PHP2Shell: Is Your Website Affected, and What Should You Do?
PHP2Shell is a pair of critical flaws (CVE-2026-109618 and CVE-2026-109619) in PHP itself, fixed on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Any site running an older PHP build is exposed, whether it runs WordPress, Magento, Drupal, Laravel or custom code. Updating the CMS or plugins does not fix it; only updating PHP does.
Key takeaways
- The flaw is in PHP, not in WordPress, Magento, Laravel or your plugins, so updating them does not help.
- Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 7.4 and older have no fix from the PHP project.
- Ask your host or developer which PHP version and build your site runs, and when it was updated.
- Sites on old PHP often need code changes before they can upgrade, so plan the upgrade on a test copy first.
- PHP on Windows has a separate Brotli issue that needs the re-released builds ending in -1.
On this page
On 21 October 2026, the PHP project fixed two critical flaws in PHP, the programming language behind a large share of the web's websites, including every WordPress site. Security researchers named the flaws PHP2Shell. Governments told website owners to update immediately or consider taking sites offline, and organisations including Wikimedia, Orange and the UK government briefly took systems down as a precaution.
This guide explains, in plain English, whether your website is affected and what to do. We have already updated PHP on our own servers and on the client websites we manage, so this is advice we have followed ourselves.
What is PHP2Shell?
PHP2Shell is the name researchers gave to two remote code execution flaws in PHP, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 for severity. They let an attacker run their own commands on a web server, which can mean taking control of the site and reading its data. According to the researchers at Wiz and Calif who found them with the help of AI tools, they had been in PHP for about a decade.
Cloudflare reported millions of attempts to exploit the flaws across its network within days, according to the BBC. As of 24 October, no successful attack on a real website had been publicly reported. However, a researcher running decoy servers recorded 35 working attacks on them, and a public exploit is now available, so attempts are likely to grow.
Does PHP2Shell affect WordPress, Magento and Laravel?
Yes, but it's not a WordPress, Magento or Laravel problem. It's a PHP problem. The flaw is in PHP itself, the software that runs your website's code. The attack happens before your CMS, framework, theme or plugins load. It makes no difference whether the site is built on WordPress, Magento, Laravel or custom code. That means:
- Every site on an unpatched PHP version is exposed, however up to date its own software is.
- Updating your CMS, framework or plugins does not fix it. Updating WordPress, Magento or Drupal, or a Laravel package, won't help. Only updating PHP does.
- Security plugins can't be relied on to block it, because they run inside PHP after the attack has already happened.
Which software is affected by PHP2Shell?
Any software that runs on PHP is exposed when PHP is not updated. That includes:
- Content management systems: WordPress, Drupal, Joomla, TYPO3, Craft CMS
- Online stores: WooCommerce, Magento (Adobe Commerce), PrestaShop, OpenCart, Shopware
- Custom applications built on PHP frameworks: Laravel, Symfony, CodeIgniter, CakePHP, Yii
- Learning, forums and wikis: Moodle, phpBB, MediaWiki
- Business tools: CRMs, helpdesks, webmail and file-sharing tools that run on PHP, plus admin tools such as phpMyAdmin
Security experts quoted by the BBC also point out that PHP runs inside the admin screens of some routers, load balancers and other devices. Those need a fix from the device maker, so check their security notices.
Sites on hosted platforms that don't run on PHP you manage, such as Shopify, Wix, Squarespace and Webflow, are not affected by this flaw.
Which PHP versions fix PHP2Shell?
| PHP branch | Fixed release (Linux and other systems) | Fixed Windows build |
|---|---|---|
| 8.5 | 8.5.12 or later | 8.5.12-1 |
| 8.4 | 8.4.27 or later | 8.4.27-1 |
| 8.3 | 8.3.36 or later | 8.3.36-1 |
| 8.2 | 8.2.35 or later | 8.2.35-1 |
| 8.1, 8.0, 7.x and older | No fix from the PHP project. Upgrade, or use a backport from your Linux distribution or host | — |
The Windows builds ending in -1 also fix the separate Brotli issue described below.
How do I check if my website is vulnerable?
Ask whoever hosts or manages your website these three questions, in writing:
- Which PHP version does our site run? The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35 or later.
- If it is older, when will it be updated? Get a date, not "soon".
- If we are on PHP 7.4 or older, what is the plan? The PHP project doesn't fix those versions any more. Some Linux distributions and hosts provide their own fixed builds, but many don't.
If you manage the server yourself, the update is your responsibility. If your developer or agency manages it, ask them to confirm it is done.
What if my site runs an old PHP version?
This is where many sites get stuck. A site built on PHP 7 often breaks when moved to PHP 8.2 or later, because old themes, plugins and custom code use features newer PHP removed. A rushed upgrade can take the site down just as surely as an attack.
The safe order is:
- Protect the site now. A firewall rule in front of the server, through Cloudflare or your web server's configuration, can block the attack requests before they reach PHP. As a temporary measure, setting
session.upload_progress.enabled=0in PHP's settings also reduces the risk. Neither replaces updating. - Upgrade on a copy first. Copy the site to a test server, move it to a supported PHP version, and fix whatever breaks.
- Switch over once it works, then keep PHP updated from then on.
Our PHP developers do this kind of upgrade for WordPress, WooCommerce, Laravel and custom PHP sites. If your site was built some years ago and nobody has touched the server since, this is the moment to get it checked.
Does PHP2Shell affect PHP on Windows?
Yes, and Windows servers have a second, separate issue to fix as well.
A separate issue affects the official Windows builds of PHP 8.2 to 8.5. They include a compression library (Brotli) with its own flaw, CVE-2026-111497, which can be reached when the site's code automatically decompresses responses from other servers using cURL or the popular Guzzle library. No attacks have been reported, according to The Hacker News.
The PHP project re-released the Windows downloads with a -1 on the end of the file name, for example php-8.4.27-1-nts-Win32-vs17-x64.zip. The PHP version number stays the same, so php -v won't tell you whether you have the fixed build. Check the file name or its checksum on the PHP downloads page.
How can I tell if my site was already attacked?
Updating PHP stops new attacks but doesn't undo one that already happened. Ask your developer or host to check the server logs since mid-October for:
- very large form submissions with no browser name attached
- "Allowed memory size exhausted" errors together with "Unknown on line 0"
- the web server process crashing, sometimes several times in a row
- the web server starting programs such as
sh,curlorwget
If any of these turn up, have the server checked for files an attacker may have left behind, and change the site's passwords, database credentials and API keys. Our cyber security team can help with this.
How Mindrops can help
We have already updated PHP to fixed releases on our own servers and website, and on the client websites we manage. If your site is looked after by someone else, or by nobody, we can help with whichever step you're at:
| What you need | What we do |
|---|---|
| Find out whether you're exposed | Check which PHP version and build your site runs, who is responsible for updating it, and tell you in plain English what needs doing |
| A quick, safe patch | Update PHP to a fixed release on your server, or apply your Linux distribution's or host's backport, then confirm the site still works |
| Protection while you plan an upgrade | Put firewall rules in front of the site through Cloudflare, Nginx or Apache, and apply the temporary PHP settings, so the site is covered while the real fix is prepared |
| An upgrade from old PHP | Move WordPress, WooCommerce, Magento, Drupal, Laravel or custom PHP sites from PHP 7 or early PHP 8 to a supported version, fixing themes, plugins and code on a test copy before going live |
| A check for signs of attack | Review server logs since mid-October, look for files an attacker may have left, and help you change passwords and keys if anything turns up |
| PHP on Windows | Install the re-released Windows builds and check whether your code uses cURL or Guzzle in a way that needs extra care |
| Ongoing care | Keep PHP, your CMS and plugins updated and monitored, so the next security fix is applied in days, not months |
We work with clients in the USA, Europe, the UK, the UAE and India, from offices in New Delhi, Belgium and London. Our PHP developers handle the upgrades, and our cyber security team handles attack checks. Use the form below to tell us your site's address and what it runs on, and we'll get back to you.
PHP2Shell is a reminder that a website isn't finished when it launches. The software underneath it needs regular updates, and somebody needs to own that job.