PHP2Shell Explained: Is Your Website at Risk?

On 21 October 2026, the PHP project released an emergency security update for two critical flaws, nicknamed "PHP2Shell". If your website runs on WordPress, or on anything else built with PHP, this one is worth five minutes of your time.

What happened

The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, are both rated 9.2 out of 10 for severity. In plain English, they can let an attacker run their own code on the server behind your website, without needing a password or a login. Once someone can do that, they can deface your site, steal form submissions or customer data, or quietly use your server to attack other people.

Security researchers reported exploitation attempts within days of the fix, and several working proofs of concept were published almost immediately (Rapid7 (opens in a new tab)). The PHP maintainers were clear that there is no complete workaround: updating PHP is the only real fix.

Who's affected

Any website serving pages through an unpatched version of PHP. That includes most WordPress sites, plus WooCommerce shops and many older custom-built sites. The fixed versions are:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

Sites on PHP 8.1 or older are in a worse position. Those versions are out of official support, so they only received limited emergency patches, and future problems won't be fixed at all.

How to check your site in two minutes

If you're on WordPress, go to Tools, then Site Health, then Info, then Server, and look at the PHP version. If it's older than the numbers above, or older than 8.2, contact your host or developer today and ask two questions:

1. Has the PHP2Shell patch been applied to my server?
2. When will my site move to a supported version of PHP?

A good host will already have patched. A cheap shared host, or a site nobody has looked at in a couple of years, might not have.

The bigger lesson: websites aren't "done" when they launch

PHP2Shell isn't unusual. Every website sits on software that needs regular updates, and the risky sites are rarely the ones being attacked on purpose. They're the ones nobody is watching. A small business site built three years ago and never touched since is exactly what automated attacks look for.

That's why we take a different approach. The bespoke sites we build don't run on PHP at all, so this particular flaw doesn't touch them. But no technology is immune forever, so the real protection is someone keeping everything up to date and watching for problems before they reach you.

How we can help

Our website care plans start from £95 a month and include uptime and error monitoring plus monthly dependency and security updates, so the next PHP2Shell is handled before you've read the headline. If your current site is on an old WordPress setup and keeps needing patches, a website rebuild onto a modern, faster stack can remove a whole category of risk for good.

Not sure where your site stands? Book a free 30-minute call and we'll check it with you.