Security alert · Updated
Is your websiteexposed to PHP2Shell?
A serious security flaw was found in PHP, the software that runs most websites, including every WordPress site. Attackers can use it to take over a site without a password. Many hosts fixed it within a day; some are still working on it.
- Free, no sign-up
- Nothing harmful is sent to your site
- A plain-English answer, plus an email to send your host
Technical names: CVE-2026-109618 and CVE-2026-109619. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Details for developers
Your result
What’s at risk
Why this one matters.
Most security news is about one plugin. This flaw is in the software underneath the whole site, so a fully updated WordPress site can still be exposed.
Someone else runs your site
Attackers can run their own code on your server without a password. That can mean hidden pages, redirects to scam sites, or a backdoor to come back later.
Logins and keys can leak
The flaw can expose what’s in the server’s memory, such as passwords and the keys your site uses to send email, take payments or connect to other services.
Cleanup costs more than the fix
A hacked site can be flagged by Google and browsers, lose leads and take days to clean up. Getting PHP updated is usually quick.
Are you affected?
It depends on who runs your server.
Updating WordPress or your plugins doesn’t fix this. Only an updated PHP does, and on most websites that’s your host’s job.
Probably covered
Your site is on a managed WordPress host that says it has fixed this, like WP Engine, WordPress.com or SiteGround, or it’s built on Squarespace, Wix or Shopify, which don’t use PHP.
Still worth a quick check: staging copies and old sites are easy to miss.
Check now
You’re on shared or cPanel hosting (GoDaddy, Bluehost, HostGator, Hostinger and similar), your host hasn’t said anything yet, or you don’t know who hosts your site.
Run the check above, then confirm with your host.
Act today
You or your developer run the server yourselves (a VPS, cloud server or your own hardware), or your site runs PHP 8.1 or older, which no longer gets regular security updates.
Update PHP today, or get help doing it.
What to do
Three steps. Most take minutes.
- 1
Check your site
Use the free check above. It shows what your site tells the world and what your host has said publicly.
Check my site → - 2
Confirm with your host
On most websites the host updates PHP, not you. The check drafts a short email you can send them to confirm your site is covered.
See what hosts have said → - 3
Make sure nothing got in
If your site was exposed before the fix, updating PHP won’t remove anything already planted. Our post-patch check looks for it.
About the $350 check →
Prefer to check your PHP version yourself?
Compare what you find with the fixed releases: 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or newer in the same series. Anything 8.1 or older is out of support.
- WordPressTools → Site Health → Info → Server. “PHP version” is the one serving your site.
- cPanel hostingSoftware → MultiPHP Manager shows the version per domain. Hosts patch these builds themselves, so ask yours whether its packages include the fix.
- Managed WordPress hostsWP Engine, Kinsta, Flywheel and similar show PHP in each site’s settings. The host updates the builds behind them.
- Your own server or VPSRun
php -v, then check the version your web server actually uses (PHP-FPM or Apache’s module). They can differ. Check containers and staging too.
Detailed steps for your kind of hosting
- On managed WordPress hostingYour host updates PHP. Confirm your plan is covered (staging and older sites too), then check for signs of compromise.
- On shared cPanel hostingMake sure the PHP version selected for your site is one your host has patched. Some shared hosts are still on temporary mitigations while they wait for patched packages.
- On a VPS or your own serverYou patch. Install your OS vendor’s package or 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart PHP-FPM or Apache.
- Stuck on PHP 8.1 or olderAsk whether your host applied the PHP team’s backport, then plan an upgrade to 8.3 or 8.4. PHP 8.2 itself reaches end of life on December 31, 2026. Code rescue can handle the plugin fallout.
- If you can’t patch todayThe PHP advisory lists server-level stopgaps, like turning off session upload progress and changing how memory limits are set, but says they don’t make a server safe. Consider maintenance mode until it’s patched.
- After patchingA patch doesn’t remove a backdoor. Look for unfamiliar admin users, new PHP files (especially in uploads), unknown scheduled tasks, and rotate passwords, keys and salts the server holds.
Host status
Has your host fixed it?
What each host has said publicly, checked . Tap a host for its latest update and the source.
Not listed? Ask your host directly. The check above drafts the email for you.
Fixed or protected 10
The host says it has patched PHP or blocked attacks.
WordPress.com, Pressable and WordPress VIPProtected
Automattic worked with the PHP security team before the release and says every site it hosts (WordPress.com, Pressable, WordPress VIP, WP Cloud) was already protected. No action needed.
Oct 21, 19:57 UTC · WordPress.com blog
SiteGroundPatched
SiteGround put protections in place on all its servers before the release, then applied PHP's official fixes across all of them the same day. It says customers don't need to do anything.
Oct 21 · SiteGround blog
WP EnginePatched
WP Engine added protections at its CDN (Cloudflare and Fastly) shortly before the release, then finished deploying the PHP patches.
Oct 22, 01:19 UTC · WP Engine status page
KinstaPatched
Kinsta says the PHP security updates have been rolled out across its platform (PHP 7.4 through 8.5) and all sites are protected. Its Cloudflare firewall rules stay in place for now. No action needed.
Oct 22, 08:26 UTC · Kinsta status page
20iPatched
20i finished its rollout, including backported fixes for older PHP versions.
Oct 21, 20:01 UTC · StackStatus
Liquid Web and NexcessPatched
Liquid Web says the security updates for both flaws have been rolled out across its hosting fleet and it's monitoring. It recommends moving sites on PHP 8.1 or older to PHP 8.2 or newer.
Oct 29, 15:39 ET · Liquid Web status
FlywheelPatched
Flywheel's status page says WP Engine finished deploying the security patches on the Flywheel platform on Oct 21, on top of protections at its CDN and servers. No action needed.
Oct 21 · Flywheel status
PantheonPatched
Pantheon patched every PHP version it offers, including older versions through its long-term-support vendor, and finished rolling them out across customer environments on Oct 21. No action needed.
Oct 22, 09:36 PT · Pantheon status
CloudwaysPatched
Cloudways says it patched every PHP version it supports, back to PHP 5.6, and finished the rollout on all active servers on Oct 22. It patches PHP for you, so there's nothing to do; support is contacting the few customers whose servers need extra help.
Oct 22, 10:20 UTC · Cloudways status
DreamHostPatched
DreamHost says its PHP servers were patched within hours of the fixes being released, and its web application firewall blocked the intrusion attempts it saw in the days before.
Oct 29 · DreamHost announcement
Still working on it, or depends on your plan 8
Some servers or plans may not be fixed yet.
GoDaddyDepends on plan
Managed Hosting for WordPress, Web Hosting and Windows Hosting: GoDaddy has patched all PHP versions and says there's nothing to do. On Web Hosting the version number may not change, so check that PHP's build date is October 21, 2026 or later. VPS: you update PHP yourself.
Oct 23, 21:00 UTC · GoDaddy blog
BluehostPatching
Bluehost says most of its platforms now run patched PHP builds and it's still deploying to the rest. It says customers in its managed hosting environments don't need to do anything.
Oct 23, 20:55 ET · Bluehost status
HostingerDepends on plan
Every Hostinger plan except VPS: Hostinger manages PHP, installed the fix on all those servers by October 22 and says there's nothing to do. VPS: you update PHP yourself.
Oct 23, 13:25 UTC · Hostinger blog
InMotion HostingDepends on plan
InMotion says its shared hosting and dedicated servers are patched. On shared hosting, CloudLinux fixed the existing PHP builds without changing their version numbers, so a scanner that only reads the version may wrongly flag your site. VPS: at InMotion's last update, patches were still being deployed across its VPS fleet.
Oct 22, 17:10 UTC · InMotion status
Rocket.netIn progress
Rocket.net marked its PHP update resolved on Oct 22. Its last detailed update said patched builds for every PHP version from 5.2 to 8.5 were going out across its fleet in rolling waves. To confirm yours, check that the Build Date in phpinfo() is October 21 or later, or ask support.
Oct 22, 06:36 ET · Rocket.net status
HostGatorPatching
HostGator says most of its servers now run patched PHP builds and it's still deploying to the rest. It says customers in its managed hosting environments don't need to do anything. If you manage your own VPS or dedicated server, run a package update from your control panel.
Oct 23, 20:55 ET · HostGator status
IONOSDepends on plan
IONOS says it has installed the official PHP updates on its systems, including the older PHP versions it still offers under PHP Extended Support, so most customers don't need to do anything. If you run PHP yourself, for example on a VPS or dedicated server, you have to update it.
A2 Hosting (hosting.com)Depends on plan
hosting.com, A2 Hosting's new name, says it updated every server it manages, including those on end-of-life PHP versions, so shared hosting and managed plans need nothing. On an unmanaged VPS or dedicated server with root access, you update PHP yourself.
Oct 23 · hosting.com blog
Not a host, but relevant 2
Firewalls and servers you run yourself.
Cloudflare (CDN and firewall, not a host)Stopgap only
Cloudflare deployed firewall rules for every customer, free plans included. Its CTO called this a stopgap: it only helps if attackers can't reach your server directly, and it doesn't replace patching PHP.
Oct 21 · The Repository
Your own server, VPS or cloud instanceYou patch
You or your developer have to update PHP: install your OS vendor's patched package or PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart PHP-FPM or Apache. Until PHP's next regular release, PHP also suggests turning off session upload progress (session.upload_progress.enabled = 0) to block a related, less likely flaw (CVE-2026-115560).
How to read this: “Protected” means the host says it blocked attacks before the release; “Patched” means it says it installed the fixed PHP; “Depends on plan” means managed plans are covered but self-managed servers aren’t. No statement doesn’t mean a host hasn’t patched: some patch quietly. If your host isn’t listed, ask them directly.
Want certainty?
We’ll check it from the inside.
The free check can only see what your site shows the world. We log in, confirm the fix is really in place, look for anything left behind, and tell you in plain English.
- Know, don’t guess. “Probably fine” isn’t an answer when a host says one thing and your site shows another.
- Catch a break-in early. The flaw leaked a day before the fix. If anyone got in, the sooner it’s found, the cheaper it is.
- One flat price. $350 for one site, billed only after you say go. No retainer.
PHP2Shell post-patch check
$350
Flat fee for one WordPress site. If we find signs of compromise, cleanup is quoted before we start.
Go on to a Code Rescue block for cleanup or a PHP upgrade, and the $350 counts toward it.
Book a check- The fix, confirmedThe PHP actually serving your live site and its staging copies, checked from the inside, not guessed from headers.
- A compromise sweepAdmin users, recently changed PHP files, the uploads folder, scheduled tasks, and WordPress core and plugin checksums.
- Firewall and origin checkWhether attackers can reach your server around Cloudflare or your host’s firewall.
- A plain-English summaryWhat we checked, what we found and what to do next, usually within two business days of access.
Selected work and partnerships
A Michigan web team that builds and looks after WordPress sites, and the hosting behind them. See the work.
PHP2Shell in plain English
What happened, briefly.
PHP is the software on the server that builds your pages before they reach a visitor’s browser. It runs most of the web, including every WordPress site.
- What it isTwo bugs in PHP itself, nicknamed PHP2Shell because they can hand an attacker control of the server. They were announced and fixed on October 21, 2026.
- Who’s affectedAny website running a PHP version that hasn’t been updated, whatever its plugins or theme. Sites on builders like Squarespace, Wix or Shopify don’t use PHP.
- How seriousRated critical: 9.2 out of 10. Details leaked a day early, working attacks were built quickly, and security firms saw attempts in the wild.
- The fixA PHP update: 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your host’s patched build. Most managed hosts handle it for you. A WordPress update doesn’t fix it.
Technical details for developers
| What it is | Two vulnerabilities in the PHP interpreter. CVE-2026-109618: memory corruption when PHP runs out of memory part-way through setting up a request. CVE-2026-109619: a use-after-free, where state left over from one request is used by the next request on the same worker. |
|---|---|
| Nickname | PHP2Shell |
| Severity | Critical. Each is rated 9.2 under CVSS v4.0. |
| What an attacker gets | Code execution on the web server with the web server’s permissions, without logging in. Researchers also showed reading PHP worker memory, which can expose passwords, tokens and API keys. |
| Who’s affected | Any PHP installation that serves web requests: PHP-FPM, Apache with mod_php (the highest risk), php-cgi, FrankenPHP and LiteSpeed. Wiz Research says every PHP version back to 5.4 is affected by at least one of the two flaws. |
| Fixed in | PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released October 21, 2026 at 14:00 UTC. Linux distributions and long-term-support vendors got the patches in advance, so check your vendor’s packages. PHP 7.4, 8.0 and 8.1 are end of life; the PHP team published minimal source backports for them. |
| Not fixed by | WordPress, plugin or theme updates. The WordPress security team says no WordPress update is required or planned. |
| Stopgaps | The PHP advisory lists temporary mitigations if you can’t update yet (an administrator-level memory_limit=-1, session.upload_progress.enabled=0, fatal_error_backtraces=0 on 8.5, a lower post_max_size, and request limits at the web server or proxy) and says they don’t make an installation safe. A CDN firewall only helps if the origin can’t be reached directly. |
| Exploitation | Details leaked on October 20, before the release. Researchers built working exploits, Patchstack logged active exploitation incidents reported by hosting partners, and Sucuri saw exploitation attempts in the wild. CISA called for immediate patching, and the UK NCSC advised taking systems offline if they can’t be protected yet. |
| Found by | Wiz Research found and reported both flaws; Calif researcher Ryan Austin independently found the first. Both were reported to the PHP project in August 2026. |
What is PHP2Shell?
PHP2Shell is the nickname for two critical vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619, disclosed on October 21, 2026. Under the right conditions they let an attacker run code on a web server without logging in. They are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Is my WordPress site affected by PHP2Shell?
If it runs on a PHP version without the fix, yes. The flaws are in PHP, not WordPress, so any WordPress site on an unpatched PHP is exposed, whatever its plugins or theme. Most managed WordPress hosts patched or blocked attacks on October 21; on a self-managed server, whoever runs the server has to update PHP.
Does updating WordPress or my plugins fix PHP2Shell?
No. WordPress, plugin and theme updates don’t change the PHP version your server runs. The WordPress security team says no WordPress update is required or planned. Only a patched PHP fixes it.
Which PHP versions fix PHP2Shell?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or newer releases in those branches. Linux distributions also ship patched packages that can keep an older version number. PHP 7.4, 8.0 and 8.1 no longer get regular updates; the PHP team published minimal source backports for them, but the lasting fix is upgrading.
My host says it patched. Do I need to do anything?
Mostly no, but confirm two things: that your plan is covered (some hosts treat VPS and self-managed plans differently) and that staging copies and other sites on the account were updated too. If your site was exposed between October 20 and the patch, check it for signs of compromise, because patching doesn’t remove a backdoor.
Does Cloudflare or a firewall protect me from PHP2Shell?
It helps, but it’s a stopgap. Cloudflare deployed PHP2Shell rules for all customers, free plans included, and many hosts added firewall rules before patching. A firewall only protects a server attackers can’t reach directly, and the PHP project says only an update is a complete fix.
I’m on PHP 7.4, 8.0 or 8.1. What should I do?
Ask your host whether it has applied the PHP team’s backport or a vendor fix for your version. Then plan an upgrade to PHP 8.3 or 8.4: PHP 8.2 itself reaches end of life on December 31, 2026. Older plugins and themes sometimes break on the upgrade, so test on a staging copy first.
How does the Codified PHP2Shell checker work?
It loads your homepage once, the way a browser would, and looks up your domain’s public DNS records. From the response it reads what your server chooses to show (the PHP version if advertised, the platform, the host and any firewall in front) and compares that with the fixed releases and your host’s public statement. It sends no attack traffic, and we don’t keep a list of the sites people check. The email to your host is drafted by AI from that result (and checked against it before it’s shown), or from a template if AI is unavailable.
Can a checker tell me my site is safe from PHP2Shell?
Not from the outside. Most well-run servers hide their PHP version, so an outside check often has to rely on the host’s public statement. Testing for the flaw directly means pushing PHP to run out of memory, which can crash its workers, so we don’t. To be sure, check the version from inside (WordPress Site Health or your hosting panel), or have someone check it for you.
How do I know if my site was hacked through PHP2Shell?
Common signs are admin users you don’t recognize, new or recently changed PHP files (especially in wp-content/uploads), unknown scheduled tasks, unexpected redirects, and bursts of multipart requests followed by memory errors or 500 errors in your server logs. None of these prove it either way. If you see them, patch first, then treat the server as compromised and rotate the passwords and keys it holds.
Sources
Where these facts come from.
Show all sources
- PHP project security announcement, October 21, 2026 (fixed versions, affected setups, mitigations)
- WordPress.org: Critical PHP Security Release (no WordPress update needed)
- Rapid7: CVE-2026-109618 and CVE-2026-109619 analysis (CVSS, attack conditions)
- Patchstack: PHP major vulnerability alert (timeline, exploitation reports, Wiz research)
- The Repository: hosts across the WordPress ecosystem race to protect customers (host roundup, discovery, Cloudflare)
- Search Engine Journal: Critical PHP core security flaws
- Host statements: linked in the host status list.
Updates
What changed on this page.
- Weekly host check. InMotion says its shared hosting servers are now patched, like its dedicated servers. On shared hosting the fix went into the existing PHP builds without a new version number, so tools that only read the version may wrongly flag those sites. Its VPS rollout was still in progress at its last update. We found no other changes in hosts’ statements, and PHP hasn’t released new versions, so the fixed versions are unchanged.
- Weekly host check. Kinsta, Liquid Web and SiteGround now say PHP itself is patched across their platforms, and GoDaddy has patched Web Hosting too. New statements: Flywheel, Pantheon, Cloudways and DreamHost say they’ve patched; IONOS and hosting.com (A2 Hosting) have patched everything they manage, while a VPS or dedicated server you run yourself is yours to update; HostGator, like Bluehost, is still finishing its rollout. On October 23 PHP disclosed a related, less likely flaw (CVE-2026-115560) that its next regular release will fix; until then it suggests turning off session upload progress on servers you manage. The fixed versions haven’t changed.
- Published the checker and this page. Host statuses taken from 11 hosts’ own public updates.
/services/code-rescue
Patched, but not sure what you’re running?
Old PHP, a plugin that breaks on the upgrade, or a site nobody has touched in years. We get it current and keep it that way.