In October 2026, reports about two critical security vulnerabilities in PHP raised concerns among website owners and hosting providers.
Known collectively as PHP2Shell, these vulnerabilities could allow attackers to execute unauthorized commands on affected servers without needing to log in.
This is particularly concerning because PHP is widely used to power websites and web applications. The vulnerabilities affect the PHP software itself, rather than a particular website platform or application.
Here is what happened, why it matters and what website owners can do to protect their websites.
What Is PHP2Shell?
PHP2Shell refers to two security vulnerabilities discovered in the PHP programming language:
- CVE-2026-109618
- CVE-2026-109619
A CVE is an identification number assigned to a known security vulnerability so that it can be tracked and referenced.
Both vulnerabilities received a critical severity rating of 9.2 out of 10. In simple terms, they involve errors in how PHP handles certain information in the server’s memory.
If successfully exploited, an attacker could potentially make the server execute commands without having a legitimate account or logging in first. This type of attack is known as Remote Code Execution (RCE).
Depending on the permissions available to the affected PHP process, an attacker could potentially access sensitive information, modify website files or carry out other unauthorized activities.
Which Websites Are Affected?
PHP is used by many popular website platforms, content management systems and custom-built applications. Examples include:
- WordPress
- Joomla
- Drupal
- Laravel-based applications
- Custom PHP websites and applications
However, the vulnerability is not limited to these platforms. Any internet-facing system running an affected PHP installation may be at risk.
This also means that updating your website application alone will not resolve the issue. Even if your website and its components are fully updated, the underlying PHP software may still be vulnerable.
Which PHP Versions Are Affected?
The PHP development team released security updates on 21 October 2026 to address both vulnerabilities. The following versions include the security fixes:
| PHP Branch | Minimum Fixed Version |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
If your server is running an earlier version within these branches, it should be updated to the corresponding fixed release or a later version containing the security fixes.
PHP 8.1 and older have reached end-of-life (EOL) and no longer receive regular security updates through the official PHP release process. If your website is still running an older PHP version, consider planning an upgrade to a supported version rather than continuing to rely on outdated software.
How to Keep Your Website Secure and Up to Date
Applying the PHP2Shell security fix is important, but website owners should also maintain their website software to reduce security risks and compatibility issues.
Here are some recommended practices:
1. Keep PHP and website applications up to date
Use a supported PHP version and keep your content management system, plugins, themes, frameworks and other website components updated.
Before upgrading PHP, check whether your website scripts and applications are compatible with the newer version. Older or poorly maintained scripts may not work correctly after an upgrade. If you use a third-party application or custom-built website, consult its developer or documentation first.
2. Use strong passwords and secure access
Use unique passwords for your hosting account, website administration and other related services. Enable two-factor authentication where available.
3. Maintain regular backups
Keep regular copies of your website files and databases. Understand how frequently your backups are taken, how long they are retained and how to restore your website if necessary.
4. Monitor unusual website activity
Pay attention to unexpected changes, unfamiliar files, suspicious redirects or unusual website behavior. Contact your hosting provider or website administrator if you suspect unauthorized activity.
What If Your Website Uses Shared Hosting?
For websites hosted on a shared hosting platform, the PHP software installed on the server is generally managed by the hosting provider. The responsibilities are therefore divided:
Hosting provider: Maintains the server environment, applies PHP security updates and manages the server-level software.
Website owner: Keeps website applications and scripts updated, checks compatibility when upgrading PHP, uses secure passwords and maintains regular backups.
If you are unsure whether your hosting environment has received the necessary PHP2Shell security updates, contact your hosting provider for confirmation.
Summary / Conclusion
PHP2Shell highlights the importance of keeping both website applications and the underlying server software up to date.
A website can have fully updated applications and still be exposed if the PHP software running it has not received the necessary security fixes.
Whether you manage your own server or use a shared hosting service, make sure PHP security updates are properly handled. Keeping your website software updated, maintaining regular backups and using secure account access are also essential parts of website security.
