PHP2Shell Vulnerability: Is Your PHP Website at Risk?

Two critical PHP security vulnerabilities, collectively known as PHP2Shell, have prompted urgent updates for websites running affected versions of PHP. Identified as CVE-2026-109618 and CVE-2026-109619, these vulnerabilities could allow attackers to execute malicious code on vulnerable web servers without needing login credentials.

The PHP development team released emergency security updates on 21 October 2026 (22 October AEDT). Security researchers also reported active attempts to exploit both vulnerabilities shortly after the patches became available, reinforcing the need for website owners and administrators to act promptly.

For businesses using WordPress, Drupal, Joomla, Magento or other PHP-based platforms, the immediate priority is to check whether their hosting environment is running a patched version of PHP.

What Is PHP2Shell?

PHP2Shell refers to two critical vulnerabilities affecting PHP, a server-side programming language used to power many websites and web applications.

PHP handles important website functions, from processing forms and retrieving database information to generating dynamic pages. Because PHP operates on the server, vulnerabilities within it can affect a website's underlying infrastructure rather than just its visible features.

The two vulnerabilities are:

• CVE-2026-109618: A memory-handling vulnerability involving out-of-memory conditions that could lead to remote code execution.
• CVE-2026-109619: A vulnerability involving PHP's handling of temporary global state, potentially allowing attackers to execute code through information retained between requests.

Both vulnerabilities received critical severity ratings of 9.2 under CVSS 4.0.

How Could PHP2Shell Affect a Website?

Successful exploitation could allow an unauthorised attacker to execute code on a vulnerable web server. Depending on the server's configuration and permissions, this could result in:

• Unauthorised access: website files and server resources.
• Malware installation: malicious scripts or backdoors placed on the server.
• Data exposure: sensitive website or customer information.
• Disruption: website defacement, outages or downtime.
• Wider compromise: applications and services connected to the affected server.

These are potential consequences, not an indication that every website using PHP has been compromised.

With active exploitation attempts already reported, these vulnerabilities present an immediate security concern for websites running affected PHP installations. Applying the appropriate security patches promptly is essential to reducing exposure.

Which PHP Versions Are Affected by PHP2Shell?

PHP2Shell affects vulnerable PHP installations that have not received the security fixes released on 21 October 2026. The PHP development team published the following patched versions:

Websites running earlier versions within these branches should be reviewed and updated where necessary.

PHP 8.1 and older versions no longer receive official security releases from the PHP project. Websites using these versions should plan an upgrade to a supported PHP release, although some hosting providers and Linux distributions may offer backported security fixes. PHP 8.2 also reaches its end of security support on 31 December 2026, making future upgrade planning important even after the current vulnerabilities have been addressed.

Important: Some Linux distributions and hosting providers apply security fixes to existing PHP packages without changing the version number displayed. If your PHP version appears outdated, confirm its patch status with your hosting provider before assuming the server is vulnerable.

How Can You Check if Your Website Is Vulnerable to PHP2Shell?

To check whether your website may be exposed to PHP2Shell, identify the PHP version used by your hosting environment and confirm that the appropriate security patch has been installed. The checking process depends on how your website is hosted.

1. Check Your PHP Version in WordPress

If your website uses WordPress, you can usually find its PHP version through the administration dashboard.

1. Log in to your WordPress dashboard.
2. Navigate to Tools > Site Health.
3. Select the Info tab.
4. Expand the Server section.
5. Locate the PHP version information.

Compare the version displayed against the patched releases listed above.

This information identifies the PHP version reported by WordPress. It does not necessarily confirm whether your hosting provider has applied a backported security patch.

2. Check Your Hosting Control Panel

If you use cPanel, Plesk, CloudPanel or another hosting management platform, your PHP configuration may be available through the control panel. Look for PHP version management, server settings or software information.

The exact location varies depending on the hosting provider and server configuration.

3. Confirm the Patch Status With Your Hosting Provider

If your website uses shared or managed hosting, your hosting provider may be responsible for installing PHP security updates. Contact their support team and ask:

"Has the PHP environment hosting our website been patched against CVE-2026-109618 and CVE-2026-109619?"

You should also confirm whether any action is required on your end.

4. Review Your Website for Signs of Compromise

Applying a patch addresses the underlying vulnerability, but it does not automatically remove malicious changes made before the update. Where exposure is suspected, a technical review may need to examine:

• Logs: unusual website or server log activity.
• Files: unexpected changes to website files.
• Accounts: unrecognised administrator accounts.
• Code and data: suspicious scripts, redirects or database changes.
• Alerts: malware scan results and recent security alerts.

These checks should be handled by someone familiar with the website's infrastructure. A website appearing to function normally does not, by itself, rule out a security issue.

How Do You Protect Your Website Against PHP2Shell?

The primary protection against PHP2Shell is to install the appropriate PHP security update. Additional website security measures remain important, but they do not replace patching the vulnerable software.

Update PHP to a Patched Version

Check which PHP release your website currently uses and arrange for the relevant security update.

Where PHP is managed directly on a VPS or dedicated server, the server administrator should install the appropriate packages and confirm that the services handling website requests are running the patched software. For shared and managed hosting, coordinate with the hosting provider.

Avoid changing PHP versions without considering compatibility. Older websites, themes, plugins and custom applications may require testing before moving to a newer PHP branch.

Test Your Website After the Update

PHP updates can affect website features that depend on specific versions or extensions. Once the update has been applied, check important functionality such as:

• Forms: contact forms and enquiry submissions.
• Accounts: login and account features.
• Ecommerce: shopping carts, checkout and payments.
• Integrations: booking systems and third-party tools.
• Custom features: bespoke functionality and database connections.

Where practical, major version upgrades should be tested in a staging environment before deployment to the live website.

Maintain Reliable Website Backups

A current, restorable backup provides an important recovery option if an update causes compatibility issues or a security incident affects website files or data.

Backups should include the relevant website files and databases, be stored securely, and be tested periodically to confirm they can be restored.

However, restoring a backup alone does not fix a vulnerable PHP installation. The underlying security issue must also be addressed.

Continue Security Monitoring

After updating PHP, maintain appropriate monitoring for suspicious activity, malware, unexpected file changes and website availability.

Security patches address known vulnerabilities, while monitoring helps identify potential issues that require investigation. Neither measure guarantees that a website cannot be compromised, but together they provide a stronger approach to managing website security.

Why Aren't WordPress and Plugin Updates Enough to Prevent PHP2Shell?

Updating WordPress, plugins and themes does not automatically patch vulnerabilities in PHP because PHP operates at a different layer of the website's technology. A WordPress website generally relies on several components working together:

Keeping WordPress updated remains essential, but it is only one part of maintaining a secure website. A website may have the latest WordPress version and fully updated plugins while still relying on an outdated or vulnerable PHP installation.

This is why website maintenance needs to extend beyond the WordPress dashboard to include the hosting environment and supporting software.

Why Is Ongoing Website Maintenance Important for Security?

PHP2Shell demonstrates how quickly a newly disclosed vulnerability can create urgent maintenance requirements.

When a critical security update becomes available, website owners need to know which systems are affected, who is responsible for installing the fix and how to confirm that their website continues to operate correctly afterwards. A structured website maintenance process helps address these requirements through:

• Software and security updates: keeping website applications, supporting software and hosting components current.
• Vulnerability monitoring: reviewing relevant security advisories and identifying updates that require attention.
• Hosting coordination: working with hosting providers when security patches fall outside the website owner's direct control.
• Backups and recovery planning: maintaining reliable restoration options if an update fails or an incident occurs.
• Website testing: confirming that forms, transactions, integrations and essential features continue working after changes.
• Maintenance records: tracking software versions, update activity and outstanding security issues.

These activities support more consistent security management and reduce the likelihood of known vulnerabilities being overlooked.

The objective is not simply to react when a major incident makes the news, but to maintain a clear process for identifying and addressing security risks throughout the year.

Get Professional Support With PHP Updates and Website Security

Keeping a website secure involves more than updating its content management system. PHP versions, server configurations, security patches, backups and ongoing monitoring all contribute to the website's overall security.

At WebMaintenance, we provide website maintenance services for Australian businesses, including software updates, security monitoring, backups, website testing and hosting coordination.

If you're unsure whether your website has received the PHP2Shell security updates, or need assistance maintaining its underlying software, our team can help you review the situation and determine the appropriate next steps.

Contact WebMaintenance to discuss your website's security and maintenance requirements.

References

• PHP official website: Security releases, 21 October 2026
• Tenable: PHP2Shell frequently asked questions about critical PHP vulnerabilities
• NHS England: Critical vulnerabilities in PHP (PHP2Shell)
• Ubuntu: PHP2Shell vulnerability fixes available
• watchTowr: PHP Remote Code Execution (PHP2Shell)