PHP2Shell is the name given to two very serious flaws in PHP (CVE-2026-109618 and CVE-2026-109619) that let anyone, with no password and no click from you, run commands on the server your website lives on. PHP shipped the fixes on 21 October 2026. If your site runs on PHP, WordPress included, and nobody has updated it, the right moment was this morning. The second best moment is now.
Here is what happened, how to tell in five minutes whether it concerns you, what to do today and how to spot whether someone is already inside. No panic: panic doesn't update servers. But neither does "it won't happen to me".
This guide is simplified as much as possible, but if you have handed your website over to someone else or it all feels too complicated to tackle, there is good news at the end of the article. Translation: if you have no idea what PHP even is, skip the explainer and write to us directly. You have just won a free consultation!
What PHP2Shell is, minus the conference jargon
PHP is the language behind WordPress and a mountain of sites built over the last twenty years. The two flaws are memory-handling bugs: sessions, the class cache (OPcache) and the moment PHP writes the details of a fatal error. By exploiting them, an attacker can end up running code on the server. The jargon is "remote code execution"; in plain English, "they took your site".
PHP rated them 9.2 out of 10 on the CVSS scale. The security firm watchTowr, in its FAQ, judged them even worse. According to the PHP team's statement, every installation that serves web requests is affected: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
Why this isn't your usual "experts only" bug
- The details leaked before the fix. SecurityWeek talks about mass exploitation on the way, and Cloudflare reported signs of attacks even before the patches were released.
- A public exploit exists. When there's a tutorial, you no longer need to be good: you just need to be many. And bots scan everything, including the bakery site you haven't touched since 2019.
- The fixes only cover recent branches: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If your hosting is stuck on an older version, no patch exists for you, and the only way out is to change version. BleepingComputer sums up the picture.
Does it concern you? Three questions, five minutes
- Is your site built with WordPress, or with PHP in general? If you don't know, look in your hosting panel: if it says PHP and a version number, it is. If "a clever kid" built the site three years ago and nobody ever told you what with, it's almost certainly WordPress.
- Which PHP version does it use? Again from the hosting panel, usually under "PHP" or "PHP version". If it's older than 8.2, or an 8.x that isn't one of the patched ones, you have a problem.
- Do you have an old site you "don't use any more"? The one you moved elsewhere and left online "just in case"? That's exactly where the bots go shopping.
If the answer to the first question is no, you're fine on this one.
What to do today
- Update PHP to a fixed version (8.2.35, 8.3.36, 8.4.27 or 8.5.12) from the hosting panel or by asking your provider. Many hosts do it in one click. Others reply "we are evaluating": in that case you do the evaluating, and it may be time to change host.
- Take a backup first. Old plugins and themes sometimes break on newer PHP versions. That's a good reason to test on a copy, not to stand still.
- Update WordPress, plugins and themes too. It's not the same flaw, but they are the number one back door. In July, for example, wp2shell made the news: another pair of critical WordPress flaws already exploited to install webshells (the fixed versions are 7.0.2, 6.9.5 and 6.8.6).
- The old site you no longer use: back it up and switch it off. A site nobody looks at and nobody updates is an open window with a "welcome back" sign.
How to tell whether someone is already in
Updating closes the door, but it doesn't tell you whether someone is already inside the house. Typical signs of a compromised site:
- .php files you don't recognise, especially in the uploads folders (wp-content/uploads), where there should be no PHP at all;
- admin users you didn't create;
- pages about pills, betting or watches that you never wrote, sometimes visible only to people arriving from Google;
- the site slowing down for no reason, or redirecting to odd pages;
- warnings from your host or from Google about a "dangerous" site.
If you find anything like that, deleting the odd file isn't enough: every password has to change (WordPress, database, hosting, linked email) and someone has to work out how they got in, otherwise they come back.
What we still don't know
With a story this fresh, honestly, a few pieces are missing. Some sources say the flaws go back to PHP 5.4; watchTowr writes that this scope has not been confirmed by an official vendor advisory. We only tell you what can be verified: the fixed versions are the ones above, and the rest should be checked against PHP's official advisory. If someone promises you absolute certainty on day one, they're selling something.
Want to know how much you're exposed? Let's find out together, free
If while reading you thought "okay, but I don't even know where my hosting is", you're in good company. That's why we offer a free consultation to assess your risk: you tell us which sites you have (the forgotten one too), and we look with you at what's running, on which version, where the backups are and whether there are signs of trouble. At the end you get a clear picture: what's fine, what needs fixing, what is better switched off.
If you need real work, we tell you what and how much it costs. If you need nothing, we tell you that too: we're used to it by now.
To book it: write to info@sarabi.cloud with "Website security check" in the subject, or use the contact form.
Have a similar case or a doubt? Write to us at info@sarabi.cloud.