If your website runs on PHP, this week's news is about you. That includes WordPress, WooCommerce, Drupal, Laravel and most custom-built sites, including the one you are reading this on.
On 21 October 2026, the PHP team released emergency security fixes for two critical vulnerabilities nicknamed PHP2Shell. Here is what happened, in plain language, and what you should do about it today.
What is PHP2Shell?
PHP2Shell is a pair of flaws in the core of PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619. They are memory-safety bugs in the PHP engine. In the worst case, they let an attacker run their own code on your server without logging in. That is called remote code execution, or RCE, and it is the most serious category of web vulnerability.
The official severity score is 9.2 out of 10 (CVSS v4.0). Some security firms rated it a full 10.0.
Who is affected?
Almost everyone running PHP. The flaws affect versions from PHP 5.4 up to 8.5, so nearly every version released in the last decade is exposed in some way.
Because PHP powers a very large share of the web, the impact reaches far beyond developers. Several governments reportedly took websites offline while they patched.
Is it being exploited?
Yes. Amazon's threat intelligence team reported an exploitation attempt as early as 17 October, four days before the public fix. Security firm watchTowr observed attacks in the wild by 21 October. Details leaked on social media before the planned disclosure date, which forced the PHP team to release the patches earlier than scheduled.
The flaws were reportedly found with the help of AI tools, which is a reminder that attackers can use the same tools to find and exploit bugs faster than before.
Which PHP versions have the fix?
- PHP 8.5: fixed in 8.5.12
- PHP 8.4: fixed in 8.4.27
- PHP 8.3: fixed in 8.3.36
- PHP 8.2: fixed in 8.2.35
If you are on an older branch such as 8.1, 8.0 or 7.x, it may not get an official fix, so plan to upgrade to a supported version.
A third, separate RCE issue was disclosed on 23 October. It only affects applications configured in an unusual way, and PHP has not issued an extra release for it. Organisations are advised to apply a configuration mitigation instead.
What should you do today?
1. Find out your PHP version. Check your hosting control panel, or ask your developer. Look at the full version number, such as 8.3.35, not just 8.3. Version 8.3.35 is one patch behind the fix.
2. Update to a patched release. On shared hosting, the provider controls the exact patch level, so check their announcements or ask support when the fixed build will be live. Switching the PHP version in your panel only changes the major and minor version, so check the full version afterwards.
3. Test before you switch branches. Moving to a newer PHP branch can break old plugins and themes. Take a full backup first and test on a staging copy if you can.
4. Add a firewall layer. Cloudflare deployed temporary web application firewall rules against this flaw. A WAF is not a substitute for patching, but it can reduce risk while you wait.
5. Hide your PHP version. Turn off expose_php so your server does not advertise the exact version to every visitor.
6. Check for signs of compromise. Because attacks started before the patch, patching alone is not enough. Look for:
- PHP files you do not recognise, especially in upload, image, CSS or JavaScript folders
- Recently modified files you did not change
- Unexpected admin users
- Strange redirects, especially for visitors coming from Google
- Unusual outgoing email or spikes in server load
7. Keep backups off the server. A clean backup stored elsewhere is your fastest way out if something goes wrong.
The bigger lesson
Old, forgotten websites are the easiest targets. Many sites on the web have not been updated in years, and automated attacks do not care how small your site is. Updating regularly, keeping backups, and removing code you no longer use are the habits that protect you the next time something like this appears.
Need help?
I build and maintain websites for education, corporate and NGO clients. If you want a security check, a PHP upgrade, or a clean-up after a suspected hack, get in touch through abbaszaidii.com.
This article reflects information available on 23 October 2026. Details of this vulnerability are still developing, so check your hosting provider and the official PHP announcements for the latest guidance.
