hello@wpfoss.com
PHP2ShellWebsite SecurityHacked WebsiteWordPress

PHP2Shell: what the PHP flaw means for your website and what to do

Two critical PHP flaws let attackers take over websites without logging in. Who is affected, the fixed versions, the signs of a hack, and how to recover.

By WPfoss Team Last updated

On Tuesday 21 October 2026, websites around the world started going offline on purpose. Government sites in the Netherlands and Finland, UK councils and the Metropolitan Police, and company sites across Europe, Asia and Australia were switched off by their own owners. They were not broken. They were hiding while their servers were patched.

The reason is a pair of flaws in PHP, the language that runs WordPress, WooCommerce, Joomla, Drupal, Magento, Laravel and most of the websites small businesses own. Researchers named it PHP2Shell, because it turns a normal web request into a shell: full control of the server.

If your website runs on PHP, and it very likely does, this is the plain version of what happened, how to tell whether you are exposed, and what to do today.

What PHP2Shell is, in plain English

PHP2Shell is two security flaws, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 for severity.

They let an attacker run their own code on your web server without logging in. Three things make this worse than the usual WordPress plugin warning:

  • It happens before your website’s own code runs. The flaws sit in the part of PHP that reads an incoming request. Your login page, your security plugin and your strong passwords never get a say. Datadog’s researchers confirmed that application-level login cannot block it.
  • A clean, up-to-date website is still exposed. Wiz showed working attacks on the latest WordPress, Drupal and Joomla. Sansec confirmed WooCommerce and Magento shops are affected even when their own code is spotless. The problem is the PHP underneath, not your site.
  • It is old. The faulty code goes back to PHP 5.4, released in 2012. Every PHP version before the fixes below is affected.

The flaws were found with the help of AI tools, which is part of why the news is everywhere: the same kind of tools can help attackers turn the published details into working attacks fast.

Attacks have already started

This is not a theoretical warning.

  • Amazon’s threat intelligence team found an attempt to exploit PHP2Shell dated 17 October, four days before the public announcement.
  • Details leaked early on 20 October, and the PHP team released emergency fixes on 21 October.
  • Cloudflare reported attack attempts climbing from thousands before the announcement to millions within hours of it, and put temporary firewall rules in place. Its own team called those rules a stopgap, not a fix.
  • watchTowr saw exploitation in its traps on 21 October, and hosting companies reported active incidents to Patchstack the same day. Wordfence had blocked more than 74,000 attempts but, at the time of writing, had not confirmed a site broken into this way. Both can be true: most attempts fail, and the ones that work are quiet.
  • CybelAngel counted about 2.24 million PHP servers facing the internet, with 59% on PHP lines that will never get an official fix.

It will take days, possibly weeks, before anyone knows how many websites were broken into before their owners patched. A site can be quietly compromised and look completely normal.

Is your website affected?

Your website is exposed if all three of these are true:

  1. It runs on PHP. WordPress, WooCommerce, Joomla, Drupal, Magento, Laravel and most cPanel hosting do.
  2. Its PHP version is older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (the fixed release in each line).
  3. Nobody has patched it since 21 October.

If your site is on PHP 8.1 or older, there is no official fix at all. Some hosting companies, including cPanel through EasyApache 4, have back-ported the fix into their own 7.4, 8.0 and 8.1 packages. Many have not. Old PHP is now a door that may never be closed by the people who made it.

The quickest check: run your site through our free PHP2Shell checker. If your server announces its PHP version, it tells you whether that version is one of the exposed ones, along with everything else a stranger can see. If your server hides the version, it says so, and you will need to ask your host.

Updating WordPress, your theme or your plugins does not fix this. The flaw is in PHP, underneath WordPress, and the WordPress security team said no WordPress update was needed or planned for it.

You can also see your PHP version in your hosting panel. On cPanel it is under MultiPHP Manager. In WordPress it is under Tools, then Site Health, then Info, then Server.

What to do today

Updating PHP is the only complete fix. The PHP team has said plainly that no setting fully closes the hole.

  1. Check your PHP version using the steps above.
  2. If you are on shared hosting, ask your host one direct question: “Has the PHP on my plan been updated for CVE-2026-109618 and CVE-2026-109619, and on what date?” A good host answers with a version number. A vague answer is an answer too.
  3. If you run your own server or VPS, nobody will patch it for you. Update to a fixed release and restart every PHP worker. Until you can, the PHP advisory’s stopgap is to turn off session.upload_progress in the server’s main PHP settings, not in a per-site file. Hostinger did exactly this across its shared platforms while packages caught up.
  4. If you are on PHP 8.1 or older, plan the upgrade now. Moving a site to a supported PHP version is the step people put off because a plugin might break. That risk is now smaller than the risk of staying.
  5. Assume the patch closed the door, not that nobody came in. Attacks started before the fix. Patching a server stops new break-ins; it does not remove a back door that was planted on 18 October.

Signs your website has already been hacked

A broken-into website rarely announces it. Look for:

  • A new administrator account you did not create.
  • PHP files in places that should only hold images, such as the WordPress uploads folder.
  • Visitors from Google or a phone being sent to a different website, often only on mobile.
  • Pages in Google’s results for things you never wrote: pharmacy, betting, loans.
  • A warning from Google Search Console, your browser, or your host.
  • Your host suspending the account for sending spam or using too many resources.
  • The site going down, or crawling, for no reason you can find.

If you see any of these, do not only delete the strange file you found. Attackers leave more than one way back in, and a partial clean-up usually means being hacked again within a week.

If your website is down or has been hacked

There are two different emergencies here, and we fix both.

Your website is down. Some sites were switched off during patching and never came back. Others broke when the host upgraded PHP underneath them, because an old theme or plugin does not run on the new version. We find what stopped it, move it safely to a patched PHP version, fix what the upgrade broke, and bring it back online.

Your website has been broken into. We find how they got in and everything they left behind, remove it, close the door they used, restore clean files where needed, reset the passwords and keys that may have been seen, and get any Google warning lifted. Then we check it again with you so you can see it is clean.

Your website is fine and you want it to stay that way. We check the PHP version and the server settings, look at your site the way an attacker would, and close what we find in a safe order without taking the site offline.

Start with our free PHP2Shell checker. It shows in about a minute whether your server announces an exposed PHP version, and what else a stranger can see about your site: missing protections, leaked keys, signs of old software. To be straight with you: no outside scanner can safely test for PHP2Shell itself without attacking your server, so treat a good result as one part of the picture, not proof you are patched.

Then talk to us:

If your site is down right now, say so in the first line and we will look at it first.

More on how we work is on the website security service page.

Sources and further reading

Read next

Get Started

Stop impersonation. Control access. Protect your business.

Choose the service you need, or book a security review and we will help you identify the correct starting point.

Book a Security Review Check Your Domain Free