PHP2Shell Vulnerabilities: What to Check and Fix Right Now
Two new vulnerabilities in PHP, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), can let an attacker run unauthorized code on a web server without signing in. The PHP project released security updates on October 21, 2026.
PHP is the software behind a huge number of websites and web applications, including WordPress. If your organization has a public website, a customer portal, or any web-facing application, there’s a good chance PHP is running somewhere underneath it.
The good news: the fix is a PHP update, and the steps to confirm you’re covered are short.
Quick takeaway: If any of your web-facing systems use PHP, confirm the server is running PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12, or a later release in the same branch. Updating WordPress, themes, or plugins does not update PHP, your host or server administrator has to do that.
What Is PHP2Shell?
PHP is a programming language that runs on web servers and builds the pages people see. Because it sits on the server, a flaw in PHP itself affects every site running on that server no matter how well the site is built.
PHP2Shell is the name being used for two related vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The short version of what they allow: an attacker can run their own code on an affected web server without logging in. That’s the part that matters. No stolen password or phishing email, just a reachable, unpatched server.
You don’t need to understand the technical details to act on this. You need to know whether you run PHP and whether it’s patched.
Does This Affect You?
Probably worth checking if you have any of the following:
- A WordPress website. WordPress runs on PHP.
- A customer or vendor portal that’s reachable from the internet.
- Custom or third-party web applications hosted internally or by another company.
- A website managed by an outside web agency or hosting provider. You may not know what’s running underneath.
If CIT manages the service, we’ve already contacted customers we know to be affected. This post is for everything else: the sites and systems your team or another provider manages.
Five Steps to Check and Fix Your Exposure
1. List your web-facing services. Write down your website, customer portals, and any other application the public can reach from the internet. Include anything managed by another provider.
2. Confirm whether each one uses PHP. Your IT team, web developer, or hosting provider can tell you quickly. If it’s WordPress, the answer is yes.
3. Check the PHP version and patch it. The October 21 fixes are included in these releases (or any later release in the same branch):
| If you run this PHP branch | Update to at least |
|---|---|
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |
Some vendors ship the same fixes through their own updated packages, so your version number may look different. If so, ask the vendor to confirm the fix is included.
4. Review PHP’s October 23 follow-up guidance. The PHP project published additional configuration recommendations after the initial fix. Administrators should review them and apply any that fit your environment.
5. Ask your provider if someone else manages your site. Don’t assume they’ve handled it. Send them the questions in the next section and get the answer in writing.
A Note for WordPress Site Owners
This trips up a lot of people: updating WordPress, your theme, or your plugins does not update PHP. PHP lives on the server, not inside WordPress. A site can show “all plugins up to date” and still run a vulnerable PHP version.
Your hosting provider or server administrator may need to make the PHP update. Many hosts let you pick the PHP version from a control panel, but if you’re not sure, ask them rather than guessing. See Wordfence’s guidance for WordPress site owners for more.
What to Ask a Provider That Manages Your Website
Copy and paste these into an email:
- Does our website or application use PHP, and which version is it running?
- Have the October 21 security fixes been applied? (PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12, or later – or an equivalent vendor package.)
- Have the recommended configuration changes from PHP’s October 23 guidance been applied?
If they can’t answer clearly, that’s worth knowing too.
Common Mistakes to Avoid
1. Assuming “someone else” handled it. Hosting companies, web agencies, and internal teams all assume the other one patched. Get confirmation from a named person.
2. Updating WordPress and calling it done. WordPress updates don’t touch PHP. Check the server.
3. Patching the main website but forgetting everything else. Portals, staging sites, old microsites, and forgotten test servers run PHP too. If it’s reachable from the internet, it’s in scope.
4. Stopping at the patch. PHP published follow-up configuration guidance on October 23. Read it.
5. Waiting for a convenient maintenance window. Because these flaws don’t require an attacker to sign in, treat this as a priority update, not a someday task.
How CIT Can Help
CIT’s managed cybersecurity services and Managed IT Services teams can help you work out what you’re running, who owns it, and whether it’s patched – including systems that sit with another provider and need someone to ask the right questions.
If you’re a CIT customer, reach out to your Account Manager. They can help you figure out who should review a given system.
Frequently Asked Questions
What is PHP2Shell?
PHP2Shell is the nickname for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They can allow an attacker to run unauthorized code on an affected web server without signing in. The PHP project released security updates on October 21, 2026.
What PHP versions fix PHP2Shell?
The October 21 fixes are included in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, as well as later releases within those branches. Some vendors provide equivalent fixes through their own updated packages.
Does PHP2Shell affect WordPress?
WordPress runs on PHP, so a WordPress site on an unpatched PHP version can be exposed. The vulnerability is in PHP itself, not in WordPress, so the fix happens at the server level.
I updated WordPress and all my plugins. Am I safe?
Not necessarily. Updating WordPress, themes, or plugins doesn’t update the underlying PHP software. Your hosting provider or server administrator may need to apply the PHP update.
How do I know if my website uses PHP?
Ask your IT team, web developer, or hosting provider. If your site is built on WordPress, it uses PHP. Many customer portals and custom web applications do too.
Who should fix this if another company manages my website?
That provider. Contact them directly and ask whether PHP is used, whether the security fixes are applied, and whether the recommended configuration changes are in place. Ask for the answer in writing.
Is patching enough?
Patching is the main fix, but the PHP project also published follow-up configuration guidance on October 23. Administrators should review it and apply what’s relevant to their environment.
How can CIT help with PHP2Shell?
CIT can help you identify which web-facing systems use PHP, confirm whether they’re patched, and coordinate with the providers that manage them. If you’re a customer, start with your Account Manager.
Not sure whether your website is covered?
You shouldn’t have to chase a hosting company for an answer. Talk with the CIT team and we’ll help you find out what’s running, who owns it, and what needs to be fixed. Start with a free Cybersecurity Gap Analysis.