Exploited now
What is PHP2Shell,and is my website affected?
Two serious flaws in PHP, the language behind WordPress and many small business websites. Here is what they are and what to check, in plain English.
In short
A flaw in PHP itself.Fixed, and being used in attacks now.
-
What it is
Two flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619). On a server without the fix, an attacker can run their own code with no login.
-
Who it affects
Websites running PHP from before the fix. That includes many WordPress, Joomla and Drupal sites, and many sites on shared hosting.
-
How urgent
PHP fixed them on 21 October 2026. Attackers are already using them, and the US government's cyber security agency has listed both as actively exploited since 26 October.
Fixed versions
Is your PHP new enough?One line per version.
Find your PHP version's first two numbers in the list. Your site needs at least the version next to it.
- PHP 8.58.5.12 or newer
- PHP 8.48.4.27 or newer
- PHP 8.38.3.36 or newer
- PHP 8.28.2.35 or newer
- PHP 8.1 and olderNo official fix. Move to a newer PHP, or ask your host whether they patched their own build.
Your version
Three ways to find it.A couple of minutes.
- Run our free PHP2Shell check. If your site shows its PHP version, you'll see it in seconds. Many sites hide it, which is good practice.
- On WordPress, open Tools, then Site Health, then Info, then Server. Or look in your hosting control panel for PHP version.
- Ask your host. You can copy this message:
Hi, is my website on PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer, or on a build with the PHP2Shell fixes (CVE-2026-109618 and CVE-2026-109619)? Have you also applied PHP's advice of 23 October 2026?
Next
Too old? Update PHP.Then check the rest.
Most hosts let you choose a newer PHP version in the control panel, or will update it for you. Test your site afterwards, because very old themes and plugins sometimes need an update first.
PHP is rarely the only thing out of date.
Our full website check looks for outdated software, including PHP, and flaws attackers are known to use, with plain-English steps.
Start with the free PHP2Shell checkIs PHP2Shell the same as a WordPress problem?
No. It is in PHP, the language WordPress and many other sites run on. Updating WordPress or its plugins doesn't fix it. PHP itself needs the update.
My site is on shared hosting. What should I do?
Your host runs PHP for you. Ask them which version your site uses, and choose a fixed one in your control panel if they offer it.
Does a fixed version mean I'm in the clear?
Not on its own. It means this flaw is fixed. Other software on your site can still be out of date, so it is worth checking the rest too.
What if my site was attacked already?
Updating PHP stops new attacks through these flaws, but it doesn't undo one that already happened. If you see files you don't recognise, new admin users or strange redirects, ask your host or a security specialist for help.