In this article
Last checked October 21, 2026, at 10 p.m. Eastern. This story is moving quickly, so we’re updating this page as the PHP project and the big hosts post new information.
On October 21, 2026, the PHP project shipped emergency updates for two critical security flaws that researchers have nicknamed PHP2Shell. PHP is the language underneath WordPress, WooCommerce, Drupal, Joomla, Magento and a big share of small business websites. Both flaws let an attacker run their own code on a web server without logging in. In plain terms, that can mean a defaced site, a stolen customer list, or a server quietly put to work attacking other people.
The fix lives on the server. No WordPress update, plugin or theme closes this hole. Whoever runs your server, usually your hosting company, has to update PHP. Your job this week is to confirm that happened, and the rest of this guide shows you how.
What is PHP2Shell?
PHP2Shell is the nickname for two vulnerabilities in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619. The PHP project rates both 9.2 out of 10, which is critical, and says they “can allow unauthenticated remote code execution.” Researchers at Wiz and at Calif found them independently over the summer and reported them to the PHP team.
Because the bugs sit in PHP, a site can be exposed even when its own code is clean and every plugin is current. The PHP advisory lists every common way of serving PHP as at risk, which covers nearly every shared hosting plan. CISA, the NSA and their counterparts in the UK and Europe all told organizations to patch right away or take PHP sites offline until they could.
Is my website affected?
If your site runs on WordPress, WooCommerce, Drupal, Joomla, Magento or other PHP software, assume it’s affected until your host confirms PHP was updated. If your site lives on Shopify, Squarespace, Wix or Webflow, you don’t run a PHP server yourself, so there’s nothing for you to update. Those platforms manage their own servers.
Not sure what your site is built on? A login at /wp-admin means WordPress, and WordPress means PHP. If you own more than one site, check each one. A Shopify store with a separate WordPress blog still has a PHP site to patch.
How do I check my PHP version?
In WordPress, go to Tools → Site Health → Info, then open the Server section. The PHP version is listed there. Your hosting control panel shows it too, usually under “PHP version,” or under MultiPHP Manager in cPanel.
Then compare what you see against the fixed releases:
| PHP | Fixed in | Fixes end |
|---|---|---|
| 8.5 | 8.5.12 | Dec 31, 2029 |
| 8.4 | 8.4.27 | Dec 31, 2028 |
| 8.3 | 8.3.36 | Dec 31, 2027 |
| 8.2 | 8.2.35 | Dec 31, 2026 |
| 8.1 and older | No release | Ended |
If your number matches or beats the fixed version, PHP itself is patched. If it’s lower, don’t assume the worst yet. Many hosts and Linux vendors copy the fix into an older build and leave the version number alone. CloudLinux, which sits underneath a lot of shared hosting, says its patched PHP 8.4 package can still read 8.4.26. A lower number means you need a written answer from your host, not a guess.
On PHP 8.1 or older, the PHP project isn’t releasing fixes at all. Some hosts and vendors are patching those versions on their own. We cover your options in our guide for sites stuck on old PHP.
What should I ask my host?
Ask one specific question in writing: has the PHP version my site runs been patched for CVE-2026-109618 and CVE-2026-109619? A yes with a date is the answer you want. “We have protections in place” is a different answer. It usually means a firewall rule while patched builds roll out, and it’s worth one follow-up.
Hi, my site [your domain] runs PHP [the version from Site Health]. Can you confirm in writing whether that PHP version on my server has been patched for CVE-2026-109618 and CVE-2026-109619 (PHP2Shell)? If it hasn't, when will it be, and do I need to do anything on my side, such as switching to a newer PHP version? Thank you.
Hosts are in very different places. Some finished on October 21. Others are running temporary protections while patched builds roll out, and on VPS and dedicated plans most leave patching to you. Our host-by-host status table shows where each host stood at our last check, on October 29.
If you run your own server, such as a DigitalOcean droplet, a Lightsail instance or a dedicated box, nobody is patching it for you. Update PHP from your Linux distribution or control panel packages, then restart PHP-FPM and the web server. Running PHP workers keep the old code in memory until they restart.
Should I take my site offline?
Only if you can’t get PHP patched quickly. CISA says to take PHP systems offline if you can’t update right away, or if you’re on PHP 8.1 or older with no vendor fix. If your host confirms the patch, there’s no reason to go dark.
If you do need to, a maintenance-mode plugin doesn’t count. That page still runs PHP on every request, and the PHP advisory says the riskiest version of this attack fires before any of your site’s own code loads. Offline means your host stops PHP for the site, or serves a plain static page in its place. Ask them to do that, and keep your phone number and hours current on your Google Business Profile while the site is down.
Does Cloudflare or a firewall protect me?
Partly, and only for now. Cloudflare switched on firewall rules for these flaws early on October 21, for every plan including the free one, and Sucuri and others did the same. All of them say you still need to patch. A firewall only filters traffic that passes through it, so an attacker who can reach your server directly skips it entirely.
Is this the same as wp2shell?
No, though the names get mixed up in forums this week. wp2shell was a WordPress flaw from July 2026, fixed in WordPress 7.0.2, and most sites got that update automatically. PHP2Shell is in PHP, so no WordPress update touches it. Keep WordPress current anyway. As of this writing, the latest version is 7.1.3.
Has anyone been hacked yet?
As of the evening of October 21, attack attempts are widely reported and confirmed break-ins aren’t. Cloudflare and watchTowr both report attackers probing sites. CISA said it had not observed exploitation when it published its alert. Security teams expect that to change quickly, because attackers study the published fix to work out the attack.
Patching stops new break-ins. It doesn’t remove anything an attacker already left behind. If your site went unpatched for a while, work through our checklist for whether a site was hacked.
How OJ Amplify can help today
Plenty of small business sites around Tampa Bay were set up years ago by a developer who has since moved on. If that’s your situation, you may not know who hosts your site or where the logins are. That’s a normal starting point for us. We can:
- confirm your PHP version and get a written answer from your host
- update PHP where your plan lets the site owner do it, then check the site still works
- move a site stuck on PHP 8.1 or older to a supported version without breaking plugins
- clean up a site that was already compromised, through our hacked website repair service
Call 813-531-9400. We pick up, and we can start on your site right away, including sites we didn’t build. You can also send the details through our emergency support page. If you’re not sure you need help at all, our free website audit will tell you plainly.
Common questions
Will updating PHP break my site? A patch within the same branch, like 8.3.35 to 8.3.36, is very low risk. Jumping several versions at once is different, because older plugins and themes sometimes depend on things newer PHP removed. Take a backup and test on a staging copy before a big jump.
Does updating WordPress or my plugins fix PHP2Shell? No. Keep them updated, but this fix happens on the server.
My host says I don’t need to do anything. Is that enough? It’s a good sign. Ask one more thing: whether the PHP version your site uses is patched already, or protected only by a firewall rule for now.
How would I know if I was attacked? Start with unknown admin users, plugins you didn’t install, and PHP files sitting in your uploads folder. Our checklist walks through the rest.