If your site runs PHP 8.2, 8.3, 8.4, or 8.5 below the fixed releases, it runs an affected version. If your host already updated PHP, you are fine. The flaw sits in PHP itself, so WordPress, theme, and plugin updates cannot fix it. Only a PHP update on the server closes it, and checking your version takes about two minutes.
PHP2Shell is the name researchers gave to two critical flaws in PHP core, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. They allow an unauthenticated attacker to run code on a server, and PHP rates the risk highest for Apache with mod_php, where a demonstrated exploit fires before any application code runs. PHP shipped the fixes on October 21, 2026. Everything below follows from one question: is your site on a fixed version or not?
How do I check my site’s PHP version?
Open your WordPress dashboard, go to Tools, then Site Health, then Info, then Server. The PHP version line shows what your site runs. Compare it with the fixed releases in the table below. If the number is lower than the fixed release for your branch, your site needs a PHP update from your host.
- Open your WordPress dashboard and go to Tools, then Site Health, then Info, then Server.
- Read the PHP version line and write down the full number, including the digits after the second dot.
- Compare that number now with the fixed release for your branch in the table below.
- Contact your host with the version number and ask for the fixed PHP release for your branch.
Most hosting panels also show the active PHP version, usually under a PHP version selector or PHP settings page. If Site Health is unavailable, that panel is the backup. Do not install a plugin to check this. A plugin cannot tell you anything Site Health does not already show, and this is a week when installing random code is a bad idea.
Which PHP versions fix PHP2Shell?
TechReview analysis: match your branch to your move. The fixed releases come from PHP’s October 21 advisory. The moves are our read of what each situation requires.
| Your PHP branch | Fixed release | Your move |
|---|---|---|
| 8.2–8.5 (supported branches) | 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 | Ask your host to update now if your version is below your branch’s fixed release. |
| 8.1 and older | No official release | Ask your host whether your build carries both CVE backports. If the answer is unclear, plan an upgrade to a supported branch. |
Every release before those four that serves web requests is affected, including PHP-FPM, mod_php, php-cgi, FrankenPHP, and LiteSpeed setups. The attack needs no login. That is why this flaw drew a CISA alert on October 21: the vulnerable code runs before a site’s own code gets a chance to defend itself.
Will updating WordPress or a security plugin fix it?
No. The bug lives in PHP’s request handling, which runs before WordPress or any plugin loads. A plugin firewall cannot block an attack that executes before the plugin’s code starts. The fix lives on the server, in the PHP version itself, and only your host or server admin can apply it.
A web application firewall helps only at the edges. Cloudflare turned on WAF protection by default for free and paid WAF customers from 03:02 UTC on 21 October, but those rules buy time rather than closing the flaw, and they help only if attackers cannot reach your origin server directly. Treat a WAF as a stopgap. The patch is the fix.
We covered the disclosure timeline, the leaked details, and the patch release in our PHP2Shell report. What follows here is the part that report could not do for you: the check and the fix, step by step.
What should I ask my hosting provider?
Send your host this message, with your version number filled in:
“Hi, my site runs on PHP [your version]. Has it been updated to the fixed PHP2Shell release for my branch (8.5.12, 8.4.27, 8.3.36, or 8.2.35), or to a backported build with both CVE fixes? If not, please update it.”
A clear answer names a version number or a backport. A vague answer does not. If your host cannot update you, ask whether they ship patched packages from a long-term support vendor. If they offer neither a fixed release nor a backported build, your realistic options are moving to a host that patches or upgrading to a supported PHP branch. CISA’s October 21 alert says systems that cannot be updated should be taken offline until they can be patched. CERT-EU had separately advised isolating internet-facing PHP apps that cannot be patched quickly. For a small site, the practical version of that advice is not to leave an unpatched site running indefinitely while hoping nobody probes it. Krebs reported working exploits and exploitation in the wild after the patches, watchTowr said it was observing active exploitation attempts of both CVEs, and VulnCheck reports a working exploit specifically for CVE-2026-109618.
What if my site runs PHP 8.1 or older?
PHP published no official release for 8.1 and older. It published minimal source backports for 7.4, 8.0, and 8.1, aimed at people who build PHP from source. Some long-term support vendors ship patched packages for end-of-life streams, including Ubuntu’s extended support releases and community rebuilds. Whether your site is protected depends entirely on whether your host applied one of those builds, which is why the question to your host matters more than the version number alone. If your host cannot confirm a backport, treat the site as unpatched and plan the upgrade. Running an end-of-life PHP branch was already risky before this week. PHP2Shell just made the cost concrete.
What to watch next
Two things will decide how this story ends for site owners. First, whether CISA adds either CVE to its Known Exploited Vulnerabilities catalog. Neither was listed as of October 22, 2026, even though researchers reported exploitation attempts. A KEV listing would force federal civilian agencies onto a deadline and push more hosts to patch faster. Second, whether hosts finish rolling out fixed builds, especially for the older branches where no official release exists. If KEV listing happens, we will update our PHP2Shell report on the same URL.
Frequently asked questions
Does disabling session.upload_progress fix PHP2Shell?
No. It addresses one of the two flaws on one confirmed path only. The other flaw needs different settings, and PHP says updating is the only complete fix.
Is PHP2Shell in CISA’s KEV catalog?
Not as of October 22, 2026. CISA’s October 21 alert still urges immediate patching. CISA said it had not observed exploitation when it published; that is a separate statement from Australia’s Cyber Security Centre, which said before the patches that it was not aware of active exploitation. Researchers have since reported exploitation attempts.
Do I need to do anything if I don’t own a website?
No. This flaw affects servers running PHP, not people browsing websites. If you only visit sites, there is nothing to patch on your side.
How do I know the patch worked?
Recheck Site Health after your host confirms the update. The PHP version line should read at or above the fixed release for your branch, or your host should confirm a backported build carrying both CVE fixes.
Sources: PHP security advisory (October 21, 2026); CISA alert, “Critical Vulnerabilities in PHP Require Immediate Patching” (October 21, 2026); CERT-EU advisory 2026-018 (October 20, 2026); VulnCheck; Krebs on Security; watchTowr; Cloudflare. Our earlier PHP2Shell report carries the full timeline.
