PHP2Shell is the nickname for two critical flaws in PHP, the programming language that runs WordPress, WooCommerce and a large share of the web. They were fixed on October 21, 2026, and since then attack attempts have run into the millions. If you own a website and aren't sure whether you need to do anything, this guide is for you.
The short version: if your site is on mainstream shared or managed hosting, your host very likely patched it within a day or two, but confirm it in writing. If your site runs on a VPS or a dedicated server, or on PHP 8.1 or older, fixing it is your job (or your developer's), and it should happen now.
What PHP2Shell is
The two flaws, CVE-2026-109618 and CVE-2026-109619, let an attacker run their own code on a web server by sending it a specially crafted request. No login is needed. They affect PHP whenever it serves web pages, whichever way it's set up (PHP-FPM, Apache's mod_php, php-cgi, FrankenPHP or LiteSpeed).
The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer get official updates; some Linux distributions and hosting vendors have published their own fixes for them, and the PHP team released minimal fixes for people who build PHP themselves.
WordPress itself doesn't need an update. WordPress.org says the problem is in PHP, so no WordPress release is required or planned. The fix has to happen on the server.
Has anyone actually been hacked?
There has been a lot of noise, so here is what's established as of November 1:
- Attempts are everywhere. Cloudflare reported millions of attempts within hours of the release, and Wordfence logged about 77,600 attack requests against WordPress sites between October 23 and 27.
- Confirmed break-ins so far are not websites. Israeli security firm Dream reported that attackers took full control of 25 servers in the US and Asia, three of them in a US government-affiliated network, by chaining PHP2Shell with a Linux bug. Those were firewall management interfaces running an old PHP version. Researchers also caught successful attacks on deliberately exposed test servers ("honeypots").
- No confirmed WordPress compromises. As of October 28, Wordfence knew of no WordPress site compromised through these flaws, and some early alarming reports were walked back. CISA, the US cybersecurity agency, has confirmed the flaws are being exploited but hasn't named victims.
- Attackers got a head start. Amazon says its sensors saw an exploit attempt on October 17, four days before the fix was public, and advises investigating back to that date.
Is your website affected?
If you're on shared or managed hosting
Several large hosts have said publicly what they did:
- SiteGround, Kinsta, DreamHost and Cloudways say they patched their servers between October 21 and 23; SiteGround and Kinsta say customers don't need to do anything.
- WP Engine (including Flywheel) says all customer sites now run fully patched PHP.
- Hostinger and GoDaddy patched their shared and managed platforms, but say VPS customers must update PHP themselves.
- Bluehost said most platforms were done as of October 23, and asked VPS and dedicated-server customers to run their package updates.
- cPanel shipped fixed PHP packages on October 21; hosts running cPanel still have to install them.
If your host isn't on this list, or you're not sure which plan you're on, ask (the questions are below).
If you run your own server or a VPS
Nobody patches it for you. Update PHP to a fixed release through your operating system's package manager or your control panel, then restart PHP so the new version is the one actually running. If you can't update right away, the US cybersecurity agency's advice is to take the site offline until you can.
If your site runs PHP 8.1 or older
There's no official PHP update. Ask your host whether they've installed a backported fix; if not, upgrading is the fix. Plan for 8.3 or newer: PHP 8.2 reaches end of life on December 31, 2026.
How to check your PHP version
- WordPress: go to Tools → Site Health → Info, then open the Server section.
- cPanel: the MultiPHP Manager screen lists each domain's PHP version. Some hosts hide it; if you can't find it, ask.
One catch: hosts that back-port fixes often keep the old version number. GoDaddy and Hostinger say to check that the PHP build date is October 21, 2026 or later. When in doubt, the host's written answer beats the version number.
What to ask your host
Copy and send this:
Is the PHP serving my account patched for CVE-2026-109618 and CVE-2026-109619, and has PHP been restarted since the fix was installed? There's also a third issue, CVE-2026-115560, that doesn't have a fix yet. Have you turned off
session.upload_progressas PHP recommends?
That third flaw only affects sites with an unusual configuration, and PHP plans to fix it in its next regular release, but the recommended setting is harmless for most sites.
Is a firewall enough?
No. Cloudflare, AWS, Imperva and others added firewall rules quickly, and they block many known attacks, but each describes them as an extra layer rather than a fix. Cloudflare reported attackers changing their payloads to slip past rules, and some attacks hit PHP before WordPress security plugins ever load. Patching PHP is the only complete fix.
Signs your site may have been compromised
From Wordfence and the security researchers who studied the attacks, look for:
- PHP files you don't recognize in
wp-content/uploads, or in plugin and theme folders, created since October 17 - administrator accounts you didn't create
- scheduled tasks or cron jobs nobody set up
- the site making unexpected outbound connections, or logs showing crashes and memory errors
If you find something: make a full backup of the site as it is first (it's evidence), change the database password and the secret keys in your configuration files, then clean up or restore from a known-good backup. Keep your server logs from October 17 onward.
Why this one moved so fast
Two research teams found these bugs over the summer with help from AI models, exploit attempts started days before the fix was public, and attempts reached the millions within hours of it. That's the new normal behind Black October: the gap between "a fix is out" and "attacks are landing" is now measured in hours, so "we'll update next month" no longer works for anything facing the internet.
Sources
- php.net: 2026 news archive (Oct 21, 23 and 26 entries)
- CISA: Critical vulnerabilities in PHP require immediate patching and two PHP flaws added to the Known Exploited Vulnerabilities catalog
- WordPress.org: Critical PHP security release and Site Health screen
- Wordfence: PHP2Shell update: still no confirmed WordPress compromises (Oct 28, 2026)
- The Hacker News: PHP2Shell attack roots 25 servers, breaches U.S. government-affiliated network (Oct 28, 2026)
- The Register: Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers (Oct 29, 2026) and CISA confirms PHP2Shell under attack (Oct 27, 2026)
- AWS Security: PHP2Shell exploitation prior to public disclosure and Using AWS WAF to apply mitigations
- Cloudflare: Protections against the php2shell vulnerability
- Hosting notices: SiteGround, Kinsta, WP Engine, Hostinger, GoDaddy, Bluehost, DreamHost, Cloudways, cPanel release notes
- WIRED: The PHP meltdown shows how AI makes bugs more exploitable (Oct 24, 2026)
This post reflects reporting available on November 1, 2026.