1. What is PHP2Shell?
PHP2Shell is the name security firm Wiz gave to two critical flaws in the PHP engine itself, CVE-2026-109618 and CVE-2026-109619. PHP’s security team rated both 9.2 out of 10 (CVSS v4.0). Under certain conditions, they can let an attacker who isn’t logged in run code on an unpatched server. The flaws are in PHP, the software underneath your website, not in WordPress or your plugins (source: php.net security advisory, October 21, 2026).
2. Which PHP versions fix PHP2Shell?
PHP released fixes on October 21, 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (source: php.net release archive). Linux distributions and hosts also ship the fix as backports that keep older version numbers, so a lower number doesn’t always mean unpatched (source: AlmaLinux). None of these releases fixes the related flaw CVE-2026-115560 (as of October 23, 2026) (source: php.net advisory on CVE-2026-115560, October 23, 2026).
3. Is my WordPress, WooCommerce or Magento site affected?
If it runs on PHP, it’s in scope. Nearly every PHP version back to 5.4 is affected, across the common ways PHP runs on a web server, and default configurations are affected (source: Beazley Security Labs; Datadog Security Labs). Whether you need to act depends on whether the PHP serving your site has been patched, and by whom (source: GoDaddy).
4. I’m on shared or managed hosting. Do I need to do anything?
Your host may already have done the patching, but confirm it. As of October 23, 2026, many shared and managed hosts had reported patching PHP for customers on their managed plans, including GoDaddy, Hostinger, SiteGround, WP Engine and WordPress.com (host notices, October 21–23) (source: GoDaddy). Ask your host to confirm in writing that your account is patched for both CVEs and has PHP’s recommended setting for CVE-2026-115560, and keep the reply (source: php.net advisory on CVE-2026-115560, October 23, 2026). The questions to ask.
5. I run my own VPS or server. What do I need to do?
Patch it yourself, or have whoever runs it do so: nobody patches a self-managed server for you (source: GoDaddy). Update to a fixed release or your distribution’s patched package, restart PHP, and apply PHP’s recommended setting for CVE-2026-115560 (source: php.net release archive; AlmaLinux; php.net advisory on CVE-2026-115560, October 23, 2026). Then check for signs of compromise going back to October 17, when attempts began (source: BleepingComputer).
6. What is CVE-2026-115560, and is it fixed?
It’s a related PHP flaw, disclosed on October 23, 2026, that the October 21 releases don’t fix. Until its next regular bugfix release, PHP recommends turning off session upload progress (session.upload_progress.enabled=0) in php.ini, the PHP-FPM pool or the server configuration, then restarting PHP. Setting it from application code doesn’t count. PHP says exploitation needs an unusual configuration and is unlikely. Status as of October 23, 2026 (source: php.net advisory on CVE-2026-115560, October 23, 2026).
7. Is there a fix for PHP 8.1 or older?
There is no official PHP release that fixes PHP2Shell on PHP 8.1 or older. The PHP team published minimal source patches for 7.4, 8.0 and 8.1, and none for 5.4–7.3. Sites on those versions depend on their host, their Linux distribution or a paid extended-support provider for a fix, or need to upgrade (source: Beazley Security Labs).
8. Can php -v tell me whether I’m patched?
No. Many hosts and Linux distributions ship the fix as a backport that keeps the old version number. The command-line php -v may not be the PHP that serves your website. And a patched package isn’t actually running until PHP’s worker processes restart (source: AlmaLinux).
9. How do I prove my server is patched?
Collect evidence for each PHP runtime that serves your site. You need the build actually serving the site; a fixed release, or a package whose changelog names both CVEs; a restart after the update; and PHP’s recommended setting for CVE-2026-115560 (source: php.net release archive; AlmaLinux; php.net advisory on CVE-2026-115560, October 23, 2026). Record the status per CVE with a timestamp. Our step-by-step guide explains each check.
10. Does updating WordPress or my plugins fix PHP2Shell?
No. The flaws are in the PHP engine, not in WordPress (source: php.net security advisory, October 21, 2026). WordPress itself is mostly kept current by automatic updates, but the PHP version underneath is set by your hosting environment, and WordPress updates don’t change it (source: WordPress.org version statistics).
11. Is a firewall or Cloudflare enough?
No, but it helps. Web application firewalls can block many attack attempts and buy time, but they don’t replace the patch. Attackers changed their payloads to get past firewall rules within hours (source: Beazley Security Labs). Cloudflare says it switched on PHP2Shell rules for all its plans, including Free, from October 21, but they only protect traffic that passes through Cloudflare (source: Cloudflare).
12. Has PHP2Shell been used to break into websites?
As of October 23, 2026, security firms and governments had reported widespread attempts but no publicly confirmed successful compromise, with one exception: Palo Alto Networks’ Unit 42 reported a compromise at one European government entity, not independently corroborated. PHP2Shell was not in CISA’s Known Exploited Vulnerabilities catalog as of that date (source: Beazley Security Labs). Attempts started on October 17, four days before the patches were released (source: BleepingComputer). This can change quickly; check the date.
13. Should I take my website offline?
Only if you can’t patch or mitigate quickly. The UK NCSC advises that if temporary mitigations can’t be applied in time, “you should consider taking the system offline until it can be fully mitigated.” (source: UK NCSC) If you do, use a proper maintenance page rather than switching off PHP on the server, which can expose your source code (source: Beazley Security Labs).
14. Should I change passwords and API keys?
Yes, if your server ran unpatched PHP while reachable from the internet. Even without taking over a server, one of the flaws can leak memory from other visitors’ requests, which may include passwords, session tokens and API keys (source: The Hacker News). Change admin and database passwords, and rotate keys and tokens stored on the server.
15. Why do PHP2Shell severity scores differ?
Different organizations score the same flaw differently. PHP’s security team rated both flaws 9.2 out of 10 (CVSS v4.0); other organizations score them differently, so we cite PHP’s own score (source: php.net security advisory, October 21, 2026).
16. When does PHP 8.2 reach end of life, and what should I upgrade to?
PHP 8.2 stops receiving security fixes on December 31, 2026 (source: php.net supported versions). Upgrade to PHP 8.4, which gets fixes until December 31, 2028, or 8.5, until December 31, 2029 (source: php.net supported versions). PHP 8.3 only lasts until December 31, 2027, so you’d repeat the work within a year (source: php.net supported versions). Our 8.2 checklist has the steps; WordPress sites still on 7.4 can follow the 7.4 to 8.4 guide.
17. Should we move away from PHP?
No. PHP isn’t the problem; unmaintained PHP is. Current PHP releases fix PHP2Shell (source: php.net release archive). Other technologies have had flaws just as severe: in December 2025, a critical flaw in React Server Components and Next.js was exploited within days of disclosure (source: Google Cloud). Patch, shield and harden now. Modernize on your own schedule, for business reasons.
18. Is a small business website really a target?
More than it used to be. In October 2026, Reuters reported that one attacker used AI agents to try to break into more than 1,200 websites. The attacker broke into sites belonging to more than 100 companies, at about $50 per successful break-in, by one researcher’s estimate (source: Reuters via Honolulu Star-Advertiser). Anthropic reported in September 2026 that AI is cutting attackers’ labor costs, which makes lower-value targets worth attacking (source: Anthropic). The same month, Google’s Threat Intelligence Group said it had not yet observed attackers deploying fully autonomous attack pipelines against real targets, and Anthropic reported that attackers were still heavily involved in choosing targets (source: Help Net Security).
19. How does Oakshield work, and who checks the findings?
We verify and document; at launch we don’t make changes to your servers. We only work on systems whose owner has authorized us in writing. Your developer or host gives us read-only access: a dedicated login that can look but not change anything, shared through a secure link, never by email. AI tools do the repetitive work: inventory, log triage and report drafts. A named person at Oakshield, the Approver of Record, reviews every finding and signs the report. We never run exploits to “prove” a site is vulnerable or fixed; we verify from the inside.