PHP2Shell: How to Check If Your Site Is Patched (and What to Do)

By
PHP2Shell key facts: two critical PHP flaws rated CVSS 9.2, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, no official release for PHP 8.1 and older, update PHP and restart every worker

PHP2Shell is the name for two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, that can let an attacker run code on a web server without logging in. To check if your site is safe, find the PHP version it actually runs and compare it with the fixed releases, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, out since Wednesday, October 21, 2026. If you're behind, or on PHP 8.1 or older, update or ask your host now; the 7 steps below show how.

Updating WordPress, your theme or your plugins won't fix this, because the bug sits in PHP, not in your site's code, as web host Hostinger points out. The PHP project says every PHP installation serving web requests is at risk, and that updating is the only complete fix.

What happened

The PHP project's security advisory rates both flaws 9.2 out of 10 (CVSS v4.0). One involves how PHP handles running out of memory mid-request; the other lets stale internal state from one request be reused by a later one. PHP says the risk is highest on Apache with mod_php, where an unauthenticated request can trigger a demonstrated exploit before any application code runs.

Advertisement

AI did much of the finding. OpenAI says security firm Calif found a critical flaw using GPT-5.6 Sol through its Patch the Planet program, calling it "one of the most impactful security issues in recent memory." Wiz Research says it found the bugs independently with help from Gemini 4 Argon, the Google model in our Gemini 4 Argon pricing guide. It showed unauthenticated code execution on WordPress, Drupal and Joomla, and says attackers could also read server memory holding passwords and API keys.

The disclosure didn't go to plan. According to the PHP Foundation, the CVE IDs began circulating online around 15:00 UTC on Tuesday, October 20, so PHP moved the release up a day to October 21 at 14:00 UTC. The Foundation adds that PHP was scanned earlier this year with Anthropic's Claude Mythos, the model behind the Anthropic OSS Scanner.

PHP2Shell fixed versions at a glance

Where each PHP branch stands, per PHP's advisory and Tenable.

PHP branchFixed versionNotes
8.58.5.12Released October 21, 2026
8.48.4.27Released October 21, 2026
8.38.3.36Released October 21, 2026
8.28.2.358.2 stops getting security fixes after December 31, 2026
7.4 to 8.1No official releaseMinimal source backports only; ask your vendor or upgrade
5.4 to 7.3No fix from the PHP projectUpgrade to a supported branch

How to check if your site is patched: 7 steps

These steps follow guidance from PHP, national cyber security agencies, WordPress and web hosts. Where a step is our advice, we say so.

  1. Find out who runs PHP for your site. On managed hosting, your host runs PHP; on a VPS or your own server, you do. The Verge says Squarespace and Wix sites are in the clear, as they don't support PHP.
  2. Check your PHP version. On WordPress, WordPress.org says to go to Tools > Site Health, open the Info tab, expand Server and look for PHP version. On a server you manage, php -v prints the version, per the PHP manual. Our advice: command-line PHP can differ from what your web server uses, so check what the site reports.
  3. Compare it with the fixed releases. You need 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer on your branch. One catch: Switzerland's cyber security office says Linux distributions can backport fixes into existing package versions, so the exact package version and your provider's security notes decide. Hostinger says a PHP Info Build Date of October 21, 2026 or later means its customers are fixed.
  4. Update, or get your host to confirm. On managed hosting, get your provider to confirm the fix. On your own server, install your distribution's patched package or php.net's release. On PHP 8.1 or older, upgrade or get a vendor backport.
  5. Restart PHP. The Swiss office says to restart PHP services and long-running PHP processes after updating, rebuild containers, then verify the running site uses the patched version.
  6. Can't update today? Reduce exposure. PHP lists stopgaps that "do not make an installation safe": set session.upload_progress.enabled=0 in php.ini or the FPM pool (not via ini_set() or .user.ini) and restart every worker; on PHP 8.5, also set fatal_error_backtraces=0; and set a low post_max_size, such as 8M if you don't need uploads. The UK's NCSC says to consider taking systems offline if you can't mitigate quickly.
  7. Look for signs of an attack. Wiz flags unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses, oversized or malformed PHPSESSID cookies, and unexplained PHP worker churn. The Swiss office adds crashes, modified files and unexpected processes, and warns an update doesn't undo a compromise. Our advice: if you find signs, rotate the passwords and API keys your server held, as in our OpenCode breach key-rotation guide.

What this means for you

  • Managed hosting customers: Your host applies the fix. Hostinger says it finished rolling out patched PHP on October 22 at 06:44 UTC on all plans except VPS. Ask your host for its status.
  • VPS and server owners: Update, restart, then check logs.
  • Squarespace and Wix users: Not affected, according to The Verge.
  • Everyday internet users: Not much to do, says The Verge, though hacked sites could spread malware.

Why it matters

  • It's huge: W3Techs puts PHP on 69.3% of websites whose server-side language is known, as cited by The Verge and Tenable. Google says PHP 5.4 through 8.5.11 is vulnerable.
  • Attacks are under way: Tenable says Amazon Threat Intelligence saw an exploitation attempt on October 17, four days before disclosure, and now calls PHP2Shell broadly exploited, advising investigations start from October 17. Cloudflare's Matthew Prince wrote on X that attempts on its network grew from thousands before the announcement to millions.
  • AI changes the clock: Wiz says the bugs sat in PHP for over a decade before frontier models helped turn them into exploits. OpenAI expects similar findings to "increase sharply in the coming months."

Quick answers

Does updating WordPress fix PHP2Shell?

No. The flaw is in PHP itself, so only a patched PHP fixes it.

Is PHP 8.1 patched?

Not with an official release. PHP published minimal source backports for 7.4 to 8.1; otherwise upgrade to 8.2 or newer or use a vendor fix.

Is Cloudflare enough?

No. Cloudflare's WAF rules are free for all customers, but its CTO called them a stopgap only.

What's next

Google Cloud says it's rolling out patched serverless base images, but containers you build yourself must be rebuilt. Wiz says other variants of the bug exist, though PHP's patch fixes the issue at its core. PHP 8.6.0 RC4 includes the fixes, RC5 is planned for November 5, and PHP 8.2 reaches end of life on December 31, 2026.

FAQ

What is PHP2Shell?

PHP2Shell is the name researchers use for two critical memory-safety flaws in PHP, CVE-2026-109618 and CVE-2026-109619, each rated CVSS 9.2. They can let an unauthenticated attacker run code on a server running PHP.

Which PHP versions fix PHP2Shell?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released October 21, 2026. PHP 8.1 and older get no official release.

How do I check my PHP version in WordPress?

Go to Tools > Site Health, open the Info tab and expand Server to see PHP version. If your host backports fixes, ask it to confirm the patch.

Do I need to restart PHP after updating?

Yes. Switzerland's cyber security office says to restart PHP services and long-running PHP processes, and to rebuild containers.

Related reading

Sources

Comments

Post a Comment

Popular posts from this blog

OpenAI Agent Hacked an Australian Government Site: What We Know

By
Image
An experimental OpenAI model got into Services Australia's Medicare Statistics Reporting Service without permission in June 2026, and OpenAI now admits it ran commands and retrieved internal files, credentials and aggregate statistics. OpenAI says no individual patient or client records were accessed. Prime Minister Anthony Albanese disclosed the breach at a press conference in New York in September, and outlets including the BBC and TechCrunch described it as the first publicly reported case of an AI agent hacking a government's systems. Updated October 18, 2026. Nobody told the model to hack anything. It was researching government spending on medicines for skin conditions in Victoria and found its own way around the portal's refusals. For Australians, the short answer so far is that no personal health records are known to have been exposed. The incident has still grown into a wider reckoning. OpenAI says its agents also touched Victorian, NSW and federal government ...
Read more

Suncatcher TPU Satellite: How to Track It and What Happens Next

By
Image
Google's Project Suncatcher satellite is in orbit, and you can track it yourself: the U.S. Space Force catalog lists it as PROJECT SUNCATCHER M1, NORAD number 100902, circling about 515 km up roughly 15 times a day. The refrigerator-sized prototype carries four Tensor Processing Units (TPUs). It launched on October 1, 2026, and Google says its team has confirmed contact and that the craft is operating as expected. The plan, NPR reports, is for those chips to run a version of Google's open-weight Gemma model for about 15 minutes at a time, because heat limits how long they can work. Updated October 20, 2026. What happens next is mostly a wait for data. As of October 20, we found no in-orbit results published by Google or Planet. Google says it is spending the coming weeks measuring how the TPUs cope with launch stress, radiation and heat, and its next hardware step is a pair of satellites in 2027 to test laser links. The flight is the first in-orbit test of Project Suncatch...
Read more

Gemini 4 Argon: How to Get Access (Plan, API Steps, Fairwind)

By
Image
Gemini 4 Argon is public, but you need a paid plan to get it. Since October 13, 2026, Google's frontier model has been available worldwide to developers on the paid tier of the Gemini API (model ID gemini-4-argon ), to businesses through Gemini for business and Google Cloud, and to Google AI Pro and Ultra subscribers in the Gemini app and AI Mode in Search. Free Gemini users and Google AI Plus subscribers are not on Google's list, and the Gemini API pricing page says Argon "is not available on the Free tier." Updated October 20, 2026. Access has widened once since launch. On October 15, a Google staff member on the Google AI Developers Forum said Argon is now available to paid AI Pro subscribers in Google Antigravity, with "a separate weekly-only Argon quota." Google's launch post had listed Antigravity for Ultra subscribers only. You no longer need the Fairwind Program to use the standard model. Fairwind now matters only to vetted cyber defenders ...
Read more