PHP vulnerability (PHP2Shell): what website owners need to do now

In short: if your website runs on PHP, which includes every WordPress, WooCommerce, Drupal and Joomla site, update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or confirm your host's patched build) and restart it. If you cannot do that today, the US cyber agencies advise taking the site offline until you can. Last checked October 22, 2026.

What is the PHP vulnerability (PHP2Shell)?

PHP is the programming language that runs on the web server behind most websites. W3Techs finds it on 69.3% of websites whose server-side language it can detect, as of October 22, 2026. WordPress, WooCommerce, Drupal, Joomla, Magento and Laravel are all built on it.

On October 21, 2026, the PHP project released emergency fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell (also written php2shell). PHP rates both 9.2 out of 10 on CVSS version 4; NIST's National Vulnerability Database scores them 9.8 on CVSS 3.1. Both can let an attacker who has not logged in run code on the server with the web server's permissions. The second can also leak server memory, which researchers at Wiz say may include passwords, tokens and API keys from other requests.

The flaws are in PHP itself, not in WordPress or a plugin. In the NSA's words, they are "flaws in PHP itself, not in the hosted application or its configuration." That is why one patch, to PHP, matters to nearly every PHP website at once.

They were found independently by Calif, working with OpenAI, and by Wiz. The CVE numbers leaked a day early, so PHP brought the release forward by a day; according to the PHP Foundation, the fixes were scheduled for 10:00 a.m. Eastern on October 21, and the advisories went live at about 9:30 a.m.

Is my website affected?

Assume yes if your website runs on PHP and its PHP has not been updated to a fixed release, or your host has not confirmed a patched build. This table shows who has to act.

Look for the PHP you may not know about: an old staging copy, a booking or forms tool, phpMyAdmin, or a network appliance that bundles PHP. CISA and the NSA both tell organizations to inventory every system that depends on PHP, internet-facing ones first.

Fixed PHP versions and support dates

Sources: the PHP security advisory, the GitHub advisories for CVE-2026-109618 and CVE-2026-109619, and PHP's supported versions. PHP 8.2.35 fixes PHP2Shell, but PHP 8.2 stops getting security fixes on December 31, 2026, so plan a move to 8.3 or newer.

How to check your PHP version

1. WordPress: in the dashboard, go to Tools, then Site Health, then the Info tab, and open Server. The PHP version is listed there.
2. cPanel: open MultiPHP Manager to see the PHP version each domain uses.
3. Your own server: check the PHP that serves the website, not only the command line. The php -v command can show a different PHP from the one your web server uses; check the PHP-FPM or Apache module package instead.
4. Ask your host. Linux distributions and hosts sometimes patch without changing the version number, so the number alone can mislead. Ask them to confirm that both CVE-2026-109618 and CVE-2026-109619 are fixed and that PHP was restarted.

On cPanel servers, cPanel's own guidance lists the patched EasyApache packages, including builds for PHP 7.4, 8.0 and 8.1, and shows how to confirm the fix from the package changelog.

How to update PHP

• Take a backup or snapshot of the site first, so you can roll back.
• Managed WordPress hosting: your host does it. Check its status page, then confirm with support.
• Shared hosting: ask your host to apply the patched PHP build. Moving to PHP 8.3 or 8.4 also gets you years of support, but test the site first, because old plugins and themes can break.
• cPanel and WHM servers: update the EasyApache PHP packages as cPanel documents, then restart Apache and PHP-FPM.
• VPS or cloud servers: install your distribution's patched PHP packages or the fixed release, restart PHP-FPM and the web server, and rebuild containers.

A short message you can send your host:

Please confirm that the PHP serving our website has been updated to a release that fixes CVE-2026-109618 and CVE-2026-109619 (PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a patched vendor build), that PHP has been restarted, and which version is now running. If our site is on PHP 8.1 or older, what is your plan?

Should I take my website offline?

If you cannot update within hours, the agencies' answer is yes, or at least take it off the open internet. Their wording differs slightly:

• CISA: "Apply the patch immediately, prioritizing internet-facing systems." Systems that cannot be updated right away, or that still run PHP 8.1 or earlier, "should take PHP-based systems offline until they can be patched or updated."
• NSA: "If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated." The FBI's Cyber Division gave the same advice.
• Canadian Centre for Cyber Security: update immediately to a fixed, supported release; where that is not feasible, consider isolating internet-facing applications from public networks until a fix is applied.
• UK National Cyber Security Centre: if PHP's temporary mitigations cannot be applied quickly, consider taking the system offline until it is fully mitigated. CERT-EU similarly advises isolating systems you cannot patch.

Offline does not have to mean a blank screen. A simple holding page served without PHP, from your CDN or as a static page, keeps your phone number and email in front of customers while the server is fixed. PHP lists temporary configuration changes that reduce exposure, but says they are incomplete and that updating is the only safe choice.

Is PHP2Shell being exploited?

As of October 22, 2026, the picture is mixed and changing quickly.

• AWS reported exploitation attempts against its honeypot sensors from October 17, before the public release, and says PHP2Shell is now broadly exploited in the wild, though it is not clear whether those attempts would succeed against real systems.
• Cloudflare reported attack traffic against its customers and turned on firewall rules for all plans, including Free.
• CISA said it had not observed exploitation when it published its alert on October 21, and the Cyber Centre said it had not identified active exploitation at that time, while noting that proof-of-concept code was circulating.
• We have not seen a primary source report a confirmed compromise of a real organization so far.

Attackers move fast once details are public. Patchstack found that for the most heavily exploited WordPress vulnerabilities of 2025, the median time from disclosure to the first attack was five hours.

Will WordPress, a security plugin or Cloudflare protect me?

Not on their own. WordPress, its plugins and security plugins all run inside PHP, so none of them can patch PHP. A web application firewall helps: Cloudflare says its rules are on by default for every plan, and CISA says "A web application firewall may provide some protection until systems are updated or patched." Both still say to update PHP.

How to tell if your site was hacked, and what to do

• PHP worker processes starting command shells or downloading files, which CISA and the FBI both tell organizations to watch for.
• New or changed files in your website folders, new administrator accounts in WordPress, or a changed .htaccess file.
• Unusual multipart requests followed by memory errors or HTTP 500 responses, or oversized session cookies, which Wiz lists as signs of attempts.
• Outbound connections from the web server that you did not expect.

Keep your logs: AWS advises investigating from at least October 17. If you find signs of compromise, isolate the server, preserve the logs, change the passwords and keys stored on it, and report it: in Canada to the Cyber Centre, and in the United States to the FBI's Internet Crime Complaint Center.

What Canadian businesses should know

The Canadian Centre for Cyber Security issued alert AL26-026 and advisory AV26-1070 on October 21, and a statement warning that some websites may be temporarily unavailable while they are patched. CBC News reported that some federal government sites, along with sites in Newfoundland and Labrador, Prince Edward Island and Elections B.C., went offline as a precaution.

Applying the update does not need to be reported. If your site was breached and personal information was involved, federal privacy law (PIPEDA) requires a business to report a breach of security safeguards that creates a real risk of significant harm to the Office of the Privacy Commissioner of Canada, and to notify the people affected, as soon as feasible. Quebec, Alberta and British Columbia have their own private-sector privacy laws, so check which applies to you.

This is not a small-company problem only. Statistics Canada found that 16% of Canadian businesses were impacted by cyber security incidents in 2023, and that businesses spent $1.2 billion recovering from them.

Stuck on PHP 8.1 or older? Upgrade or rebuild

About one in three websites whose server language W3Techs can detect still run PHP 8.1 or older, which the PHP project no longer fixes. For these sites the patch is the start, not the end. There are two sensible paths.

• Upgrade to PHP 8.3 or 8.4. Best when the site is in good shape. Expect to update or replace old plugins and themes, and test on a copy before switching.
• Rebuild without WordPress or PHP. Best when the site depends on abandoned plugins, nobody owns it, or it needs a redesign anyway. A site built on a framework such as Next.js has no PHP and no plugins on the public server, so PHP flaws like this one do not apply to it. If you keep WordPress as a back-end editor (a headless setup), that WordPress still needs patching.

Many businesses are already moving. W3Techs data shows WordPress's share of all websites fell from 43.3% in October 2025 to 39.6% on October 22, 2026, after holding near 43% from 2022 to 2025. Over the same period, Patchstack counted 11,334 new WordPress vulnerabilities in 2025, up 42% on 2024, and 46% of them had no fix when they were disclosed.

How Data Function can help

We are a Toronto web and software company with more than 30 customers across Canada and the USA. We update PHP and secure WordPress sites on their existing hosting, and we rebuild sites that no longer make sense to patch, with every old address redirected so search rankings carry over. Our own website moved off WordPress in October 2026.

See our website security and PHP update service, our website packages, or call +1 416-319-3884 for urgent help.

What changed in this article

• October 22, 2026: first published, with sources checked the same day.