PHP2Shell PHP Vulnerability: What to Do Now

On 21 October 2026, the PHP project released fixes for two critical security flaws that have become known as PHP2Shell. Because WordPress, TYPO3 and many other systems run on PHP, a lot of websites are in scope. The reassuring part first: for many sites, a PHP update from the hosting provider is all it takes. This article walks through what happened, who is affected and what to do, calmly and in order.

As of 21 October 2026. Sources are listed at the end of the article.

If you'd like to know first which PHP version your site reports to the outside world: our free PHP check loads your homepage once and explains the result.

What is PHP2Shell?

PHP2Shell is the name for two vulnerabilities in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619. Both allow remote code execution: under certain conditions, an attacker can run their own code on your server from the outside. The official PHP security team rates them 9.2 on CVSS v4.0, which is critical.

What makes this case unusual is the timeline. Details leaked before the patch was released, and the leaked material pointed at "session upload progress", a PHP feature that is switched on by default. Cloudflare has already reported early attacks. On WordPress sites, attackers reportedly used UpdraftCentral keys to plant backdoors.

PHP2Shell is not a bug in a single plugin but in PHP itself. What matters is the PHP version on your server.

Is my website affected?

In principle, every PHP installation that answers web requests is affected, no matter how PHP is set up:

• PHP-FPM
• mod_php (PHP as an Apache module, where the risk is highest)
• FrankenPHP

That covers practically every site built on WordPress, Joomla, Drupal, TYPO3 or custom PHP code, as long as it doesn't run a fixed PHP version yet.

The fix ships in these releases, published on 21 October 2026:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

Any later release in these branches includes the fix as well. PHP 8.1 and older will not be patched, because those versions have reached end of life.

What should I do now? Step by step

1. Find out your PHP version

The most reliable source is your hosting control panel, usually under "PHP settings" or "PHP version". Or simply ask your host. Our PHP check shows what your server reports publicly. Treat that as a hint, not proof: many servers hide their version, and that's good practice.

2. Update to a fixed release

If your site runs on PHP 8.2 to 8.5, updating to the fixed release of your branch is normally enough. On shared hosting your provider usually rolls it out, often without you having to do anything. It's still worth asking whether and when the update was applied. On your own server, update PHP through the package manager or your container image.

3. Apply the interim mitigation

If you can't update right away, the recommended stopgap is to switch off session upload progress:

session.upload_progress.enabled = 0

Depending on your hosting, you set this in php.ini, in the hosting control panel or in a .user.ini file. It doesn't replace the update, but it shrinks the attack surface until the update is in place.

4. Look for signs of an attack

Because details were public before the patch and early attacks have been reported, it's worth taking a look at your site even if the update is already installed:

• newly created or recently modified PHP files, especially in upload folders
• admin accounts you don't recognise
• unexpected redirects or content that isn't yours

If in doubt, keep a backup at hand that was made before 21 October 2026.

5. WordPress: update plugins and renew UpdraftCentral keys

WordPress sites have two extra items. Update all plugins and themes. And if you use UpdraftPlus together with UpdraftCentral, delete the existing UpdraftCentral keys and create new ones, because keys like these were reportedly abused to plant backdoors.

Why will PHP 8.1 and older get no patch?

Each PHP version receives security updates for a limited time only, and PHP 8.1 and everything before it are past that window. For PHP2Shell this means: there will be no fix for these versions. The interim mitigation lowers the risk, but it is not a lasting solution.

The only way forward is an upgrade to PHP 8.2 or newer. That sounds like one click in the hosting panel, but often it isn't: older themes and plugins that haven't been maintained for years frequently need changes before they run on a newer PHP version. Sometimes the site shows error messages after the switch, or just a blank page. If you can, test the upgrade on a copy of the site first.

Do I need a new website?

Honestly, in most cases no. If you're on PHP 8.2 to 8.5 and keep your plugins up to date, the update is all you need.

A rebuild can make sense when several of these apply:

• The site runs on PHP 8.1 or older, and the upgrade fails because of the theme or plugins.
• Important plugins are no longer being developed.
• Nobody has looked after the site for a while, and no one really knows its technical state.
• The content and design are dated anyway.

Then a new website can be cheaper than patching up an old installation, for example one that doesn't need PHP at all and therefore no server updates, plugin maintenance or security patches. We build those from €1,990 at a fixed price, and we move your content over. Whether that applies to you is usually clear after a quick look at your site. More on our custom development and website leasing pages.

How can EA Digital Solutions help?

EA Digital Solutions is a small software and consulting company based in Graz, Austria. If you'd rather not handle the update yourself, or you don't have access to the server configuration, we take care of it: checking the PHP version, coordinating with your host, setting the interim mitigation and checking for suspicious files. For sites on PHP 8.1 or older, we plan the upgrade or a rebuild. All details and the enquiry form are on our page about the PHP2Shell vulnerability. For urgent help we quote a fixed price after a short call; a new website starts at €1,990.

Summary

PHP2Shell deserves attention, but in most cases it is straightforward to deal with: check your PHP version, update to a fixed release, apply the interim mitigation until then and look for traces of an attack. It only gets harder on PHP 8.1 and older, where no patch is coming and an upgrade or rebuild is needed.

Sources

• Patchstack: PHP major vulnerability alert
• Tenable: PHP2Shell – Frequently Asked Questions
• Help Net Security: PHP2Shell vulnerabilities patched

As of 21 October 2026