PHP2Shell: what the new PHP flaw means for your website, without panic

Since October 21, 2026, security updates exist for two serious flaws in PHP. PHP is the programming language behind a great many websites, WordPress among them. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and the press calls them “PHP2Shell”.

What happened?

Both flaws can let attackers run their own code on a web server without logging in. A working attack is known. According to media reports, Amazon saw a first attempt four days before the public announcement. That sounds dramatic, but it is very manageable: the PHP developers have closed the holes.

Does it affect you?

The server is affected, not your design or your texts. If your website runs on PHP, you should ask. Important: updating WordPress or plugins is not enough, because PHP itself has to be updated on the server. Your hosting provider usually does that.

The flaw sits in the server, not in your website. That is why only a PHP update helps.

What you can do today

1. Ask your hosting provider or agency which PHP version you are running.
2. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or newer.
3. Still on PHP 8.1 or older? These versions are no longer officially supported. Ask for a move to a current version.
4. Get written confirmation of when the update was applied.

A firewall in front of your site, such as Cloudflare, adds protection but does not replace the update.

How we help

Days like this are what our Care plan is for: we keep an eye on updates, backups and monitoring, so you do not have to read security bulletins. And if you only want to know whether your website is affected, we can look together.

Not sure whether your site is affected? Let's talk for 30 minutes, free of charge.

As of October 24, 2026. The situation may change, so please also check your hosting provider's notices.
Sources: Help Net Security, Cloudflare.