On 21 October 2026, the PHP project released emergency fixes for two critical security flaws, known as CVE-2026-109618 and CVE-2026-109619 and nicknamed "php2shell". They allow an attacker to run their own code on an unpatched web server without logging in. If your website runs on PHP — and most business websites do — it is worth checking today.
What is php2shell?
PHP is the programming language that powers a large part of the web. When someone visits your website, PHP runs on your server to build the page, process an order or send a contact form.
php2shell is the name given to two serious mistakes found inside PHP itself — not in your website, your theme or your plugins. Because the problem sits in PHP, a well-built website can still be at risk if the server underneath it has not been updated.
Both flaws are rated 9.2 on CVSS v4.0, the standard scale used to measure how serious a security problem is. In simple terms, that puts them in the "critical" group. The reason is easy to understand: an attacker does not need a password or an account. If the server is unpatched, they can make it run their own instructions — which could mean changing your pages, stealing data or using your server to attack others.
There is one more reason to act promptly. Details of the flaws leaked before the official fixes were released, and there were reports of attacks starting early. This is not a theoretical problem that may matter some day; it is one to deal with this week.
Is my website affected?
If your website is built on PHP and has not been updated since the fixes came out, assume it is affected until you have checked. PHP sits behind many of the most common website platforms, including:
- WordPress websites, including most company and blog sites
- WooCommerce online shops
- Laravel applications, such as custom portals and dashboards
- Most websites on shared hosting plans with a control panel such as cPanel or Plesk
The flaws affect PHP 5, PHP 7 and PHP 8. It also does not matter how your server runs PHP. PHP-FPM, Apache mod_php, php-cgi, LiteSpeed and FrankenPHP are all at risk. If you don't know which of these your hosting uses, that's fine — what matters is your PHP version.
Fixed versions
The PHP project has released fixed versions for the four PHP 8 lines it still supports. Find your version in the first column:
| Your version | Safe from | What to do |
|---|---|---|
| PHP 8.5 | 8.5.12 | Update to 8.5.12 or later |
| PHP 8.4 | 8.4.27 | Update to 8.4.27 or later |
| PHP 8.3 | 8.3.36 | Update to 8.3.36 or later |
| PHP 8.2 | 8.2.35 | Update to 8.2.35 or later |
| PHP 8.1 and older (including PHP 7 and 5) | No fix | Upgrade to a supported version (8.2 or newer) |
For PHP 8.2 to 8.5, the update stays within the same version line, so it is usually small and low-risk. For anything older, the situation is different.
Why PHP 8.1 and older need a full upgrade
The PHP project only fixes versions it still supports. PHP 8.1 and older will not receive a fix for php2shell. There is no small update to install. The only way to make these websites safe is to move to a supported version, PHP 8.2 or newer.
This is a bigger job than a normal update. Each new PHP version removes or changes some older features. Websites built years ago — and older plugins, themes or custom code — sometimes rely on those features. After an upgrade, you might see:
- a blank page or an error message instead of your website
- a plugin, payment option or contact form that stops working
- parts of an admin area or custom software that no longer load
None of this means you should avoid the upgrade. Staying on an unsupported version is the riskier choice. It simply means the upgrade should be planned: take a full backup first, update plugins and themes, and test the important parts of the website — ideally on a copy of the site before switching the live one.
How to check your PHP version
You only need one of these methods:
- cPanel: log in to your hosting control panel and open Select PHP Version (sometimes called "MultiPHP Manager"). Your current version is shown at the top.
- Plesk: open Websites & Domains, then look at the PHP settings for your domain. The version is listed there.
- SSH: if you or your developer have server access, run
php -v. The first line shows the version. - Our free checker: enter your website address in the PHP vulnerability checker and it will tell you what it can detect.
Write down the full version number, for example 8.3.36 rather than just 8.3. The last part is what tells you whether the fix is installed.
One important note: don't assume your hosting has already updated PHP for you. Automatic updates from hosting companies often do not apply this kind of fix, so it is always worth checking yourself.
What to do next
Here is a simple checklist to work through:
- Take a full backup of your website files and database, and keep a copy somewhere other than the server.
- Check your PHP version using one of the methods above.
- If you are on PHP 8.2, 8.3, 8.4 or 8.5, update to the fixed release in the table — or ask your hosting company to do it and confirm the new version number.
- If you are on PHP 8.1 or older, plan an upgrade to a supported version. Update plugins and themes first, then test the website after the switch.
- Test the key pages: home page, contact form, checkout and any login or admin area.
- Check again afterwards to confirm the version has really changed.
If your website is looked after by a developer or agency, send them this article and ask them to confirm which PHP version your site is running.
Need a hand?
If you are not comfortable changing server settings, or your website runs on an old PHP version and you are worried an upgrade will break something, tell us about your website. We will check your PHP version, take a backup and handle the update or upgrade carefully — and tell you honestly if anything on your site needs attention first.