PHP2Shell Explained: Is Your Business Website at Risk (and How to Fix It Today)?
By Zhessor · · 5 min read
If your business website runs on WordPress, Drupal, Joomla or any PHP-based platform, this one matters. In October 2026, two critical vulnerabilities in PHP itself, nicknamed PHP2Shell, were disclosed and quickly exploited. Government agencies in the Netherlands and Finland even took websites offline as a precaution, and the UK's National Cyber Security Centre told organisations to update immediately or take systems offline until they could.
Here's what you need to know, in plain language, and exactly what to do about it.
What is PHP2Shell?
PHP2Shell is the name for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 (critical) on CVSS v4.0.
The important part: these bugs aren't in a plugin, a theme or your website's code. They're in PHP, the language your server uses to run your site. That means your website can be built perfectly and still be vulnerable.
In the worst case, an attacker can run their own code on your server without logging in. That could mean stolen customer data, a defaced site, injected malware or spam pages that destroy your Google rankings.
Why this one is different
- No login required. Attackers don't need a password or a vulnerable plugin.
- It affects almost every PHP version. All releases before the October 21, 2026 fixes are vulnerable, and researchers confirmed older versions going back to PHP 5 are affected too.
- It's already being exploited. Technical details leaked before the planned disclosure, public exploit code appeared on GitHub, and security firms including Cloudflare and watchTowr reported real attacks.
"I updated WordPress. Am I safe?"
No, not from this. This is the most common misunderstanding we're seeing.
Updating WordPress, your theme or your plugins does not fix PHP2Shell. WordPress automatic updates don't touch the PHP version on your server. The fix has to happen at the server or hosting level.
How to check if your website is vulnerable
You don't need to be technical to do this:
- Use a free checker. Security firm Aikido offers a free PHP2Shell checker. Enter your website URL and it reports whether your site looks vulnerable, mitigated or patched.
- Check your PHP version. Log in to your hosting panel (cPanel, Plesk, Hostinger hPanel, etc.) and look for "PHP Version" or "PHP Configuration."
- Ask your host directly. Send them one line: "Has my server been updated to a PHP version patched for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)?"
The fix: upgrade PHP
The PHP project has been clear that updating is the only complete fix. Temporary workarounds reduce risk but don't fully close the hole.
Upgrade to one of these patched versions, matching the branch your site uses:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
If your site runs PHP 8.1 or older
This is the riskiest situation. PHP 8.1 and older no longer receive official updates, so there is no simple patch for them. Your options are:
- Upgrade to a supported PHP version. This sometimes breaks old themes and plugins, so test it on a staging copy first.
- Use a host or vendor that provides extended security support.
- If the site is too outdated to upgrade safely, rebuild it on a modern, maintained stack.
Patched doesn't automatically mean clean
Because attacks started before the patches shipped, an update stops new attacks but doesn't undo anything that already happened. After updating, it's worth:
- Checking for unknown admin users or recently changed files
- Running a malware scan
- Resetting admin, hosting and database passwords
Watch out for fake "urgent PHP update" emails
Scammers love a headline. Be suspicious of emails or messages urging you to download an "emergency PHP patch." Real PHP updates happen through your hosting provider or server, never through an email attachment.
A newer related issue to keep an eye on
On October 23, PHP published an advisory for a related vulnerability, CVE-2026-115560, in its session upload progress feature. It affects even fully patched versions and will be fixed in PHP's next regular release. Using a web application firewall (WAF), such as Cloudflare's, adds an extra layer of protection while you wait.
The real lesson: someone needs to own your website
PHP2Shell will be fixed. The bigger problem it exposed is that most small-business websites have nobody looking after them. They get launched and then left alone, with no updates, no monitoring and no one checking when something like this hits.
A website is not a one-time purchase. It's a business asset that needs maintenance, just like your accounts or your equipment.
How Zhessor can help
At Zhessor, we build and maintain websites so issues like this don't land on your desk.
- Free PHP2Shell check: we'll test your site and tell you exactly where you stand. If you're already safe, we'll tell you that too.
- Patching and hardening: we'll coordinate with your host, upgrade PHP safely and check for signs of compromise.
- Ongoing maintenance: updates, monitoring and backups handled for you.
- Modern rebuilds: if your site is too outdated to upgrade safely, we rebuild it on a modern, managed stack where platform-level security patches are handled for you.
👉 Get your free website security check
Sources
Want help growing your business online? See our services
Get a Proposal