Critical PHP flaws: attack attempts already reported
Is your PHP safe from PHP2Shell?
Two critical flaws in PHP itself could let an attacker take over a web server with a single request. Enter your PHP version for a straight answer, then follow the steps for your situation. There are ready-to-send emails for your host and your clients.
Ready-to-send emails
- Ask your host if they've patchedAsks for your exact PHP version, whether it's fixed, and what happens if it can't be. Fills in your website; copy it or open it in your email app.
- Tell your clients what you're doingA short, calm update for the people whose sites you look after, ready to edit and send.
What's your situation?
- My site is on shared or managed hostingYour host controls PHP. Here's what to ask them, with an email you can send.
- My site runs WordPressWhy plugin updates and security plugins won't fix this, and what will.
- I manage my own serverUpdate commands for Ubuntu, Debian, Red Hat, cPanel, Plesk and Docker.
- I look after sites for clientsCheck every site quickly, decide what comes first, and tell clients.
- I can't get it patched soonWhen to take a site offline, and how to do it so PHP is really switched off.
- I think my site was attackedSigns to look for, and what to do if you find them.
What PHP2Shell is
PHP2Shell is the name for two critical vulnerabilities in the PHP language, CVE-2026-109618 and CVE-2026-109619. PHP runs WordPress, WooCommerce, Joomla, Drupal, Magento and most shared hosting, so a very large share of the web is affected.
Both flaws come from how PHP cleans up when a request is cut short, for example by running out of memory or hitting a fatal error. PHP can leave memory in a broken state, and a crafted request can turn that into running the attacker's own code on your server. Both are rated 9.2 out of 10.
The flaw is in PHP, not in your website. Updating WordPress, your theme or your plugins does not fix it. The PHP on the server has to be updated, which on most hosting means your host has to do it.
- Disclosed and patched
- 21 October 2026
- Login needed to attack
- None
- Versions affected
- PHP 5.4 onwards, every way of running PHP on a web server
- Attacks
- Attempts reported by Cloudflare, Amazon and watchTowr, some before the flaws were public. CISA hadn't confirmed exploitation as of 21 October.
Which PHP versions are fixed
| PHP version | Fixed in | What to do |
|---|---|---|
| 8.5 | 8.5.12 | Update to 8.5.12 or later |
| 8.4 | 8.4.27 | Update to 8.4.27 or later |
| 8.3 | 8.3.36 | Update to 8.3.36 or later |
| 8.2 | 8.2.35 | Update to 8.2.35 or later |
| 8.1, 8.0, 7.4 | No official release | End of life. Source patches exist, so ask your host if they've applied one. Otherwise move to 8.2 or newer. |
| 7.3 and older, PHP 5 | No fix | Upgrade to a supported version |
Linux distributions (Ubuntu, Debian, Red Hat and others) and hosting vendors often add the fix without changing the main version number. If your version has extra text after it, like 8.1.2-1ubuntu2.19, see checking vendor builds.
Who's giving advice
This guide follows the official advisories below. Where they differ on detail, we go with the PHP project's own figures.
Government agencies
- CISAUnited StatesPatch immediately; take PHP systems offline if you can’t, or if you run PHP 8.1 or older.
- NSAUnited StatesInventory PHP, patch, and take systems offline if an immediate update isn’t feasible.
- National Cyber Security CentreUnited KingdomFind every PHP install, update, apply temporary measures, and consider going offline if you can’t.
- EU joint statementEuropean Commission, ENISA, CERT-EU, EuropolApply the updates; consider isolating exposed applications until fixed.
- National Cyber Security CentreIrelandPatch internet-facing systems first; isolate end-of-life PHP if it can’t be mitigated.
- NCSC-NLNetherlandsA list of software products that include PHP and may be affected.
PHP itself
- The PHP projectphp.netThe official advisory: fixed versions, temporary measures and backports.
Security companies and researchers
- CloudflareWeb securityFirewall rules for every plan, and early attack traffic.
- ImpervaWeb securityTechnical analysis and signs of exploitation to look for.
- SophosSecurity vendorAdvisory with patching, detection and interim steps.
- watchTowrSecurity researchExploitation seen in its honeypot network.
- SansecE-commerce securityTechnical research write-up.
Distribution and hosting-panel notices (Ubuntu, Debian, Red Hat, cPanel, Plesk and others) are on the sources page.
Questions
Do I need to do anything if my host manages everything?
Yes: check, don't assume. Find your PHP version and compare it with the table above. If it's not fixed, ask your host when it will be. Our hosting guide has an email you can send.
Does Cloudflare protect me?
If your site's traffic goes through Cloudflare's proxy (the orange cloud), its emergency rules block known PHP2Shell attacks on every plan, including free. That helps a lot while you wait for a patch, but new attack methods appear over time, and only a PHP update fixes the flaw.
Can you check my site from the outside instead?
Partly. Our outside look-up reads what your site reveals to visitors. Most well-run sites hide their PHP version, so it often can't give a verdict. Your actual version number, from your hosting panel or WordPress, is the reliable way.
Is my information stored when I check a version?
No. The version check runs entirely in your browser and nothing is sent to us.