The name given to two critical flaws in PHP, CVE-2026-109618 and CVE-2026-109619, rated 9.2 out of 10. They let an attacker on the internet run their own code on a server that runs PHP, without logging in. PHP released fixes on 21 October 2026. Attacks were seen from 17 October, four days before the fix.

Is WordPress affected by PHP2Shell?

Yes, because WordPress runs on PHP. So do Drupal, Joomla, Magento, PrestaShop, Moodle, and custom applications built with Laravel, Symfony or CodeIgniter. The flaw is in PHP itself, so it does not matter which software sits on top. What matters is the PHP version on the server and whether it has been updated.

Which PHP versions are affected by PHP2Shell?

Every PHP version from 5.4 (2012) to 8.5. The fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older get no official fix: some Linux distributions and long-term support vendors provide patched packages, otherwise the only fix is to upgrade to PHP 8.2 or later.

How do I know if my website runs PHP?

If it is built on WordPress, Drupal, Joomla, Magento, PrestaShop or WooCommerce, it does. Other clues: page addresses ending in .php, a /wp-admin login, or a hosting control panel such as cPanel or Plesk with a PHP version setting. The surest way is to ask whoever hosts or maintains it for the exact PHP version, in writing.

What should a CEO do about PHP2Shell?

List every website and web tool the company owns, ask each provider for the exact PHP version and the date it was updated, and ask them to check the server logs back to 17 October. Anything on PHP 8.1 or older, or that cannot be updated this week, should be taken off the public internet or put behind a filter until it is fixed.

PHP2Shell: Is Your Business Exposed? A Plain-English Check

Four different small buildings, a shop, an office, a house and a warehouse, all standing on the same concrete slab with a glowing crack through it, a toolbox with a patch plate and a magnifying glass over a date mark

PHP2Shell is a pair of critical flaws in PHP, the language that runs WordPress and a large share of business websites, that let an attacker run their own code on your server without logging in. PHP released fixes on 21 October 2026 (versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12), after the details leaked a day early (PHP security advisory). Amazon saw the first attack attempt on 17 October, four days before the fix (AWS), and exploitation has been widespread since (watchTowr). The flaw is in PHP itself, not in WordPress, Laravel or Symfony, so any PHP version from 5.4 (2012) to 8.5 is affected, whatever runs on top of it. This post is for the person who has to decide, not the person who patches: how to tell whether you are exposed, and what to ask for.

The short version: the engine, not the car

Think of PHP as the engine and WordPress, Laravel, Symfony, Drupal or Magento as the car body. Brands differ, the bodywork differs, but thousands of models share the same engine. PHP2Shell is a defect in the engine. It does not matter how well your car was built or how recently the body was repainted: if it has this engine and the engine has not been serviced since 21 October, it is exposed.

That is why this one is wider than the usual "WordPress plugin vulnerability". In the worst configuration, the attack works before your own application code even runs, so a well-written application does not protect you.

Should you be worried? Three questions

Does anything we own run on PHP? Websites, shops, client portals, intranets, internal tools.
Can it be reached from the internet? A public website, yes. An internal tool reachable only on the office network or through a VPN, much less.
Has its PHP been updated since 21 October? If yes to 1 and 2 and you do not know the answer to 3, treat it as urgent.

How to tell if you run PHP, without a tech team

The software you bought or had built. WordPress, WooCommerce, Drupal, Joomla, Magento (Adobe Commerce), PrestaShop and Moodle all run on PHP. So do custom applications built with Laravel, Symfony, CodeIgniter, CakePHP or Yii: look for those names in the agency's quote, invoice or handover document.
The addresses. Page addresses ending in .php, or a login page at /wp-admin, mean PHP.
The hosting panel. If your host gives you cPanel, Plesk or a similar panel, look for a setting called "PHP version" or "MultiPHP". If it exists, you run PHP, and it shows which version.
The quick header check. Free online "HTTP header" checkers sometimes show a line like X-Powered-By: PHP/8.1.2. Many servers hide it, so not seeing it proves nothing.
Ask. The only answer that counts is the exact version, from whoever hosts or maintains the site.

Hosted platforms like Shopify, Squarespace or Salesforce are the vendor's job to patch. You only need to worry about what runs on a server that you, your host or your agency manage.

When was your tool built? A rough way to date your exposure

If nobody can tell you the version today, the date the tool was built gives you a first idea, because a tool that was never upgraded still runs the PHP of its birth year. This is an estimate, not a diagnosis: a maintained tool will be newer.

Built or last upgraded	Probable PHP version	Affected?	Is there a fix?
Before 2012	5.3 or older	Below the reported range (from 5.4)	Unsupported for over 10 years: replace or upgrade anyway
2012 to 2015	5.4 to 5.6	Yes	No fix. Upgrade to PHP 8.2 or later
2016 to 2019	7.0 to 7.3	Yes	No fix. Upgrade to PHP 8.2 or later
End of 2019 to 2022	7.4, 8.0 or 8.1	Yes	No official release. Patched packages from some Linux distributions or support vendors, otherwise upgrade
December 2022 onwards	8.2 to 8.5	Yes, until updated	Yes: 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later

PHP release dates for reference: 5.4 in March 2012, 7.0 in December 2015, 7.4 in November 2019, 8.0 in November 2020, 8.1 in November 2021, 8.2 in December 2022, 8.3 in November 2023, 8.4 in November 2024, 8.5 in November 2025.

The uncomfortable row is the fourth one. A lot of business software was built between 2019 and 2022 and has not been touched since. PHP 8.1 stopped receiving fixes at the end of 2025, so for those tools there is no simple "click update": someone has to upgrade them. We wrote about planning that upgrade (in French) before this flaw made it urgent.

What needs to happen

Update PHP to 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later, and restart PHP. An update that is installed but not restarted protects nothing.
On PHP 8.1 or older: get a patched package from your Linux distribution or a support vendor, or upgrade. PHP says no configuration change fully protects you.
If it cannot be done this week: take the site off the public internet, or restrict who can reach it. As a stopgap only, Cloudflare pushed filtering rules to all its customers, free plan included, and AWS published equivalent rules. Your provider can also turn off a PHP feature (session.upload_progress) that the attacks use. None of these replace the update.

Managed WordPress hosts have very likely patched already. Ask them to confirm in writing anyway.

How to know if you were hit

You will not see it on the website: the point of this attack is to stay quiet. Ask your host or developer to:

Search the web server logs back to 17 October, not 21, for requests containing PHP_SESSION_UPLOAD_PROGRESS. That is the marker AWS published.
Look for changes on the server: files modified since 17 October that nobody deployed, unknown processes, new admin accounts in the site's back office.
Watch the side effects: your host warning about abuse or unusual traffic, the site redirecting visitors elsewhere, emails sent from your domain that you did not send.

A clean result does not prove nothing happened. If a site was unpatched, public and accepting uploads between 17 October and its update, the cautious move is to change the passwords and API keys stored on that server: database, payment provider, email sending, cloud accounts.

A message you can send today

Hello, following the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), can you confirm for each of our sites and tools: 1) the exact PHP version in production, 2) the date it was updated to a fixed version (8.2.35, 8.3.36, 8.4.27, 8.5.12 or later) and whether PHP was restarted, 3) whether the logs since 17 October show requests containing PHP_SESSION_UPLOAD_PROGRESS. If a site runs PHP 8.1 or older, what do you propose and by when? Thank you.

Where we fit

Our own products run on Go and Python, so PHP2Shell does not touch them. For yours:

The code audit, $2,900 (€2,500) fixed: we list what runs where, which versions, what is exposed to the internet, and the order of work, upgrade path included.
The upgrade or takeover when a tool is stuck on an old PHP and nobody maintains it any more, from €800 a day, then maintenance from about $470 a month so the next flaw is a routine update.

What we are not: an incident response firm. If you find signs of an intrusion, call your host and a specialist incident responder first. We come in afterwards, to rebuild cleanly and keep it current.

PHP2Shell, Explained for CEOs: Is Your Website Exposed?

On 21 October 2026, PHP patched two critical flaws that attackers were already using. They sit in PHP itself, not in WordPress, Laravel or Symfony, so nearly every PHP website is concerned. Here is how to tell whether your company is exposed, without a tech team, and what to ask for.