PHP2Shell: What Agencies need to know, and do, now
Two critical PHP flaws. Almost every version is affected. Here’s a summary of what you need to know in less than five minutes.
If you’re still working through the patching, this might also help;
Key takeaways
- PHP2Shell is two critical flaws in PHP (CVE-2026-109618 and CVE-2026-109619). They could let an attacker run code on your web server without logging in.
- Almost every version of PHP is affected, the language behind WordPress, Drupal and an estimated 70% of websites.
- Update now. If you can’t, check for signs of compromise.
- Expect more of these. AI is finding long-hidden flaws faster than ever.
What is PHP2Shell?
PHP2Shell is the name given to two critical security flaws in PHP, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 for severity. Together, they let an attacker run their own code on a web server, with no login required. PHP published emergency fixes on 21 October 2026, after details leaked online, and attackers were soon trying to exploit them.
| If you run… | Update to… |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
| PHP 8.1 or older | No new release: use your vendor’s backported fix, or upgrade |
What should you do now?
The NCSC’s priority actions, in short:
- Find every system running PHP, not just the old ones. Start with anything internet-facing.
- Update to a fixed version, then restart. Most Linux distributions already have patched packages.
- Can’t update yet? Apply the temporary mitigations in PHP’s security advisory, or take the site offline. Mitigations aren’t a permanent fix.
- Check anything left unpatched for signs of compromise. Not confident? Speak to us or locate a NCSC-assured incident response provider.
- Watch for updates to products that bundle PHP.
Full guidance: PHP’s security advisory and the NCSC’s advisory.
UK organisations can also sign up to the NCSC’s free Early Warning service.
Update, 23 October:
PHP now also advises setting session.upload_progress.enabled=0 until its next regular release, to close an unlikely extra attack route. If you already applied this as a mitigation, keep it in place. Read PHP’s notice.
Will there be more like this?
Yes. In May, the NCSC warned of a “vulnerability patch wave”: AI is helping attackers find flaws that have hidden in software for years, so expect more critical updates, more often. Some older technology can’t be patched at all and will need replacing, and the clock is ticking: PHP 8.2, still widely used, reaches end of life on 31 December 2026.
How did Digital Craftsmen handle PHP2Shell?
Our clients heard from our team before the fixes landed: an alert at 11:20 on 21 October, then our patching plan at 13:21, with the option to isolate systems from the internet until the fixes were applied.
Every update is published on our status page.
PHP2Shell: frequently asked questions
Is my WordPress site affected by PHP2Shell?
WordPress runs on PHP, so any WordPress site is exposed if the server’s PHP hasn’t been updated to a fixed version. Ask your hosting provider to confirm your server has been patched.
How do I check which PHP version my site runs on?
Ask your hosting provider, or check your hosting control panel. In WordPress, go to Tools, then Site Health, then the Info tab, and open the Server section.
What if I’m on PHP 8.1 or older?
The PHP project won’t fix those versions. You’ll need a backported patch from a vendor, or an upgrade to a supported version. Upgrades can take time, so act now.
Need more advice?
Contact us now or before the next vulnerability alert. Call 020 3745 7706 / Email [email protected]
Coming soon: our Partner Programme for agencies. UK-sovereign hosting, fully secured 24/7, managed by our team under your brand, so you can win bigger clients without carrying the operational risk or seeing valuable internal resources firefighting more patching waves.
