Is Your Website Affected by the PHP2Shell Flaw?

A PHP flaw called PHP2Shell can let attackers take over unpatched websites. Here's how to tell if yours is affected and what to ask your web host.

2026-11-10 · Chris Coulson

An owner's guide to PHP2Shell, what to ask your web host, and who should handle website updates.

By Chris Coulson, Coulson Technologies · York, PA

Chris Coulson has 40+ years of IT experience and runs Coulson Technologies in York, PA.

If someone else built or hosts your website, you may not know whether it runs PHP — or whether anyone applied the October 2026 security update. This guide explains the flaw in plain English, how to tell if your site is involved, and the questions to send your web host or developer.

This is about your public website, booking page or customer portal. It is not about patching the computers in your office, and it is not about equipment a supplier installed at your location.

What is PHP2Shell?

PHP2Shell is the name security agencies use for two serious flaws in PHP, the software that runs many websites. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) calls the pair "php2shell" and identifies them as CVE-2026-109618 and CVE-2026-109619. They allow someone who is not signed in to run their own code on the server, without a password or an account on your site. That is what "remote code execution" means.

On October 21, 2026, the PHP project released emergency updates — versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — and said every installation that serves website requests should apply them right away. The FBI's Internet Crime Complaint Center warned on October 23 that the flaws could put sensitive information and business operations at risk. On October 26, CISA listed both as known exploited vulnerabilities. If an update cannot happen right away, CISA and the FBI recommend taking the affected system offline until it can be fixed.

How do I know if our website, portal or vendor tool runs PHP?

If your site runs on WordPress, it uses PHP. The same is true for many other hosted websites, and for a lot of booking pages, customer portals and online stores that a vendor runs for you.

The WordPress project says you can look this up yourself: sign in and go to Tools, then Site Health, then Info, then Server. That screen shows the PHP version your site is using. If you do not use WordPress, check your hosting control panel or ask the person who built or hosts the site.

Compare the number you see with 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a later version in the same line. The U.S. Chamber of Commerce owner guide notes that some hosts install the fix without changing the version number you see, so ask for written confirmation rather than guessing from the number. PHP 8.1 and older no longer receive updates from the PHP project; CISA says those systems should be taken offline until they are upgraded.

If a vendor runs your booking calendar, customer portal or payment page, send them the same questions. CISA notes that PHP is often built into other software and may not be obvious.

Does updating WordPress fix PHP2Shell?

No. The WordPress security team said these flaws are not specific to WordPress, and that no WordPress update is required or planned. Updating WordPress, your theme or your plugins is still good practice, but it does not patch PHP. The fix has to happen on the server.

The Chamber warns owners not to install an unofficial "PHP2Shell fix" plugin or a code snippet from a forum or social post. Some of those unofficial fixes may contain malware. Use your host's official website or phone number, and be wary of unexpected emails or calls offering a fix.

What questions should I send my web host or developer?

Copy the questions below, send them today, and keep the reply in writing.

Please confirm whether our website is patched for the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619).

1. Which version of PHP is running our website right now, and does it include the official fixes? The patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If our version number looks older, has your vendor applied the fix without changing that number?
2. When was the fix applied, and were PHP and the web server restarted afterward so the new version is actually running?
3. Have you reviewed our logs for suspicious activity since mid-October — from October 17, 2026 onward — including PHP unexpectedly launching extra programs or downloading files?
4. Have you checked for new or unfamiliar administrator accounts, unfamiliar files, unexpected scheduled tasks, or other signs of a break-in since then?
5. Do we have a recent backup of the website stored somewhere other than this same server?

If you host other sites or tools for us, including test sites, older sites we no longer use, or a booking or payment page, please confirm those are covered too. If we are on PHP 8.1 or older, what is the plan and timeline to upgrade?

A restart matters because the new version may not run until PHP and the web server are restarted. The Chamber says attack attempts may date back to October 17, 2026. After a confirmed fix, it also recommends changing website admin and hosting passwords and turning on multi-factor authentication — an extra login step, such as a code on your phone.

Who is responsible for updating our business website going forward?

Someone needs a named job, in writing. In many small businesses the designer built the site, the host keeps it online, and the owner assumes updates are handled.

Think of three separate jobs:

• Keeping WordPress, themes and plugins updated. That still does not fix a PHP problem.
• Keeping PHP and the server updated. That is usually the host's work, but it is not always automatic, and not every plan is covered the same way.
• Confirming the work was done. That last job belongs to the business.

Write down who owns each job, including booking or payment tools a vendor runs for you. PHP 8.2 stops receiving official security updates from the PHP project after December 31, 2026, so plan that upgrade if you use it.

If you cannot get a straight answer, CISA and the FBI say to take the system offline until it can be patched. A web application firewall — a service that screens incoming traffic before it reaches your site — may help in the meantime, according to CISA, but the Chamber calls that a stopgap, not a fix.

If you find signs of a break-in, isolate the affected systems, preserve the web server and PHP logs, and report it to the FBI's Internet Crime Complaint Center or your local FBI field office.

Coulson Technologies helps businesses in York, Lancaster and South Central Pennsylvania with cybersecurity. If you want a second opinion on who should handle website updates, get a free assessment. It is a conversation, not a technical scan of your site.

We improve the way you work.

What else do owners ask about PHP2Shell?

What is PHP2Shell?

PHP2Shell is the name CISA and other security agencies use for two critical flaws in PHP (CVE-2026-109618 and CVE-2026-109619). They can let an attacker run their own code on an unpatched web server without logging in.

Is my WordPress site affected by PHP2Shell?

WordPress sites run on PHP, so they can be affected if the server has not been updated. The problem is in PHP, not in WordPress itself, so you still need your host or developer to confirm the server fix.

How do I check which PHP version my WordPress site uses?

In WordPress, go to Tools, then Site Health, then Info, then Server. Compare what you see with the patched releases — 8.5.12, 8.4.27, 8.3.36 or 8.2.35 — and ask your host to confirm, because some hosts apply a fix without changing the version number.

Does updating WordPress fix PHP2Shell?

No. WordPress says no WordPress update is required or planned for these issues. The fix has to happen in PHP, on the server.

What should I ask my web host about the PHP update?

Ask which PHP version is running, whether it includes the PHP2Shell fixes, whether PHP and the web server were restarted, whether logs and administrator accounts have been checked since mid-October, and whether you have a recent backup stored somewhere other than the same server. Get the answers in writing.

Who is responsible for updating my business website?

The host or developer usually applies the PHP update, but the business still needs a named person who confirms the work was done. Updating WordPress is a separate job and does not patch PHP.

What if we cannot update PHP right away?

CISA and the FBI recommend taking the affected system offline until it can be patched. A web application firewall may offer some protection in the meantime, but it is not a substitute for the update.

Which sources support this guide?

Outside facts in this guide come from these pages, checked November 10, 2026.

• CISA: Critical Vulnerabilities in PHP Require Immediate Patching (alert dated October 21, 2026; last revised October 26, 2026).
• FBI IC3: Critical Vulnerability Alert: PHP Core (alert number I-102326-PSA, October 23, 2026).
• PHP.net: Security advisory on critical remote code execution vulnerabilities (October 21, 2026).
• WordPress.org: Critical PHP Security Release (John Blackbourn, October 21, 2026).
• U.S. Chamber of Commerce CO: A Security Flaw Is Affecting Millions of Websites: What Small Business Owners Need to Do (Bill Jewell, published October 22, 2026).