PHP2Shell is the name given to two critical flaws in PHP (CVE-2026-109618 and CVE-2026-109619), the language that runs WordPress, WooCommerce and most business websites. They let an attacker run code on a web server without logging in. PHP fixed them on 21 October 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and attacks started the same day. To protect your website: check which PHP version it runs, make sure your host has installed the fix (some hosts keep the old number but add the patch), update WordPress and every plugin, look for signs of intrusion, and keep a recent backup outside the server.
This guide is written by Kolchi In One (KIO), a digital agency that builds and maintains websites, CRMs and AI agents for clients in the Middle East, Europe, Asia and North Africa. We ran this exact check on our own site and on the sites we look after the week the flaw was announced.
Why business owners around the world are searching for it
On Google Trends worldwide, “php2shell” went from nothing to a Breakout search in a few days. The countries searching it most are Austria, China, Luxembourg, Switzerland, the Netherlands, Hong Kong, Germany and Singapore. Related searches tell the same story: “php critical vulnerability”, “php vulnerability patch” and “cve-2026-109618” are all Breakout, and “wordpress php update” is up more than 2,700%. From Dubai to Amsterdam to Casablanca, business owners heard that websites are under attack and want to know one thing: is mine safe?
What PHP2Shell is, in plain words
PHP is the engine behind most websites you visit: every WordPress site, WooCommerce shops, PrestaShop, many school and booking systems, and a lot of custom platforms. The two flaws sit inside PHP itself, not inside WordPress or a plugin. A specially crafted request can make the server run the attacker’s code before your website’s own code even starts. That is why security teams rated them 9.2 out of 10.
- Announced and fixed: 21 October 2026, with an official PHP security advisory and four fixed releases.
- Attacks: Amazon’s threat team recorded an attempt on 17 October, four days before the announcement. Security companies reported attack attempts in the wild from the day of disclosure, and Cloudflare saw attempts climb into the millions within a day.
- Who is concerned: every website that runs PHP, on shared hosting, on a VPS or on a dedicated server.
Is your website affected?
If your website runs on WordPress, the answer is yes, it uses PHP. What matters is whether the PHP on your server already has the fix.
- Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer.
- Hosting companies that patch for you: many shared hosts (for example those running CloudLinux) add the fix to their own build and keep a lower number, such as 8.3.35. The number alone does not prove you are vulnerable; your host can confirm.
- PHP 8.1, 8.0, 7.4 and older: these versions no longer get official releases. If your site still runs one of them, plan an upgrade now.
The 10-minute check for business owners
- Find your PHP version. In WordPress, go to Tools, Site Health, Info, then the Server section. You can also see it in your hosting panel (hPanel, cPanel or Plesk) under PHP configuration.
- Ask your host one clear question. “Is the PHP version used by my website patched for CVE-2026-109618 and CVE-2026-109619?” A good host answers with a yes and the date. If they cannot answer, switch to a fixed version in your panel or ask your agency to do it.
- Update WordPress, plugins and themes. Updating WordPress does not fix a PHP flaw, but attackers who scan for PHP2Shell also try old plugins at the same time. Remove plugins you no longer use.
- Look for signs of intrusion. Check Users for any administrator you do not know, the plugin list for anything you did not install, and your hosting file manager for PHP files inside the uploads folder. Watch for redirects to strange sites, a Google “this site may be hacked” warning or a malware alert from your host.
- Keep a backup outside the server. A copy of the database and files on your own computer or cloud drive, not only on the same hosting account.
- If anything looks wrong: change the WordPress, hosting and database passwords, turn on two-factor login for every admin, and ask a professional to clean the site before you put it back online.
What a security plugin can and cannot do
Security plugins and firewalls like Wordfence or Cloudflare can block known attack patterns and warn you about changed files. That helps, but the PHP team is clear: no setting fully protects an unpatched server. Only the updated PHP does. Think of the plugin as an alarm and the PHP update as the lock.
One more advisory to know about
On 23 October PHP published a smaller advisory about a feature called session upload progress, recommending hosts turn it off until the next release. It concerns unusual server setups and has not been reported under attack. Your host handles it at server level; you do not need to touch your website for it.
What we did at KIO
When the flaw was announced, we checked our own website and the sites we host on the same day: PHP build confirmed patched by the host, WordPress core files verified against the official checksums, plugin files verified, administrator accounts reviewed, recently changed files inspected and no PHP files found in uploads. Nothing was compromised. Then we updated the remaining plugins, with a full backup taken first.
If you do not have time to do this yourself, or your site was built by someone you cannot reach anymore, this is exactly the kind of maintenance we do. Our checklist for choosing who looks after your site is in our 10-point checklist for choosing a digital agency, and if you are thinking of rebuilding on something more robust, read Website, Web App or Mobile App: What Should Your Business Build in 2026? and see our services.
Frequently asked questions
Does updating WordPress fix PHP2Shell?
No. The flaw is in PHP, the server software under WordPress. Your host or your agency must install the fixed PHP. Updating WordPress and plugins is still important because attackers try both at once.
How do I know which PHP version my site uses?
In WordPress: Tools, Site Health, Info, Server. In your hosting panel: the PHP configuration or PHP version page.
My host shows PHP 8.3.35. Am I safe?
Possibly. Several hosts add the fix to their own build without changing the number. Ask them to confirm in writing that your PHP is patched for CVE-2026-109618 and CVE-2026-109619.
How do I know if my website was hacked?
Common signs are unknown administrator accounts, plugins you did not install, PHP files in the uploads folder, visitors redirected to other sites, spam pages in Google results, or a warning from your host or Google. Some attacks stay silent, which is why a file check matters.
Can KIO check my website?
Yes. We check the PHP version and patch, WordPress and plugin files, admin accounts and suspicious files, take a backup first, and tell you in plain words what we found. Write to us on WhatsApp at +212 688 445 399 or through the contact page for a free 15-minute call.
