PHP2Shell: What Small-Business Website Owners Need to Know

Last verified: October 26, 2026, 7:30 PM ET. We'll update this page if the facts change.

Short answer

If your website runs on PHP, which includes WordPress and many other website platforms, it is probably affected until it's updated. On October 21, 2026, PHP released fixed versions: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Ask your host which PHP version your site runs. If it's older than the fixed version for its release line, or older than PHP 8.2, it needs attention. CISA now lists both flaws as exploited, so it's worth checking this week.

What happened

On October 21, 2026, the PHP project released emergency updates for two critical flaws, CVE-2026-109618 and CVE-2026-109619. Together they're known as "PHP2Shell." Each is rated 9.2 out of 10 on the CVSS v4.0 severity scale.

PHP is the software that runs underneath WordPress, Drupal, Joomla and many small-business websites. The flaws can let an attacker run their own code on a web server without logging in. In some setups the attack works before the website's own code even starts. The PHP team says the risk is highest on servers using Apache with mod_php.

How it was found

The researchers were from Calif, working with OpenAI and Wiz. They found the flaws during an AI-assisted security review of PHP, done as part of OpenAI's "Patch the Planet" initiative with the PHP Foundation. According to Calif's write-up, researcher Ryan Austin started from a type of bug first described back in 2004. A related issue was reported in 2020 and noted again in a 2024 audit, but no one had proven it could be exploited.

Calif reports finding the first working path on August 1, 2026, and reporting it to PHP on August 11. Fixes came out on October 21, 2026, a day after PHP gave public notice that a critical release was coming.

News reports say some details leaked before the release. Amazon says it saw a related attack attempt on one of its decoy servers ("honeypots") on October 17, four days before the patch.

Who is affected

Any website running PHP, on every common server setup: Apache mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.
Every PHP version from 5.4 onward, according to the researchers, up to the patched releases.
PHP 8.1 and older no longer get official updates. PHP published minimal source patches for 7.4, 8.0 and 8.1, and some hosts and Linux vendors offer their own fixes. For most sites, though, the real fix is moving to a supported version.

Is it being exploited? CISA lists both flaws as exploited. On October 26 it added them to its Known Exploited Vulnerabilities list and set October 29 as the deadline for federal agencies to fix them. Attackers were probing for the flaws before the patch. Amazon saw an attempt on October 17, and on October 24 a researcher reported working attacks on honeypot servers set up to be easy targets. We have no information about any specific business being hit. If your site runs PHP, this is worth checking this week, not someday.

The fix: what to do today

Do the two-minute check. Ask your host or web person one question: "What PHP version is my site running, and does it include the October 21 security update?"
If it's 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer in its branch, you have the PHP2Shell fix. That covers these two flaws, not everything else a site can be exposed to.
If it's an older 8.2–8.5 release, ask your host to update it now. Most managed hosts handle this for you.
If it's 8.1 or older, ask your host about an upgrade to 8.3 or newer, and test your site after the switch. Also, 8.2 reaches end of life on December 31, 2026, so 8.3 or newer is the better target.
Can't update right away? Ask your host whether they've applied PHP's published temporary settings or a web application firewall rule. These lower the risk but don't fix the flaw. PHP's October 23 advisory also suggests turning off the `session.upload_progress.enabled` setting until the next release. That's a partial measure, not a fix.
Keep WordPress, themes and plugins up to date as usual. It doesn't fix this flaw, but it closes other doors.

What High Power does for care-plan clients

On the hosting we manage for care-plan clients, keeping PHP current is our job, not yours. We keep those sites on supported PHP versions, and we apply emergency PHP security updates on the servers we manage. While an update is rolling out, we use PHP's published temporary settings where they fit. Those lower the risk but aren't a fix, so the update still comes first. If your site is with a host we don't manage, we'll help you get a straight answer from them.

Not sure where you stand?

Call or text (757) 869-4742, or email contact@highpower.tech. We'll help you find out which PHP version your site runs and what to do next.

Sources

PHP.net security advisory and release notes, Oct 20–26, 2026: https://www.php.net/archive/2026.php
CISA alert, revised Oct 23, 2026: https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
Calif Research, "PHP2Shell": https://calif.io/php2shell/
Amazon Threat Intelligence, Oct 21, 2026: https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/
SecurityWeek, Oct 26, 2026: https://www.securityweek.com/php2shell-exploitation-moves-from-probes-to-working-shells/
CSA Singapore AL-2026-151: https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-151/