PHP2Shell Flaw: Update PHP on Your Website Now

The PHP project and CISA warned on Oct. 21, 2026 about two critical bugs, nicknamed the PHP2Shell flaw, that could let an attacker take over a web server without a password. Reports conflict on whether attackers are already using them.

This is a developing story. We will update this post as new information comes in. Last updated Oct. 21, 2026, 10:45 a.m. PT.

If your office has a website, especially a WordPress one, this one touches you. PHP is the software behind many websites. Your web host usually runs it, so the fix is often in their hands. If you have no website, you can mostly relax.

What the PHP2Shell flaw is

PHP is a programming language that many websites run on. WordPress is built on it. So are many contact forms, online stores and booking tools.

The two bugs are tracked as CVE-2026-109618 and CVE-2026-109619. The PHP project says both can allow “unauthenticated remote code execution.” In plain words, a stranger on the internet could make your web server run their commands. They would not need to log in.

The first bug involves how PHP handles running out of memory. The second involves leftover data that survives from one web request to the next. You don’t need to understand the details. The PHP team says the risk is highest on servers using Apache with mod_php. It reports a demonstrated exploit there, where one request can trigger the attack before any website code even runs.

The advisory says all PHP installations serving web requests are affected.

Who is affected and what is fixed

Here is what the PHP project and its GitHub advisory list:

Product	Affected	Fixed
PHP 8.5	Before 8.5.12	8.5.12
PHP 8.4	Before 8.4.27	8.4.27
PHP 8.3	Before 8.3.36	8.3.36
PHP 8.2	Before 8.2.35	8.2.35
PHP 8.1 and older	No longer supported	No regular update from the PHP project

The PHP team says it made minimal fixes for PHP 7.4, 8.0 and 8.1, but only for people who build PHP from source or have no vendor to turn to. Some Linux vendors also provide their own backported fixes. Your host would know.

The reports conflict on whether attackers are already using these flaws. CISA said it had not seen them exploited as of its Oct. 21 alert. Two security firms report otherwise. watchTowr says it is seeing active exploitation attempts against both bugs. Fastly says there is evidence of attacks from before the fix was public.

Fastly also notes that the attack code shown so far needs details about the exact PHP build on a server, so many sites may be hard to break into with it. That could change quickly. Treat this as urgent and update now, and we will update this post as the picture firms up.

Who can relax, and who shouldn’t

You can probably relax if you have no website, or your site is run entirely by someone else and you never touch the server. Your Windows laptop is not a web server, so this isn’t a “patch every PC” situation.

Pay attention if any of these sound like you:

• Your business website runs on WordPress or another PHP tool.
• You pay a hosting company to run your site.
• Someone built a website for you years ago and nobody has looked at it since.
• You have an old web-based tool, like a booking page or login portal, running on a server in the back room.

That last group worries us most. Old sites on old PHP versions are the ones nobody remembers to update.

Find out which PHP version you run

You don’t need to be technical for this. There are two easy ways.

In WordPress: log in to your dashboard. Go to Tools, then Site Health, then the Info tab, then Server. It lists your PHP version.

With your host: look in your hosting control panel for a “PHP version” setting. Or email support and ask, “Are we on PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer?”

Remember that PHP is often hidden inside other software. CISA makes the same point in its alert. It tells organizations to take stock of every system running PHP, because it may not be obvious.

If you are stuck on an old version

PHP 8.1 and older no longer get updates from the PHP project. CISA says organizations that can’t update right away, or that still use PHP 8.1 or earlier, should take PHP-based systems offline until they are patched or upgraded. It also says a web application firewall, a filter that sits in front of a website, may give some protection in the meantime.

For a small office, taking the site down is a real cost. Still, a brochure site that is offline for a day is better than a hijacked one. Ask your host or web developer for a plan, and ask today.

The PHP team also lists stopgap settings for hosts who cannot update right now. It says plainly that these reduce exposure but do not make a server safe. Only the update does that. Leave those settings to your host or developer.

We covered the basics of keeping a small office tidy in our office security checklist. A list of what you run is step one there too.

What to do this week

• Find your PHP version using the WordPress Site Health page or your hosting control panel.
• If you are on PHP 8.2, 8.3, 8.4 or 8.5, make sure you are on 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or newer. Ask your host to update if you can’t.
• If you are on PHP 8.1 or older, ask your host or developer for an upgrade plan right away. CISA says to take those systems offline until they are upgraded.
• Make a list of every website, web portal or web-based tool your office uses, and who runs each one.
• Check that you have a recent backup of your website before any update, and watch for odd behavior afterward.

Not sure what your website runs on, or who is looking after it? We’re happy to take a look. Our free 30-minute assessment is no cost and no contract. You can also read about how we help with security.

Sources

• PHP security advisory and release notes (PHP project, php.net)
• Critical Vulnerabilities in PHP Require Immediate Patching (CISA)
• GHSA-w8hw-w9fx-j79w: RCE via OOM corruption (php-src on GitHub)
• GHSA-6wmf-4rv5-p3rp: RCE via stale global state (php-src on GitHub)
• PHP Remote Code Execution (“PHP2Shell”) (watchTowr)
• Fastly’s proactive protection for critical PHP RCE (Fastly)

This article was drafted by Percival, Rainier IT’s AI writing assistant, from the sources linked above, and reviewed by Christopher Engelhardt before publication. Spot an error? Email [email protected].