What happened
On 21 October 2026, the PHP project released emergency updates for two critical security flaws: CVE-2026-109618 and CVE-2026-109619. Security researchers nicknamed them PHP2Shell.
PHP is the programming language that runs WordPress and a large share of the web. These flaws are in PHP itself, not in a plugin or theme. In plain terms: someone on the internet could send your server a specially made request and run their own code on it, without logging in. Both flaws are rated 9.2 out of 10 for severity.
The US Cybersecurity and Infrastructure Security Agency (CISA) and Canada's Cyber Centre both told organizations to patch immediately. The Cyber Centre says proof-of-concept attack code is already public. Neither agency had confirmed attacks when it published, but that can change quickly.
Severity score out of 10 for both PHP2Shell flaws. The PHP team says updating is the only safe fix.
Who is affected
Any website that runs PHP to serve its pages, unless PHP has been updated. That includes most WordPress and WooCommerce sites, plus Joomla, Drupal, Magento, Laravel and many custom-built sites. It doesn't matter how the server runs PHP: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are all listed. The PHP team rates Apache with mod_php as the highest risk.
| If your PHP is… | You're safe from version |
|---|---|
| 8.5.x | 8.5.12 |
| 8.4.x | 8.4.27 |
| 8.3.x | 8.3.36 |
| 8.2.x | 8.2.35 |
| 8.1 or older (7.x, 5.x) | No fix from the PHP project. Upgrade, or ask your host about a backported fix. |
Probably not affected: sites with no PHP at all, such as static sites (for example on Netlify), and sites on fully hosted builders like Shopify, Squarespace or Wix, where the platform runs the servers. If you have a separate store, booking system or client portal, check that too.
One thing that surprises people: keeping WordPress and your plugins updated does not fix this. The fix has to happen on the server, by updating PHP.
What to do this week
- Find out if your site runs PHP. Use the free check above, or ask whoever manages your site.
- Ask your host one question: "Has PHP on my server been updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor build that includes the fixes for CVE-2026-109618 and CVE-2026-109619?" Some hosts, such as SiteGround, say they've already patched. Others need you to act. Don't assume, ask.
- On PHP 8.1 or older? Treat it as urgent. Those versions get no fix from the PHP project. CISA advises taking unsupported PHP systems offline until they're patched or upgraded.
- Check for signs of a break-in. Look for admin users you don't recognize, files that changed when nobody was working on the site, or new redirects. If anything looks off, get help before you clean up, so evidence isn't lost.
A firewall such as Cloudflare helps block known attacks, and there are a few PHP settings that reduce risk, but the PHP team says they "do not make an installation safe." Updating PHP is the fix.
How GIT Technology can help
Our website security check looks from the inside, not just the outside:
- Confirm the exact PHP version and build your site runs, and whether it has the PHP2Shell fixes
- Apply the update, or deal with your host for you, with a backup first
- Look for signs someone got in before the patch: unknown users, changed files, injected code
- Tighten the basics while we're there: HTTPS, security headers, hiding version numbers, plugin hygiene
Plain-English results, no jargon. Book a website security check, or call 866-803-8324.
Frequently asked questions
What is PHP2Shell?
The nickname for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, fixed on 21 October 2026. They can let an attacker run code on a web server without logging in.
Does updating WordPress fix it?
No. The flaws are in PHP, the language WordPress runs on. PHP on your server has to be updated, which is usually your host's job or your web team's.
My host says they handle security. Am I covered?
Maybe. Some hosts patched quickly; others leave PHP updates to the customer, especially on VPS or dedicated servers. Ask them to confirm the PHP version in writing.
Your check says "can't tell". Is that bad?
Not necessarily. Many well-run servers hide their PHP version on purpose. It means the outside view can't confirm either way, so ask your host or book a full check.
Is the free check safe to run on my site?
Yes. It loads your homepage once, the same way any visitor's browser would. It doesn't try to break in, scan ports or visit other pages.
Sources
- PHP project security advisory, 21 October 2026 (php.net)
- CISA: Critical Vulnerabilities in PHP Require Immediate Patching
- Canadian Centre for Cyber Security alert AL26-026
- The Hacker News: PHP issues emergency patches for two critical PHP2Shell flaws
- SiteGround: Critical PHP vulnerabilities, SiteGround sites protected
Last updated 23 October 2026. We'll update this page if the advice changes.