Jump to a section
What is PHP, and what went wrong?
PHP is software that helps many websites run behind the scenes. WordPress uses it to turn stored content and website instructions into the pages a visitor sees. Your hosting provider runs that software on the computer that serves your website.
PHP2Shell is the name used for two serious flaws in PHP. Under affected conditions, an attacker could make that computer run their own instructions, without a website login. The technical term is “remote code execution.” The PHP Foundation’s explanation (opens in a new tab) describes the underlying problems.
WordPress and PHP have separate updates. A message saying your plugins are up to date does not confirm that PHP has been fixed. Think of a shop: updating the display does not tell you whether the building’s locks have been repaired. Your host or website administrator needs to confirm the PHP update too.
What could that mean for your business?
If an attacker successfully runs code, the effect depends on what the website’s software is allowed to access. Possible consequences include:
- Changed pages. Customers could see altered content or unwanted material instead of the information you published.
- Misled visitors. An attacker could change links or send visitors to a different destination.
- Exposed information. Data the compromised website can access could be at risk. The extent depends on its permissions and setup.
These examples explain why the flaw matters; they are not evidence that your site has been attacked. The PHP security advisory (opens in a new tab) says the risk differs between setups. A working homepage or a normal-looking dashboard does not confirm that the underlying fix is in place.
Four sensible steps for website owners
- Find the right person. Ask who manages the hosting and PHP updates. The person editing your website’s pages may have a different role.
- Get the fix confirmed. Ask whether the PHP2Shell fixes are installed and running. Include other websites, test sites and subdomains on the same account, and ask about the separate October 23 notice.
- Check the things customers use. Coordinate with your provider to verify backups and test contact forms, bookings, login and checkout after the update.
- Write down who owns the next update. Keep the provider’s confirmation and a clear contact for ongoing maintenance or suspicious activity.
Keep WordPress, themes and plugins updated as well. You do not need to copy unfamiliar server settings into your site or decide on a rebuild to get the immediate PHP issue addressed.
A message you can send your host
You can copy these five questions into an email to your hosting or website provider. Ask for a clear reply you can keep with your website records.
- Does our website use PHP, and who is responsible for keeping it updated?
- Are the PHP2Shell security fixes installed and running on all our sites, including any test sites or subdomains?
- Have you also checked the separate October 23 PHP security notice, and do we need any additional action?
- Can you confirm our backups and check that our forms, booking tools and checkout still work after the update?
- Who should we contact about future security updates or anything suspicious on the website?
Which PHP versions fix the October 21 vulnerabilities?
| PHP branch | First fixed release |
|---|---|
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |
Vendor backports may use a different package/version label. Ask for confirmation.
The PHP team released these first fixed versions for the two PHP2Shell CVEs on October 21, 2026. Your host may supply a later release or a vendor-supported backport.
A backport can retain an older version banner. Ask for the installed package/build and its vendor advisory, rather than deciding from the banner alone. For an older unsupported PHP branch, discuss a supported upgrade or verified vendor-supported fix with your host.
For your administrator: the October 21 PHP2Shell identifiers are CVE-2026-109618 and CVE-2026-109619. The official advisory (opens in a new tab) covers web-serving PHP, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Conditions differ; PHP-FPM is not a blanket exemption. Verify the fixed package is serving web requests and that the relevant workers restarted, rather than checking only command-line PHP.
Separate advisory October 23, 2026
Separate update: the October 23 upload-progress notice
CVE-2026-115560 is separate from the two PHP2Shell CVEs above. It applies under an unusual combination of website settings and behavior. Ask your host to check it separately, even after confirming the October 21 fixes.
For your administrator: the conditions include upload progress remaining enabled and an application starting with php_binary or php_serialize serialization, then changing the handler to php before session_start.
The PHP notice (opens in a new tab) recommends disabling session.upload_progress.enabled while the next regular bugfix release is prepared. A full advisory is forthcoming with that release. Ask your host to assess the conditions and appropriate mitigation. The October 21 patches should not be represented as fixing this additional issue.
WordPress or custom code: decide after the patch
Choose a website that fits how your business works and has a clear plan for its care. SDM can help evaluate that choice, including custom development where it makes sense. PHP2Shell does not mean every WordPress site has been breached or that a custom website is automatically safe.
Custom PHP still runs on PHP. It can share these runtime risks. A deployment with no PHP runtime avoids these specific PHP execution paths, while keeping its own obligations around dependencies, access, hosting and recovery.
Patch the current environment first. Then compare editing needs, integrations, performance, ownership and maintenance costs. A rebuild should solve an actual business problem, with a plan for the next system’s care. Explore SDM’s website development approach.
What a more maintainable website plan should include
A useful website plan answers everyday questions: who updates it, who checks the backups, and who helps when something goes wrong? An SDM review can help you understand what runs your website, where responsibilities sit and whether the current setup still fits your business.
- A deliberate stack. Choose software and integrations for the business need, with a known maintenance burden.
- Named ownership. Record who maintains hosting, the runtime, dependencies and account access, and how issues are escalated.
- An update and recovery plan. Define update checks, backup verification, restoration responsibility and post-change testing.
- Evidence for the specific deployment. Confirm implemented controls and actual patch status. A score or a platform label does not establish security.
Clear responsibilities make a website easier to maintain as the technology changes. Assess security controls and recovery arrangements for the actual project, rather than relying on blanket guarantees. See our services.
PHP2Shell questions, answered clearly
Does this mean my website has been hacked?
No. A security flaw means there may be a way in; it is not proof someone used it. Ask your host to confirm the fix. If you have noticed suspicious changes, preserve relevant logs and have your host or an incident-response specialist investigate.
Is updating WordPress enough?
Keep WordPress, plugins and themes updated, but also ask about PHP. PHP is separate software used behind the scenes, and its security update may be your hosting provider’s responsibility.
How do I know whether my site uses PHP?
Ask your website or hosting provider. In WordPress, Tools → Site Health → Info → Server also shows a PHP version. Your host should confirm that the fix is included and running; a version number alone may not tell the whole story. See the WordPress Site Health guide (opens in a new tab).
Can a firewall take care of it?
A website firewall may block some attacks, but it does not fix PHP itself. Cloudflare’s guidance (opens in a new tab) also calls for the PHP update. Ask your host to complete the fix rather than relying on the firewall alone.
Do I need to replace my WordPress site?
Fix the immediate issue first. A new website is a separate decision based on your business needs, editing tools, integrations and ongoing care. You do not need to decide on a rebuild before asking your host to update PHP.
Would a custom-built site avoid this?
It depends on what runs it. A custom site using PHP can face the same PHP risk. A site that does not use PHP avoids these particular flaws, but still needs updates, secure accounts, backups and someone responsible for its care.
Why is there a separate October 23 notice?
PHP reported an additional issue that applies under an unusual combination of settings and website behavior. It needs its own check. Your host should assess the October 23 notice (opens in a new tab) as well as the October 21 fixes.
Can SDM help if I do not know who handles this?
You can ask SDM to review how your website is built, who handles its updates and what its maintenance plan covers. We can help clarify the next questions and any agreed follow-up. A general website or marketing score is not proof that PHP2Shell is fixed.
Sources and update notes
Technical sources checked October 24, 2026. Guidance can change as maintainers publish updates. Recheck primary advisories before making a deployment decision.
- PHP Foundation: October 21 security release (opens in a new tab)
- PHP news: October 21 advisory and separate October 23 notice (opens in a new tab)
- CVE-2026-109618 technical advisory (opens in a new tab)
- CVE-2026-109619 technical advisory (opens in a new tab)
- WordPress Site Health documentation (opens in a new tab)
- Cloudflare: WAF protection and the need to patch (opens in a new tab)
- Plesk: PHP2Shell and vendor-package guidance (opens in a new tab)
- CISA ransomware response and recovery guide (opens in a new tab)
