PHP2Shell Explained: Who Needs to Patch Your Website, and How

On October 21, 2026, a critical security flaw was disclosed in PHP, the programming language behind roughly three out of four websites. Government sites in the Netherlands, France, and Canada were taken offline as a precaution, and South Korea’s KISA (Korea Internet & Security Agency) issued emergency guidance. The security community calls it PHP2Shell.

The good news: patches are out, and most major hosting companies have already applied them. The catch is that who patches your site depends entirely on how it’s hosted. This guide covers who needs to act right now, which patches are available, and how the major hosts handled it.

Key Takeaways

• PHP2Shell is two critical remote code execution flaws in PHP itself (CVSS 9.2) that can be exploited without logging in.
• Updating WordPress or plugins does not fix it. PHP itself must be patched.
• Patched versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35 or later. PHP 8.1 and older have no official release.
• On shared or managed hosting, your host patches PHP, but you should verify it. On a VPS or dedicated server, you must patch it yourself and restart PHP.
• A third flaw (CVE-2026-115560) has a temporary fix: session.upload_progress.enabled = 0.

What Is PHP2Shell?

PHP2Shell is the name for two remote code execution (RCE) vulnerabilities found in the PHP core.

• CVE-2026-109618: a memory corruption flaw triggered by abusing out-of-memory conditions
• CVE-2026-109619: a flaw that reuses freed global state

Both are rated CVSS 9.2 out of 10, and the scariest part is that they can be exploited without logging in and without an account. The flaws live in PHP’s own request handling, not in WordPress or a plugin, so the attack works before your site’s code even runs. Keeping WordPress fully up to date won’t help if PHP itself isn’t patched.

Virtually every PHP version since 5.4 is believed to be affected, and according to W3Techs, about 75% of websites with a known server-side language use PHP. The flaws were found by security firms Calif and Wiz during analysis with AI models (OpenAI GPT-5.6 Sol and Google Gemini 4 Argon) and reported to the PHP team in August. Details leaked while the patches were being prepared, which pushed disclosure up by a day. Real attack attempts started on disclosure day, and Cloudflare reported millions of them. No large-scale successful breach has been confirmed yet, but attack tools keep getting better, so “we haven’t been hit yet” is no reason to relax.

Then on October 23, a third related flaw, CVE-2026-115560, was disclosed. It only works under specific configuration combinations, so the PHP team recommends a temporary workaround instead of an emergency patch. Details are in the patch section below.

Who Needs to Act?

It all comes down to one question: “Who manages PHP on my site?” The answer decides what you need to do.

Which Patches Are Available?

Official Patches (October 21, 2026)

If you run your own server, updating through your distribution’s packages is the usual route. Ubuntu, Debian, AlmaLinux, Amazon Linux, and others have already shipped patched packages.

# Debian / Ubuntu example
sudo apt update
sudo apt upgrade php8.3-fpm php8.3-cli php8.3-common
sudo systemctl restart php8.3-fpm

If you skip the restart, the patch is not applied. If you update the packages but don’t restart PHP-FPM or Apache, the old PHP still loaded in memory keeps handling requests. KISA’s guidance warns about this explicitly. If you use the Remi repository on a CentOS-family system, note that Remi had no update on disclosure day, so consider your distribution’s default packages or building PHP yourself.

PHP 8.1 or Older: Backports

PHP 8.1, 8.0, and 7.4 have reached end of life, so there are no official patch releases. You still have options.

• The PHP team published minimal source patches (backports) for 7.4, 8.0, and 8.1. You can apply them if you build PHP yourself.
• The Ubuntu and Debian packages from Ondřej Surý’s repository include backports for 5.6 through 8.1.
• Some hosts (Hostinger, 20i, xCloud, and others) shipped their own patched builds, including older versions. Check whether your host offers a backport first.

Backports are only a stopgap, though. This is a good time to move to PHP 8.3 or later.

Third Flaw CVE-2026-115560: Temporary Fix Until the Patch

The third flaw, disclosed on October 23, involves PHP’s session upload progress feature. It’s hard to trigger with typical settings, so there’s no emergency patch. The fix will ship in the next regular release. Until then, the official workaround is a single setting:

; Add to php.ini or your PHP-FPM pool config, then restart PHP
session.upload_progress.enabled = 0

Unless your site shows an upload progress bar, you lose almost nothing. As the hosting table below shows, major hosts have already turned this off at the server level.

Temporary Mitigations Before Patching (Not a Full Fix)

• Turn off session.upload_progress: Same as above. It blocks one known attack path for CVE-2026-109619.
• Cloudflare WAF rules: Cloudflare applied emergency rules to all plans, including Free, just before disclosure. But Cloudflare itself says this is “temporary protection, not a replacement for patching,” and bypass attempts have already been seen.
• Your host’s firewall rules: Tools like ModSecurity block attack patterns in front of the server. They buy time but don’t fix the root problem.

The PHP team’s official position is clear: “There is no complete mitigation. Updating is the only safe option.”

How Major Hosting Companies Responded

Fortunately, the well-known hosts moved quickly. Below is each company’s status, based on its official announcements. The common pattern: block attacks with firewall rules and settings first, then roll out the patch to every server as soon as it was released.

Each host’s status keeps changing, so if your host isn’t listed or you’re not sure where it stands, check its status page and announcements directly. Put the other way around: if your host has stayed silent with no announcement at all, that in itself is a warning sign.

How to Check Your Site (3 Minutes)

1. Check your PHP version: In WordPress, go to Tools → Site Health → Info → Server and look at the PHP version.
2. Compare it with the patched versions: 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 or later means you’re patched.
3. Don’t assume a lower number means you’re exposed: Some hosts, like Hostinger, keep the version number and patch the build instead. In that case, the test is whether the Build Date in your hosting panel’s PHP Info is October 21, 2026 or later.
4. On PHP 8.1 or older: Check your host’s announcements, or ask whether they provide a backport. If they don’t, schedule an upgrade.
5. On a VPS or dedicated server: Run php -v in the terminal, and make sure it matches the PHP your web server actually uses (as shown by phpinfo). Several PHP versions often coexist on one server.

Patching Isn’t the End: Post-Patch Checks

A patch only blocks future attacks. If your site was compromised before you patched, the patch won’t undo it. Because the details leaked before the patch and attacks started before disclosure, KISA recommends the following:

• Review logs: Check web server and PHP logs for suspicious requests, including the period before you patched.
• Look for web shells: Check for recently created or modified PHP files, unknown admin accounts, and unfamiliar cron jobs.
• Rotate credentials: On servers that were exposed, change database passwords, API keys, and admin passwords.
• Secure your backups: Keep tested, restorable backups from before and after patching in an off-site location.
• If you find signs of a breach, don’t restart the server (you’ll lose the evidence in memory). Cut off network access and report it to a professional.

Final Checklist

• Confirm your site’s PHP version and who manages PHP for you
• Verify you’re on a patched version (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35) or that the build date is October 21 or later
• On a VPS or dedicated server, update PHP yourself and always restart the PHP service
• On PHP 8.1 or older, check for a backport and plan an upgrade to 8.3 or later
• Disable session.upload_progress for the third flaw (or confirm your host has)
• Review logs and look for web shells from the period before you patched
• Include forgotten test, staging, and event sites in your inventory

Frequently Asked Questions

Does updating WordPress protect me from PHP2Shell?

No. The flaws are in PHP itself, not in WordPress or plugins. Only a patched PHP build protects your site.

I’m on shared hosting. Do I need to do anything?

Your host usually patches PHP for you, but verify it. Check that your PHP version is patched, or that the PHP build date is October 21, 2026 or later.

Is Cloudflare enough to keep my site safe?

No. Cloudflare’s WAF rules are temporary protection, and bypass attempts have already been seen. Your origin server still needs the PHP patch.

Are non-PHP platforms like Wix affected?

No. PHP2Shell is a flaw in PHP on the server, so platforms that don’t run on PHP, like Wix, and static sites are not affected.

Need Help?

If you run several sites or aren’t sure whether your host has patched, contact We Design Orange. We can help with everything from checking each site’s PHP version and build, to patching your VPS, looking for signs of compromise, and testing your site after a PHP upgrade.

This article summarizes public information as of October 23, 2026. It is technical information, not a security assessment or legal advice. Hosting statuses are based on each company’s official announcements and may change. If you suspect a breach, contact a security firm or your country’s computer emergency response team (CERT).