PHP2Shell Explained: What Every Small Business With a Website Needs to Know

What happened

PHP is the language behind roughly seven in ten websites with a known server-side language. It powers WordPress, which alone runs about 43% of the web, plus Drupal, Joomla, Magento and countless custom sites. On October 21, 2026 the PHP project shipped emergency releases for two flaws it rates 9.2 out of 10. Security researchers nicknamed the pair PHP2Shell, because that is what they do: turn a web request into a shell on your server.

The two bugs are CVE-2026-109618, where PHP running out of memory mid-request leaves half-built internal data that later cleanup trusts, and CVE-2026-109619, where state from one request survives in a worker and gets reused by the next. Both let an attacker who has never logged in send a crafted request and run their own code with the website's permissions: read the database, change pages, plant a backdoor that survives the patch.

Every PHP install that serves web traffic is in scope, on every branch back to PHP 5.4 from 2012. PHP says the risk is highest on Apache with mod_php, where the attack lands before your site's own code runs. The researchers who found the bugs confirmed pre-authentication exploits against WordPress, Drupal, Joomla and Magento.

The numbers that matter

Which PHP versions are fixed

Linux distributions and hosting vendors received the patches early and may backport the fix under an older version number. Check the package changelog for both CVE IDs rather than trusting the version string.

How the disclosure unfolded

1. August 2026Calif, working in OpenAI's "Patch the Planet" program, and Wiz, part of Google Cloud, each find the flaws and report them privately to PHP. One bug had been spotted in a 2024 audit and never fixed.
2. October 17Amazon's threat intelligence honeypots log the first exploitation attempt, four days before anything is public.
3. October 20Details leak on social media. PHP posts an advance notice and moves the release up a day. Cloudflare sees early attack traffic and ships emergency firewall rules.
4. October 21, 14:00 UTCPHP releases the fixes. CISA publishes its alert. Government sites in the Netherlands, Finland and France, the Internet Archive and Wikimedia support services go offline to patch.
5. October 22Hosts across the WordPress ecosystem roll out patched PHP over the following days. watchTowr, Hadrian and Amazon report exploitation attempts at scale. More than a million exposed hosts estimated, most on end-of-life branches.

What the agencies said

This is rare. Cybersecurity agencies on three continents issued alerts within a day, and several told organizations to take unpatched sites offline rather than wait.

CISA (the U.S. Cybersecurity and Infrastructure Security Agency) says the flaws affect "all PHP installations serving web requests." Its checklist: inventory every system running PHP, because PHP is often buried inside other software; patch, prioritizing anything facing the internet; treat a web application firewall as temporary help; and if you cannot update right away, or you are still on PHP 8.1 or older, take PHP-based systems offline until they are fixed. CISA had not observed exploitation at publication, but said unpatched systems remain at risk.

The FBI Cyber Division warned that the two CVEs could let malicious actors remotely execute code in PHP core and urged immediate patching. If you find signs of compromise, its guidance is to isolate the affected systems, preserve your web server and PHP logs, and report to your local FBI field office or ic3.gov.

The UK NCSC issued guidance the day of the release and was blunt about end-of-life installs: unsupported PHP that cannot be updated must be taken offline. It also warned organizations to check for backdoors left behind by attacks that may have landed before the patch. CERT-EU said the flaws could affect every PHP version since PHP 5 and told organizations to isolate internet-facing PHP applications where immediate patching is not possible. Singapore's Cyber Security Agency reported widespread exploitation attempts and told organizations to check for PHP even on servers whose main site does not use it, since third-party tools often do. Japan's National Cybersecurity Office and Australian authorities urged immediate updates.

Where they disagree: whether widespread exploitation has already happened. CISA had not confirmed it. Several security vendors say they are watching it happen. Either way, the advice is the same: patch now, restart workers, and isolate what you cannot fix.

Patch now, restart workers, and isolate what you cannot fix.

Does your website run PHP?

Most small-business owners do not know, and that is fine. Here is the short version.

Yes, almost certainly

• WordPress, WooCommerce, Divi, Elementor
• Drupal, Joomla, Magento, PrestaShop, OpenCart
• Laravel or any custom PHP application
• Anything on cPanel, Plesk or shared hosting
• An old site a developer built years ago that nobody touches

Your host or server admin must update PHP. Get written confirmation.

Your platform handles it

• Shopify, Squarespace, Wix, Webflow
• WordPress.com and fully managed WordPress hosts
• Toast, Square Online and similar hosted storefronts

You do not control PHP, so you cannot patch it yourself. Check the platform's status page or ask support whether the fix is live, not just scheduled.

No PHP at all

• Static HTML and JavaScript sites on Cloudflare, Netlify or Vercel
• Every standard VIBE89 build

There is no PHP process on the server, so there is nothing for PHP2Shell to reach. Still worth confirming any third-party tools you embed.

The 30-minute checklist

Condensed from the PHP advisory, CISA's alert and what hosts have been telling their customers. Most of it is email.

1. Work out who controls PHP.Your host, your developer, an IT provider, or you. Whoever it is owns the update. Routine WordPress and plugin updates do not touch PHP.
2. Ask your host three questions, in writing.Which exact PHP build is serving my site? When were the PHP workers restarted? Does that cover every domain, subdomain and staging site on my account? Keep the reply.
3. If you are on PHP 8.1 or older, plan an upgrade.There is no normal patch. Ask the host for their fix date. If there is none, upgrade to 8.3 or newer, isolate the site, or move it to a build that does not run PHP.
4. If you run your own VPS, update today.Install the vendor package or the 8.x release for your branch, then restart PHP-FPM or Apache so every worker picks it up. PHP's interim settings reduce exposure but are not a fix on their own.
5. Look for signs of compromise.New PHP files in uploads or the web root, new admin users, new cron jobs, a web server process spawning a shell. If you see any, isolate the server, keep the logs, rotate every password and key, and report it to ic3.gov.
6. Do not run exploit code from the internet.Proof-of-concept scripts circulating online are unverified, and several researchers warned they may carry malware. Test with a reputable scanner or ask someone you trust.

Two questions we keep getting

Does Cloudflare or a firewall protect me?

It helps but it is not a fix. Cloudflare published emergency firewall rules, including on its free plan, and calls them a stopgap. CISA says a WAF may provide some protection until systems are updated. The only complete fix is the PHP update.

Should I take my website offline?

CISA, the UK NCSC and CERT-EU all said that if you cannot patch promptly, or you are stuck on PHP 8.1 or older, taking the site offline or isolating it is the safer option until it is fixed. A maintenance-mode plugin does not count, because PHP still handles the request before the plugin runs. Use a holding page at the CDN or host level instead.

What a site with no PHP changes

Our standard build is hand-coded HTML and JavaScript on Cloudflare's edge. There is no PHP runtime, no plugin stack and no database to break into, so this entire class of bug cannot touch it, and there is nothing to patch the next time one appears. That is not the same as risk-free: our contact forms run on small Cloudflare functions we keep updated, and any third-party tool you embed is still its vendor's responsibility. But for a brochure site, a menu, a booking page or a portfolio, it removes the most common way small-business websites get hacked.

Sources

• PHP security release announcement, October 21, 2026
• GitHub advisory for CVE-2026-109618
• GitHub advisory for CVE-2026-109619
• CISA alert: Critical Vulnerabilities in PHP Require Immediate Patching
• Singapore Cyber Security Agency alert AL-2026-151
• CyberScoop: PHP releases emergency fixes
• Tenable FAQ on php2shell
• watchTowr PHP2Shell FAQ
• Rapid7 emergent threat response
• The Hacker News: what actually protects you
• Malwarebytes: why websites are going offline
• Wikipedia: PHP2Shell

This guide summarizes public guidance as of October 22, 2026, reviewed October 29, 2026. It is general information, not legal or incident-response advice. If you believe customer data was exposed, talk to counsel and report to ic3.gov.