patch is now, not next week. The good news: fixes are out, and protecting your site takes about 15 minutes.
No panic, no jargon. Just the steps.
What You’ll Need
- Access to your WordPress dashboard
- Access to your hosting account (the control panel where you manage your site)
Step 1: Check Your PHP Version
In WordPress:
- Go to Tools → Site Health.
- Click the Info tab.
- Open the Server section and look for PHP version.
Write the number down. You’ll need it in a second.
Using cPanel or shared hosting? You can also see it under MultiPHP Manager or Select PHP Version in your control panel.
Step 2: Compare It to the Safe Versions
These are the patched versions released on October 21, 2026:
| If your version starts with… | You need at least… |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
| 8.1, 8.0, 7.x or older | Upgrade to 8.2 or newer |
If your version is equal to or higher than the one in the table, you’re patched. Skip to Step 6.
Version number looks old? Some hosts and Linux distributions apply the fix to their own PHP builds without changing the version number to the one above. If your number is lower but your host says it’s patched, ask them to confirm in writing that the PHP2Shell fix has been applied.
On PHP 8.1 or older? Those versions no longer get official releases. Only source-code patches exist for 7.4, 8.0 and 8.1, and some hosts apply them for you. The safest move is still to upgrade.
Step 3: Back Up Your Site First
Before changing anything, take a full backup of your files and database.
- Most hosts have a one-click backup in the control panel.
- Or use a backup plugin like UpdraftPlus.
If anything breaks after the update, you can roll back in minutes.
Step 4: Update PHP in Your Hosting Panel
Most hosts let you change PHP versions yourself. Look for a menu called something like:
- Select PHP Version or MultiPHP Manager (cPanel hosts)
- PHP Configuration (hPanel and similar)
- PHP Settings or Runtime (other control panels)
Choose the newest version your host offers (8.2 or above) and save.
Tip: If you’re jumping several versions, for example from 7.4 to 8.3, update your plugins and theme first. Very old plugins may not work on newer PHP.
Step 5: Can’t Find the Setting? Ask Your Host
Many hosts patch PHP for you, but don’t assume. Send your host this message:
Hi, I’d like to confirm my site is protected against the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Could you tell me which PHP version my site is running and whether the October 21, 2026 security patch has been applied? If not, please update it or let me know how. Thanks!
If they can’t give a clear answer, that’s a good sign it’s time to consider a different host.
Step 6: Check That It Worked
Go back to Tools → Site Health → Info → Server and check the PHP version again. Then click through your site, including the homepage, a few posts and any contact forms, to make sure everything still works.
Step 7: Can’t Update Yet? Use Temporary Protection
If your host hasn’t patched yet, these settings lower the risk. They’re a stopgap, not a fix, so keep pushing to update PHP.
- Turn off upload progress tracking. In your hosting panel, find PHP Options, MultiPHP INI Editor or php.ini, and set
session.upload_progress.enabled = Off. This blocks one known way attackers trigger the bug. - On PHP 8.5, also set
fatal_error_backtraces = Off. This blocks the second known trigger. - Save and restart PHP (or ask your host to), so the change takes effect.
- Don’t rely on maintenance mode. WordPress’s maintenance or “coming soon” mode doesn’t stop this attack, because the bug triggers before WordPress even loads.
Step 8: Add a Firewall Layer
If your site uses Cloudflare, it has rolled out firewall rules that block known PHP2Shell attack patterns, and they’re available to all customers. In your Cloudflare dashboard, check that managed WAF rules are switched on. AWS has published similar rules for AWS WAF users.
A firewall is a safety net, not a fix. It can’t see everything that reaches PHP, so you still need to update.
Firewalls are also how many sites now control bots. Here’s why websites are blocking AI agents.
Step 9: Check for Signs of Trouble
Attack attempts were spotted before the fix was public, so it’s worth a quick look around:
- Users: go to Users in WordPress and check for admin accounts you don’t recognise.
- Plugins: look for plugins you didn’t install.
- Scan: run a free scan with a security plugin such as Wordfence or Sucuri.
- Hosting logs: ask your host whether they’ve seen unusual activity on your account.
If anything looks wrong, change all your passwords (WordPress, hosting, database, FTP) and contact your host straight away.
Step 10: Tidy Up While You’re Here
- Update WordPress, your theme and all plugins.
- Delete plugins and themes you don’t use. Unused code is still attack surface.
- Turn on automatic updates for minor WordPress releases and trusted plugins.
- Want fewer apps holding your data? Try these open-source alternatives to Big Tech.
Managing Your Own Server?
If you run a VPS, dedicated server or containers:
- Install the patched PHP packages from your Linux distribution or PHP vendor. Distributions received patches before the public release.
- Restart PHP-FPM, Apache, Nginx or LiteSpeed so the new version is actually in use. Updating without restarting leaves the old code running.
- Confirm with
php -v, and check the version your web server uses too, which can differ from the command line. - Setups using Apache with mod_php face the greatest risk, so prioritise those.
- Using Docker? Rebuild your images from an updated official
php:base image and redeploy. Restarting old containers doesn’t update PHP. - Don’t rely on dependency checkers alone. PHP itself isn’t listed in
composer.json, so tools that scan your project’s dependencies can miss it. Check the PHP version on the actual running server or container. - Checking with
phpinfo()? Delete that file as soon as you’ve read it. Left online, it shows attackers exactly what your server is running.
If you can’t patch quickly, the NSA’s advice is blunt: take vulnerable systems offline until you can.
Running bigger systems at work? Patching is one reason enterprise AI projects stall when security teams can’t keep up.
How to Stay Protected Next Time
PHP2Shell won’t be the last big bug, especially now that AI tools are finding security holes faster than ever. A few habits make a huge difference:
- Stay on a supported PHP version. Check once a quarter.
- Choose a host that patches quickly and tells you when it has.
- Keep automatic backups running daily.
- Use a firewall such as Cloudflare or a security plugin.
- Don’t ignore update notices. They exist for days like this.
Related Buzz: We also covered 10 Open-Source Alternatives to Big Tech That Respect Your Privacy