Security
PHP2Shell: the PHP flaws threatening your website (and what to do)
Your website, online store or client portal most likely runs on PHP. WordPress, WooCommerce and most CMSs are built on this language. On October 21, 2026, the PHP team released emergency fixes for two critical flaws, nicknamed PHP2Shell, which under certain conditions allow an attacker to take control of a web server without any password. Here is what you need to know, in plain language, and what you should check right now.
PHP2Shell at a glance
- Identifiers: CVE-2026-109618 and CVE-2026-109619
- Severity: CVSS v4.0 score of 9.2 out of 10 for each (Qualys)
- Impact: remote code execution, without authentication
- Who is affected: any PHP installation that serves web pages — PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, LiteSpeed (Datadog Security Labs)
- Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35
Why are these flaws so serious?
Most web vulnerabilities target a specific plugin, theme or form. PHP2Shell is different: it lies in PHP itself, before your site even runs. According to Datadog Security Labs, “PHP processes the malicious request before any application code runs.” In other words, a strong password, a WordPress security plugin or a well-coded site are not enough to block the attack.
In simple terms:
- CVE-2026-109618 — when a request exhausts the memory allocated to PHP, PHP can abandon a half-finished operation, then “clean up” by treating invalid data as if it were valid.
- CVE-2026-109619 — a PHP process can keep information from a previous request that points to memory that has already been freed. A later request sent to the same process can then reuse this stale data.
In both cases, a skilled attacker can turn this memory mix-up into running their own commands on the server: theft of customer data, installing a backdoor, sending spam or ransomware.
Are attacks already happening?
The technical details leaked on October 20, before the planned disclosure date. Several sources report malicious activity:
- Amazon Threat Intelligence observed an exploitation attempt as early as October 17, 2026, four days before the fixes were released (Help Net Security).
- Cloudflare reported attack traffic targeting these flaws (Qualys).
- Datadog says it is aware of broad, untargeted scanning of the Internet.
Attackers don’t need to target you personally: bots scan the Internet looking for any unpatched server. The size of your business does not protect you.
The real problem: end-of-life PHP versions
PHP2Shell highlights a broader risk. Each PHP branch receives security fixes for a limited time. According to php.net, as of October 2026:
| Version | Security fixes until | Status |
|---|---|---|
| PHP 8.5 | December 31, 2029 | ✅ Supported |
| PHP 8.4 | December 31, 2028 | ✅ Supported |
| PHP 8.3 | December 31, 2027 | ✅ Security fixes only |
| PHP 8.2 | December 31, 2026 | ⚠️ Ends in a few weeks |
| PHP 8.1 | December 31, 2025 | ❌ End of life |
| PHP 8.0 | November 26, 2023 | ❌ End of life |
| PHP 7.4 | November 28, 2022 | ❌ End of life |
For PHP2Shell, the PHP team exceptionally released source-code fixes for versions 7.4, 8.0 and 8.1 (Help Net Security). But these versions no longer receive regular updates: the next flaw may never be fixed. WordPress itself recommends PHP 8.3 or newer and states that older versions “may expose your site to security vulnerabilities.”
PHP2Shell is not an isolated case: the PHP changelog lists about ten vulnerabilities fixed in version 8.5.11 alone, released in September 2026 (FPM, OpenSSL, SOAP, Phar…). A server that is not updated regularly piles up these flaws.
What to do now: 5 concrete steps
1. Find out your PHP version
In WordPress, go to Tools → Site Health → Info → Server. You can also find it in your host’s control panel (cPanel, Plesk, etc.).
2. Require your host to update
If you are on shared or managed hosting, updating PHP is usually your provider’s responsibility. Ask them in writing whether they have applied versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or the equivalent fix from their Linux distribution), and on what date.
3. If you manage your own server: patch, then restart
Install the fixed version, rebuild your Docker images if applicable and restart all PHP processes. According to Datadog, “only patching fixes these vulnerabilities.” If you cannot patch immediately, temporary measures exist, including disabling session.upload_progress.enabled — but they do not replace the update. The UK’s NCSC even recommends considering taking offline any system that cannot be fixed quickly.
4. Add a layer of protection in front of your site
A web application firewall (WAF) can filter known attempts. Cloudflare has deployed rules for PHP2Shell, including for its free-plan customers — a partial protection that does not replace the fix. See our article DNS, WAF and Zero Trust: protecting your website and access.
5. Check for signs of intrusion
A successful attack does not necessarily crash the site. Watch for: unknown PHP files on your site, new administrator accounts, unusual “Allowed memory size exhausted” errors in the logs, or a web server running system commands. If in doubt, call a professional before simply “cleaning up.”
How ServiTIQ protects its clients’ sites
On October 22, 2026, within hours of the fixes being released, ServiTIQ updated all the PHP environments it hosts to PHP 8.3.36 and applied the recommended hardening measures. That is what managed hosting gives you: you don’t have to track security alerts yourself.
- Security monitoring of PHP, WordPress and your plugins
- Scheduled updates with a rollback image in case of problems
- Guided migration of sites still on PHP 7.x or 8.0/8.1 to a supported version
- Backups and a web application firewall in front of your sites
Not sure which PHP version your site runs on, or whether your host has applied the fix? Contact us : we will check your site and clearly explain the risks and your options.
FAQ
Is my WordPress site affected by PHP2Shell?
If your site runs a PHP version older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (without a fix from your distribution), you should assume it is. The flaw is in PHP, not in WordPress: updating WordPress is not enough.
Does a security plugin like Wordfence protect me?
Not against this type of flaw. A WordPress plugin runs inside PHP, whereas PHP2Shell is triggered before your site’s code runs. Only updating PHP fixes the problem; a WAF in front of the server can reduce the risk in the meantime.
My site runs on PHP 7.4 and works fine. Why change?
PHP 7.4 has not received official fixes since November 28, 2022. For PHP2Shell, a source fix was exceptionally released, but there is no guarantee the same will happen for future flaws. Moving to PHP 8.3 or 8.4 often requires adjustments to the theme or plugins: better to plan it than to be forced into it.
My host says they are handling it. How can I check?
Ask for the exact PHP version installed and the update date. In WordPress, the Site Health page shows the version your site uses. A reliable host should be able to give you a clear answer.
Sources: php.net – supported versions, php.net – unsupported branches, Datadog Security Labs, Help Net Security, Qualys, WordPress.org. Information current as of October 22, 2026; the situation may change.
