PHP2Shell: What the October 2026 PHP Vulnerabilities Mean for Your Website

On October 21, 2026, the PHP project released emergency updates for two critical vulnerabilities that are now widely called PHP2Shell. If your website runs on WordPress, Joomla, Drupal, Laravel, or a custom PHP application, this one is worth ten minutes of your attention today. Here is what happened, in plain English, and what I recommend you check.

If you would like someone to check and patch your server for you, Able Rescue is $199 for up to two hours of senior help. Email greg@ableadmins.com or call (832) 977-1356 any hour.

What happened

According to the PHP project's security advisory, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. In everyday terms, that means an attacker may be able to run their own code on a server without logging in first. The advisory lists every PHP installation serving web requests as at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, and it considers the risk highest for mod_php.

The reaction was unusually visible. The Verge reported that Wikipedia, 4chan and DeviantArt had problems that day, that some Dutch and Finnish government agencies took their sites down as a precaution, and that both the NSA's cybersecurity account and the UK National Cyber Security Centre suggested taking systems offline if an immediate update was not feasible. The same report noted that GoDaddy told customers any site using PHP should assume it is affected.

Who should pay attention

If your site runs on a hosted website builder that does not use PHP, there is little for you to do. If you run WordPress or any PHP application on shared hosting, a VPS, a dedicated server, or a cloud instance, you should confirm that your PHP version is patched. This is especially important if your site takes orders, stores customer data, or connects to other business systems.

How to check your PHP version

• cPanel hosting: look in MultiPHP Manager or the PHP version selector for the version assigned to each domain.
• WordPress: go to Tools, then Site Health, then the Info tab, and open the Server section.
• Server access: run php -v on the command line, and remember that the web server may use a different PHP build than the command line, so check the PHP-FPM or Apache module version as well.

Compare what you find with the fixed releases above. One detail matters here: Linux distributions and LTS vendors received the patches in advance, so a package from your distribution may carry the fix even when the version number looks older. Check your vendor's security notice to be sure.

If you are on PHP 8.1 or older

The PHP project says PHP 8.1 and older no longer receive updates. Some distributions and LTS vendors provide backported fixes, and the PHP security team published minimal source backports for PHP 7.4, 8.0 and 8.1 for people who build from source. For most businesses, the practical answer is to plan a move to a supported PHP version. It is also worth noting that PHP 8.2 reaches end of life on December 31, 2026, so if you are upgrading now, aim for 8.3 or newer.

If you cannot update today

The advisory lists temporary measures that reduce exposure to specific attack paths, while being clear that only an update is a complete solution. Examples include setting session.upload_progress.enabled=0 and restarting every PHP worker, and lowering post_max_size for applications that do not need large uploads. On October 23, the PHP project also recommended keeping session.upload_progress.enabled=0 in place until the next regular bugfix release. These steps buy time. Schedule the real update as soon as you can.

After you patch, look for signs of trouble

Because these flaws allowed code to run before anyone logged in, it is sensible to check patched sites for anything unusual from the days before the update: new PHP files in upload folders, unfamiliar administrator accounts, unexpected scheduled tasks, changed files in the web root, and outgoing spam from the server. If you find something, treat it as a cleanup job rather than just an update. Our guide to cleaning up a hacked cPanel or WordPress site walks through the basics.

How Able can help

For a quick, hands-on fix, Able Rescue covers up to two hours on your server for $199: I check every PHP version in use, apply the vendor updates or move you to a supported version, restart the workers, and look for signs of compromise. If you would like a written picture of your exposure afterwards, our security scans start at $349 for an OWASP web scan.

Sources

• PHP News Archive 2026: security advisory and releases, October 21 and 23, 2026
• The Verge: PHP, the three letters that shut down sites all over the internet today (October 21, 2026)

If you are not sure whether your server is patched, email greg@ableadmins.com and I will gladly take a look with Able Rescue.