mebeing
If your website runs on PHP, and most small business sites, blogs and WordPress installs do, this week’s news is directly about you. On October 21, 2026, the PHP project shipped emergency fixes for two critical flaws nicknamed PHP2Shell. This guide skips the drama and walks through what to check, in order.
What actually happened
Two bugs in the PHP runtime itself, CVE-2026-109618 and CVE-2026-109619, let an attacker with no login run code on a server. Both are rated 9.2 on the CVSS v4.0 scale. Because the problem sits in the engine and not in any one plugin or theme, a site can be well written and still be exposed. The Hacker News reports that nearly every PHP version back to 5.4 is affected, across PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.
Security firm watchTowr reported active exploitation attempts from October 21. As of its October 22 update, neither flaw was in CISA’s Known Exploited Vulnerabilities list, and no source I found has reported a confirmed break-in. Treat that as a short window, not as safety.
Step 1: Find your PHP version
In most hosting panels the PHP version sits under a section called Select PHP Version, MultiPHP Manager or Software. In WordPress, Tools, then Site Health, then the Info tab, shows the PHP version under Server. Write it down.
Step 2: Compare it with the fixed releases
The patched versions, per watchTowr’s FAQ, are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 7.4, 8.0 and 8.1 have no official release, only source backports and vendor packages. PHP 7.3 and older, including PHP 5, have no fix at all.
If you are on one of those older branches, the honest answer is that you need to move to a supported branch, and the sooner the better.
Step 3: Ask your host, and restart workers
On shared hosting you usually cannot patch PHP yourself. Open a ticket and ask two plain questions: has the server been updated to a fixed release, and have PHP workers been restarted? The restart matters, because the fix does not take effect until workers reload.
Step 4: Do not rely on settings alone
PHP lists some stop-gaps, such as disabling session upload progress with session.upload_progress.enabled=0 and keeping post_max_size low. The advisory is clear that only updating is a complete fix, and that configuration changes block confirmed paths but not every variant. Use them only as a bridge while you wait for your host.
Step 5: If you cannot patch yet
The Belgian Centre for Cybersecurity advised taking websites offline if the update cannot be installed, as Brussels Times reported. For a small site, a cheaper middle path is restricting access with a firewall or putting the site behind a service that filters requests, then patching as soon as the host allows.
After the patch
Once the version is confirmed, spend ten minutes on hygiene: review admin users for accounts you do not recognise, check that backups ran and are restorable, and note the date and version you updated to so you have a record. Then book a recurring reminder to check your PHP version each quarter.
If you look after websites for other people, our piece on how freelancers and agencies can turn the PHP2Shell scare into a maintenance service shows how to talk to clients about it. For the bigger picture, see what PHP2Shell says about AI and software security.
