PHP2Shell: What to Do If Your Site Runs on PHP

Short answer: PHP2Shell is a pair of critical vulnerabilities in the PHP engine itself (CVE-2026-109618 and CVE-2026-109619), affecting almost every version from 5.4 to 8.5. How clean your application code is doesn't matter; the only fix is updating PHP: 8.2.35, 8.3.36, 8.4.27 or 8.5.12, then restarting the PHP service. On shared hosting, your hosting provider has to do it.

This guide walks through how to tell whether your site is at risk, what to do on a dedicated server or shared hosting, and what temporary measures exist if you can't update right away.

What is PHP2Shell, and what happened?

• October 21, 2026: the PHP team shipped fixed releases. Public disclosure was planned for the next day, but details leaked and the release was moved up.
• How it was found: researchers used AI models to turn the bugs into a full exploit. One of them had been known since 2024 but was deprioritized because building an exploit for it looked infeasible.
• Impact: an attacker can run code on the server without logging in. Exploitation attempts were reported from the day the patch came out, and several government sites in Europe and Canada went offline temporarily.

To be fair: Sansec reports that the current public exploits don't work against a default PHP installation and most need another bug in the application. So it isn't "everyone gets hacked", but given how fast new exploits are built now, waiting isn't sensible either.

Is my site affected?

If your site runs on PHP, almost certainly yes, unless you already have a fixed version. That includes WordPress, WooCommerce, Laravel, Joomla, Magento and every other PHP site, because the problem is in the PHP engine, not in plugins or your code.

It doesn't matter whether PHP runs as PHP-FPM, Apache mod_php, LiteSpeed or FrankenPHP; all are affected. According to PHP, the highest risk is Apache mod_php.

How do I find my PHP version?

On hosting with a control panel (cPanel, DirectAdmin, Plesk): a section such as "Select PHP Version" or "MultiPHP Manager" shows it.

On your own server: note that php -v shows the command-line version, which can differ from the one serving your site. The reliable way is a temporary file:

<?php echo PHP_VERSION;

Open it in the browser, read the version and delete it immediately.

If PHP comes from your Linux distribution, the version number may not change even though the fix is applied. Check the package changelog:

# Debian / Ubuntu
zgrep CVE-2026-109618 /usr/share/doc/php*/changelog.Debian.gz

# AlmaLinux / Rocky / RHEL
rpm -q --changelog php-common | grep CVE-2026-109618

A match means the fix is installed.

Fix on a dedicated server or VPS

1. Update the PHP packages:

# Debian / Ubuntu
sudo apt update && sudo apt install --only-upgrade 'php*'

# AlmaLinux / Rocky
sudo dnf upgrade 'php*'

1. Restart the PHP service. Already-running workers still have the old code:

sudo systemctl restart php8.3-fpm   # use your version
sudo systemctl restart apache2      # if you use mod_php

1. On PHP 8.1 or older there will be no new official release. Use your distribution's patched packages (for example Ubuntu 22.04 for PHP 8.1, the Remi repository or CloudLinux), or better, upgrade to PHP 8.2 or later now.

Fix on shared hosting

You can't touch PHP itself on shared hosting, so this is your provider's job. Send support something like:

Hello. Regarding the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), please confirm that the PHP version on my hosting server has been updated to a fixed release (8.2.35, 8.3.36, 8.4.27 or 8.5.12, or an equivalent backport) and that the PHP service has been restarted.

Meanwhile, if your panel lets you pick a PHP version, switch the site to the highest version it works with (back up first). If your host still only offers old PHP 7.x, it's time to change hosts.

If I can't update yet

The PHP team states plainly that no configuration change fully mitigates this; updating is the only fix. The following only reduce risk and must be temporary:

• Block multipart/form-data requests, the path this attack comes in through. In nginx:

nginx if ($http_content_type ~* "multipart/form-data") { return 403; }

This breaks file uploads and some forms (product image uploads, some checkout forms); test your important forms afterwards.
- Disable session.upload_progress.enabled in PHP's settings. Not enough on its own, only together with the above.
- A web application firewall (WAF): some CDN and WAF services have added rules for this attack. Ask yours, but this doesn't replace updating either.

How do I know if I was already compromised?

No official indicators of compromise (IoCs) have been published yet. General checks worth doing after any code-execution vulnerability:

• New PHP files in folders that shouldn't contain PHP, such as uploads:

bash find /var/www -name "*.php" -newermt "2026-10-15" -path "*upload*"

• A new, unknown admin user in your site's panel (for example in WordPress).
• Unknown scheduled jobs (cron) on the server.
• Sudden spikes in PHP memory use in your logs; this attack works by exhausting memory.

If you find something suspicious, updating isn't enough: rotate passwords and keys (database, API, panel) and, if possible, restore from a clean backup taken before the intrusion.

The bigger lesson: "not exploitable" no longer means safe

One of these bugs was found two years ago and set aside because nobody thought it could be exploited. This time AI made that "hard" cheap. For anyone running sites and servers, that means two things:

1. The gap between a patch and the first attacks is now hours, not days. Security updates can't wait for the weekend.
2. Old versions are real debt. A site still on PHP 7 is the first place a fix never arrives.

FAQ

Does updating WordPress or plugins fix it?
No. The problem is in PHP itself, and only updating PHP fixes it.

My site is Laravel. Am I affected?
Yes. Anything running on PHP is affected, regardless of framework.

My site is behind a CDN. Am I safe?
Risk is lower if the CDN has enabled a rule for this attack, but it doesn't replace updating.

Anything else after updating?
Restart the PHP service and use the temporary PHP_VERSION file to confirm the site really runs on the new version.

What about Python, Django or Node.js sites?
This vulnerability is PHP-only. Node.js did ship important security fixes the same day, though, so update that too.

Sources

• PHP2Shell on Wikipedia
• Sansec technical analysis
• watchTowr FAQ
• The Hacker News report