PHP2Shell. What to do, in plain English.
Two critical flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619) let an attacker run code on a web server without logging in. The fix shipped on 21 October 2026. This resource center explains who is affected, which version to install, and what to check if you're worried your site was hit. Updated 23 October 2026.
Free PHP2Shell exposure review
Tell us your website. We'll look at what it runs from the outside and tell you what to check and what to ask your host.
Already compromised or need it patched now? See emergency PHP patching.
Thanks. Where should we send it?
Tell us where to send what we find.
You're all set.
We have your request and will be in touch by email.
Status as of 23 October 2026
Where things stand
The fix is out. On 21 October 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which fix both flaws. Its security advisory rates both CVSS v4.0 9.2 (critical) and says only an update is a complete fix.
Attacks have been reported. watchTowr reports exploitation in its honeypot network from 21 October, and Cloudflare reported early attack traffic and added firewall rules. As of 23 October, CISA had not added either CVE to its Known Exploited Vulnerabilities catalog, and no source had documented a confirmed mass compromise. We update this page as that changes.
The flaw is in PHP, not in your CMS. WordPress, Drupal, Joomla and custom PHP sites are exposed because they run on PHP. Updating a plugin or the CMS does not fix it; updating PHP on the server does. Sites on Shopify, Wix or Squarespace run on the platform's own servers, so the platform handles it.
Old PHP is the real danger. PHP 8.1 and older get no official release. The PHP project published minimal source backports for 7.4, 8.0 and 8.1; 7.3 and older, including PHP 5, have no fix at all. PHP 8.2 itself stops receiving security fixes on 31 December 2026.
Free tools
Check, look up, configure
Three free tools for the most common PHP2Shell questions.
PHP2Shell exposure check
See what a website reveals publicly: PHP, its version and its platform.
Check a site →Fixed version lookup
The release or package that fixes your branch, distro, panel or image.
Look up your fix →php.ini generator
PHP's interim settings for your setup, with the restart command.
Generate settings →Fixed versions
Which PHP version fixes PHP2Shell
Find your branch, then make sure your server runs at least the fixed release. "8.3" is not enough on its own: 8.3.35 is still vulnerable, 8.3.36 is fixed.
| Your PHP branch | Fixed in | What to do |
|---|---|---|
| 8.5 | 8.5.12 | Update now. While you wait, the advisory also lists fatal_error_backtraces=0 for 8.5. |
| 8.4 | 8.4.27 | Update now. |
| 8.3 | 8.3.36 | Update now. |
| 8.2 | 8.2.35 | Update now, then plan a move: 8.2 reaches end of life on 31 December 2026. |
| 8.1, 8.0, 7.4 | No official release | Upgrade to a supported branch. Source backports and some Linux vendors' packages exist as a stopgap. |
| 7.3 and older, PHP 5 | No fix | Upgrade or take the site offline until you can. |
Source: PHP security advisory, 21 October 2026. Linux distributions patch without changing the version number: a patched Debian, Ubuntu or Red Hat server can still report an older 8.x version, so check the package version against your vendor's advisory or ask your host. Full details in PHP2Shell fixed versions.
Do this today
Five steps for any site owner
You don't need to understand the bug to close it. You need to know your PHP version and who updates it.
Find out what your site runs
Check the PHP version in WordPress Site Health or your hosting panel, or ask your host. Our guide shows seven ways to check, and why a Linux server can be patched while still showing an older version number.
Find out who updates PHP
On shared or managed hosting, your host updates PHP and you pick the version. On your own VPS or server, you or your developer do it. Platforms like Shopify and Wix handle it themselves.
Get onto a fixed release
Move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later, or your Linux vendor's patched package. If you're on 8.1 or older, this is the moment to upgrade.
Restart PHP
The PHP advisory says to restart every PHP worker after updating, so the fixed code is what's running. Hosts normally do this for you.
Check for signs of a break-in
Attempts were reported before many sites were patched. Look for the signs in was my site hacked through PHP2Shell?
Start here
Understand it and fix it
The plain-English guides most owners need.
What Is PHP2Shell? A Plain-English Guide for Website Owners
What happened, who is affected and what to do, without jargon.
Start here →How to Check Your Website's PHP Version (7 Ways, No Developer Needed)
Seven ways to see your PHP version, no developer needed.
Read the guide →PHP2Shell Fixed Versions: What to Install for Every PHP Branch
Every PHP branch, its fixed release and what to do.
Read the guide →Was My Site Hacked Through PHP2Shell? Signs to Check and What to Do
Signs to look for and what to do if you find them.
Read the guide →PHP2Shell FAQ: 40 Questions Answered
40 short answers to the questions people are asking.
Read the guide →By platform
WordPress, Drupal and Joomla
What PHP2Shell means for each CMS, and what each one needs from PHP.
PHP2Shell and WordPress: Is Your Site Affected and What to Do
Is your WordPress site affected, and what to do about it.
Read the guide →PHP2Shell and Drupal: What Site Owners Need to Do
Drupal versions, PHP requirements and the steps to take.
Read the guide →PHP2Shell and Joomla: What Site Owners Need to Do
Joomla versions, PHP requirements and the steps to take.
Read the guide →Website Security by Platform: What You Are Responsible For, and What You Are Not
How security duties split across 10 website platforms.
Read the guide →For IT teams
Technical detail
For developers, sysadmins and in-house IT.
CVE-2026-109618: PHP2Shell Out-of-Memory Flaw, Advisory Summary and Fix
Out-of-memory corruption: the trigger, the code path and its mitigations.
Read the guide →CVE-2026-109619: PHP2Shell Stale-State Flaw, Advisory Summary and Fix
Stale global state: OPcache, fatal errors and why restarts matter.
Read the guide →PHP2Shell Interim Mitigations: Every php.ini Setting Explained
Every php.ini setting in the advisory, what it blocks and what it breaks.
Read the guide →PHP2Shell Exploitation Status: What Is Confirmed So Far
Dated reports of exploitation, newest first.
Read the guide →By PHP version
Your PHP branch, your next step
One page per branch: the fixed release, end-of-life date, which Linux releases ship it, and what to do.
PHP 8.5 and PHP2Shell: Fixed in 8.5.12, What to Do
Fixed in 8.5.12, plus the 8.5-only setting.
Read the guide →PHP 8.4 and PHP2Shell: Fixed in 8.4.27, What to Do
Fixed in 8.4.27.
Read the guide →PHP 8.3 and PHP2Shell: Fixed in 8.3.36, What to Do
Fixed in 8.3.36, and why Ubuntu shows 8.3.6.
Read the guide →PHP 8.2 and PHP2Shell: Patch to 8.2.35, Then Plan Your Move
Fixed in 8.2.35, end of life 31 December 2026.
Read the guide →PHP 8.1 and PHP2Shell: No Official Fix. Your Options
No official fix: your options.
Read the guide →PHP 8.0 and PHP2Shell: No Official Fix. Your Options
No official fix: your options.
Read the guide →PHP 7.4 and PHP2Shell: No Official Fix. Your Options
No official fix: your options.
Read the guide →PHP 7.3, 7.2 and PHP 5 After PHP2Shell: Upgrade or Take It Offline
7.3, 7.2 and PHP 5: upgrade or take it offline.
Read the guide →How to Upgrade an Old PHP Site Safely After PHP2Shell
Upgrading an old PHP site without breaking it.
Plan the upgrade →By server setup
How your server runs PHP
Exposure, settings and the right restart for each setup.
Apache mod_php and PHP2Shell: Why It's the Highest-Risk Setup
The highest-risk setup, and how to patch it.
Read the guide →PHP-FPM and PHP2Shell: Patch, Restart and Configure
Pools, settings and reload vs restart.
Read the guide →Nginx With PHP-FPM and PHP2Shell: What to Check
Nginx in front of PHP-FPM: what to check.
Read the guide →LiteSpeed (LSAPI) and PHP2Shell: Patching lsphp
Patching lsphp on LiteSpeed servers.
Read the guide →FrankenPHP and PHP2Shell: Worker Mode, Updates and Restarts
Worker mode, updates and restarts.
Read the guide →php-cgi and PHP2Shell: What Older Hosting Setups Need to Do
Older CGI setups.
Read the guide →OPcache and PHP2Shell: What Site Owners Need to Know
What OPcache has to do with it.
Read the guide →How to Restart PHP Workers After a Security Update (Every Setup)
Restart commands for every setup.
Get the commands →Hosting
Shared and managed hosting
Most owners don't patch PHP themselves. Here's what your host does and what to ask.
Public sector
Cities, counties and special districts
Agency advice, vendor questions, and how PHP2Shell fits with the ADA Title II deadlines.
The bigger picture
AI and the future of website security
What AI-assisted discovery changes, and what it doesn't.
If the worst happened
Hacked-site recovery guides
The First Hour: A Website Incident Response Plan You Can Actually Follow
Read article →BlogWebsite Hacked? Start Here
Read article →Blog10 Warning Signs Your WordPress Site Has Been Hacked
Read article →BlogHow to Remove Malware from Your Website (Without Losing Everything)
Read article →BlogHow to Check If Your Website Has Been Hacked (Free Tools Inside)
Read article →BlogRecovering Your Rankings After a Hack: The Job That Starts When the Cleanup Ends
Read article →BlogWhat It Costs to Fix a Hacked Website, and What You Are Actually Paying For
Read article →BlogBackups: The Control That Decides How Bad It Gets
Read article →Get help
When you'd rather hand it off
Patching PHP is quick when you know the server. If you don't, we can do it or work with your host.
Emergency PHP Patching
We confirm your setup, get PHP onto a fixed release and check for signs of compromise.
Get it patched →Website Security Services
Ongoing hardening, monitoring, backups and hack cleanup.
Read the guide →Website Security Consulting for Businesses and Local Government
Assessments, vendor reviews, incident response retainers and rebuild planning.
Talk to a consultant →Headless CMS Development Services
Rebuild so the public site no longer runs PHP for every visitor.
Read the guide →FAQ
Quick answers
What is PHP2Shell?
Is my WordPress site affected?
Are Shopify, Wix and Squarespace sites affected?
Does a security plugin or firewall protect me?
I'm on PHP 7.4. What now?
Do I have to restart anything after updating?
Project Managers who will work with you on your project!
Not sure where your site stands?
Tell us your website and we'll tell you what it runs, who should patch it and whether anything looks wrong.
Get help with PHP2Shell →