PHP2Shell: Is Your Website Affected (and What to Do)
Two critical PHP vulnerabilities were patched on 21 October 2026. If your website runs WordPress or another PHP platform, ask your host whether it is on PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or newer. Wix, Squarespace, Shopify and Webflow sites do not give you PHP to patch. Sites on PHP 8.1 or older are on an end-of-life branch, so ask whether your host has backported the fix.
PHP runs a large share of the web, including WordPress, Drupal, Joomla and Magento. When a flaw lands in PHP itself, it sits underneath your site, your theme and your plugins. The incident is being called PHP2Shell. It moved fast: the details leaked before the patch was ready, and hosts were told to update or take sites offline.
This is not a breach of every PHP website. It is a critical vulnerability in PHP. Attackers are already probing for it, and some hosts have reported attack traffic. The patch closes the hole.
What happened?
On 20 October, details of two critical PHP vulnerabilities leaked on Hacker News before the coordinated release. The PHP project moved its emergency release forward and published fixes on 21 October, shortly before 14:00 UTC.
The two flaws are CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2, critical, and both can let an unauthenticated attacker run code on a vulnerable server. The flaw sits in PHP itself, so it affects the common ways PHP runs on a web server: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
Security researchers found the flaws with AI assistance and reported them through OpenAI's Patch the Planet programme. Calif and Wiz have published technical write-ups. The bugs had gone undetected for more than a decade.
Cloudflare reported attack traffic against its customers. CISA said it had not observed exploitation at the time of publication, while CERT-EU said proof-of-concept code is circulating and advised organisations to patch immediately or isolate affected systems.
Is your website affected?
The short answer: if your site runs PHP and your host has not patched it, yes. If your site is on a managed platform where you do not control the PHP version, the platform handles it.
| Where your site runs | Affected? | What to do |
|---|---|---|
| WordPress, WooCommerce, Drupal, Joomla or Magento on PHP | Yes, if the host has not patched PHP | Ask your host for the PHP version and the patch date |
| A custom PHP site or app | Yes | Patch to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or newer |
| Wix, Squarespace, Shopify or Webflow | No PHP for you to manage | Ask the platform to confirm, then no action |
| A static site on Netlify, Vercel or Cloudflare Pages | No PHP runtime | No action |
| You are not sure | Treat it as affected until you check | Ask your host the question below |
On a phone, swipe the table sideways to see the last column.
How to check your website in two minutes
If you use WordPress
Log in to your dashboard, open Tools > Site Health, click the Info tab and open Server. Look for the PHP version. If it is 8.1 or older, or older than the fixed version for your branch (8.2.35, 8.3.36, 8.4.27 or 8.5.12), ask your host when it will be patched.
If you use cPanel
Go to Software > MultiPHP Manager. Some hosts use Software > Select PHP Version instead. Either screen shows the PHP version for each domain. If the version is 8.1 or older, you are on a branch the PHP project no longer supports with normal releases.
If you cannot find it
Send your host this question: "Is my website on PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or newer? If not, when will it be patched? If yes, when was the patch applied?" A good host will answer with a version and a date. If they cannot, that is your answer.
What to do if your site is on an old version
- Get a patch date. Ask your host for the exact version and the date it will be applied. If they cannot give you one, move the site or take it offline until they can. That is the advice from CERT-EU and the NCSC.
- Check the branch. PHP 8.1 and older are end-of-life. The PHP project is not issuing normal releases for them, though it published minimal source patches and some hosts backport fixes. Ask yours to confirm in writing. If they cannot, upgrade the site or move it.
- Do not hide the version and call it fixed. Removing the PHP version from your headers does not remove the vulnerability.
- Do not install a random patch. Use the official PHP release or your host's package. WordPress itself does not need an update for this one. The PHP runtime does.
- If the host says the site was compromised, treat it as an incident. Change passwords, ask the host to check logs, and get a clean rebuild before you put the site back.
Signs to check for: new admin users, plugins you did not install, odd redirects or pop-ups, a sudden traffic or CPU spike, or a Google warning that the site may be hacked. If you see any of those, ask your host to check the logs before you rebuild.
Why a static site avoids this
The sites we build for tradies are static Astro files hosted on Netlify. There is no PHP runtime and no server-side code on the site itself. When a PHP vulnerability lands, there is nothing on the site for it to reach.
That is not the right answer for every business. If you run a booking system or a database-driven app, you need a runtime and you need to patch it. For a tradie website with services, suburbs, photos and a contact form, a static site does the job without the maintenance.
If your current site is on an old PHP version and your host cannot give you a patch date, we can rebuild it as a static site. The build and hosting are free, and the site stays yours. See the free website offer.
Frequently Asked Questions
Is my website affected by the PHP vulnerability?
If it runs WordPress, WooCommerce, Drupal, Joomla, Magento or custom PHP and the host has not patched PHP, yes. If it runs on Wix, Squarespace, Shopify or Webflow, you do not manage PHP. If it is a static site, there is no PHP runtime.
How do I check my PHP version in WordPress?
Open Tools > Site Health, click Info, then Server. Look for the PHP version. If it is 8.1 or older, or below the fixed release for your branch, ask your host when it will be patched.
Does Wix or Squarespace use PHP?
They are managed platforms. You do not install or patch PHP, and this vulnerability is not something you can fix on your site. Ask their support to confirm.
What if my host has not patched PHP?
Ask for a date. If they cannot give one, move the site to a host that can, or take it offline until they patch. PHP 8.1 and older will not get a normal upstream release.
Can I just hide my PHP version?
No. Hiding the version makes it slightly harder to fingerprint the site, but it does not remove the vulnerability. The fix is the patched PHP runtime.
Are static websites affected by the PHP vulnerability?
No. A static site has no PHP runtime, so this vulnerability does not apply. The trade-off is that static sites cannot run server-side features like booking systems without a separate service.
Sources
- PHP security release, 21 October 2026
- CERT-EU advisory 2026-018
- NCSC: critical security issue affecting PHP
- CISA alert, 21 October 2026
- Cloudflare: PHP vulnerability WAF protection
- Wiz: PHP2Shell technical write-up
- WordPress.org: critical PHP security release
- BBC: websites taken down worldwide
Last checked 22 October 2026. This guide reflects the advisories published on 21 October 2026.
Want a free website?
If your site is on an old PHP version and your host cannot give you a patch date, we can rebuild it as a static site. No PHP, no database on your site, nothing to patch. Free to build and host, and it stays yours.
See the free website offer