php2shell: What the PHP Flaw Means for Your Website

What is the php2shell vulnerability?

php2shell is the nickname for two serious flaws in PHP, the software that runs a large share of websites. They were announced on October 21, 2026. An attacker does not need a password to use them, and a successful attack can let the attacker run commands on the web server.

The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Both score 9.2 out of 10 on the CVSS 4.0 scale, which is the "critical" range, according to Zscaler and Palo Alto Networks Unit 42. The PHP team published the fixes the same day on its 2026 news page.

What is PHP, and why does my website use it?

PHP is a programming language that runs on the web server and builds pages before they reach a visitor. WordPress, the most common website platform, is written in PHP. So are WooCommerce stores, many booking plugins and many custom business sites. If your site runs WordPress, it runs on PHP.

Think of PHP as the engine under the hood. You never see it, and your developer does not own it. It is open-source software maintained by the PHP project, and your hosting company installs and updates it on the server. That detail matters for the next question.

Is this a problem with my website or my developer's work?

No. The flaw is in PHP itself, not in your site's code, your theme, your plugins or anything your developer built. A site that was written carefully and kept up to date can still be exposed until the server's PHP version is updated. This is a software supply issue, not a mistake by you.

Because the flaw sits below your website, the usual protections inside WordPress, such as strong passwords and security plugins, are not the fix. The fix is to run a PHP version that includes the patch. The PHP team rated one common setup, Apache with mod_php, as the highest risk, since the demonstrated attack runs before any of your site's own code does.

Who is affected by php2shell?

Any website that serves web requests through an unpatched PHP version is potentially affected. The PHP team lists several server setups as affected, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Whether your own site is exposed depends on its PHP version and on how your host has set it up.

The reach is wide. W3Techs reports that PHP is used by 69.2 percent of websites whose server-side language is known (checked October 27, 2026). Among WordPress sites, the WordPress.org statistics feed shows about 34 percent still on PHP 8.1 or older (our own calculation from the feed on October 27, 2026).

Is php2shell being used in real attacks?

Yes. On October 26, 2026, the US cyber agency CISA added both flaws to its Known Exploited Vulnerabilities list, which is reserved for flaws being used in real attacks. Security firms also saw heavy scanning in the first days after the announcement.

Zscaler recorded 1,156 exploitation attempts from 156 unique IP addresses against 70 organizations in the first 48 hours after disclosure, using a network of decoy systems (see its report). F5 Labs said scanning began before official disclosure. As of October 27, CISA lists ransomware use of these two flaws as "Unknown," which means no confirmed link, not a clean bill of health. Source: CISA KEV feed.

Which PHP versions have the fix?

Four current PHP lines have patched releases: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If your server runs one of those numbers or higher within the same line, the fix is in. If it runs something lower, it needs an update. The PHP team lists these on its 2026 news page.

The 8.2 end date comes from the PHP supported versions page.

Why is older PHP (8.1 and earlier) worse?

PHP 8.1 and older no longer receive regular security updates, so a flaw like this one normally goes unfixed on them. The PHP team made an exception and shipped minimal fixes for 7.4, 8.0 and 8.1 because of the severity. That is a one-time courtesy, not ongoing support.

CISA's advice is direct. Organizations that cannot patch, or that continue to use PHP 8.1 or earlier, should take PHP-based systems offline until they can be patched. The full wording is in the CISA alert. Taking a site offline is a business decision, and we cover practical options in the steps below.

Some hosts sell a paid extension. GoDaddy, for example, moved PHP 8.1 to a paid "PHP Extended Support" add-on on January 1, 2026 (GoDaddy help page). That is a stopgap, and it is worth asking your host whether it covers this specific fix.

What do I need to do?

Find out which PHP version your site runs, then update it to a patched release. For most owners that means four steps, and the first one takes about five minutes. If you are on PHP 8.1 or older, treat it as urgent.

• • Check your PHP version. Use our free PHP version checker, or follow the steps in our 5-minute owner check.
• • Ask your host or developer to update. Request a patched release from the table above, in writing, and ask for confirmation once it is done.
• • Test the site afterward. Check forms, checkout, logins and any booking tools. Older plugins sometimes break on a newer PHP.
• • Decide on a plan for old PHP. If you are on 8.1 or older, either upgrade or ask for a documented stopgap and a date. Our PHP upgrade service covers this.

What does Cuanto Labs do for clients?

For clients on our care plans, we check each site's PHP version, schedule the update with the host, test the site before and after, and send a short written confirmation. Sites on PHP 8.1 or older get an upgrade plan, because patching alone is not a long-term answer.

If you are not on a plan, we can do the same as a one-time job. Start with the PHP upgrade service or, for a WordPress site, WordPress security. Ongoing coverage is described on our website care plans page. We cannot promise that any site is unbreakable, but we can make sure this specific flaw is closed and that you have a record of it.

Does php2shell affect HIPAA or PCI compliance?

It can. Healthcare practices and businesses that take card payments are expected to patch known serious flaws within a reasonable time, and some rules set time limits. The details differ for each, so we wrote a separate explainer for healthcare owners.

If you run a practice, read PHP Vulnerability: Is My Healthcare Site at HIPAA Risk?. It also covers the PCI DSS patching rule for sites that take payments. If you are unsure which rules apply to you, ask your compliance advisor.

Next step

If you want a second pair of eyes on your site, book a call and tell us your hosting provider. We will tell you whether you need action this week.

This article is general information, not legal or compliance advice. Written by Eliran Yihye, founder of Cuanto Labs, on October 27, 2026.