PHP2Shell explained: what happened and what to do now

Q: What is the PHP vulnerability?

Two critical bugs in PHP itself, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. They let an attacker run code on a web server without logging in. PHP fixed them on Oct 21, 2026, in 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Q: Is my site vulnerable?

It is at risk if it runs PHP older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and your host has not applied a backported fix. Use the free checker on this site, then confirm with your host.

Q: How do I check my PHP version?

Look in your hosting control panel, such as cPanel or Plesk. If you have server access, run php -v. On hosts that backport fixes, check the build date in phpinfo(): GoDaddy says a fixed build can keep an older number, such as 8.5.11.

Q: What should I ask my host?

Ask: Are my sites on PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later, or on a build with the Oct 21, 2026 fix backported? Have PHP workers been restarted? If I am on 8.1 or older, what is my upgrade path?

Q: Do I need to do anything on WordPress?

Yes, check. WordPress runs on PHP, and a WordPress core or plugin update does not update PHP. PHP is updated by whoever runs your server: your host on shared or managed hosting, or you on a VPS.

Q: Is GoDaddy affected?

GoDaddy calls it an industry-wide PHP issue, not specific to GoDaddy. On Oct 22, 2026, it said it had patched all PHP versions on Web Hosting, Windows Hosting and Managed Hosting for WordPress, with no customer action needed. VPS customers must update PHP themselves.

Q: Why did government websites go offline?

CISA, the NSA and national agencies advised taking unpatched PHP systems offline. The Dutch government took sites such as Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution on Oct 21, 2026. Canada's Treasury Board said some Government of Canada websites may be temporarily unavailable while updates are applied. Yle reported that Finland's government ICT centre, Valtori, took public government web services offline as a precaution.

Q: Did AI find the PHP bugs?

Yes, with human researchers. OpenAI says Calif found a critical flaw using its GPT-5.6 Sol model in its Patch the Planet program. Wiz says it found the flaws independently using AI models, and reported them on Aug 24, 2026.

Q: Is it being exploited?

watchTowr says its honeypots saw exploitation of both CVEs on Oct 21, 2026. Singapore's Cyber Security Agency reports widespread exploitation attempts. CISA said it had not observed exploitation as of its Oct 21 alert. Treat it as active and patch now.

By Keith Motte, Topofmind.AI, former AWS Enterprise Support Manager who ran about 20 end-of-life and patch campaigns for healthcare customers. Last updated Oct 22, 2026.

Short answer: On Oct 21, 2026, PHP fixed two critical flaws that let attackers take over web servers without a password.^[1][5] If your site runs PHP, make sure it is on 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later, or on a host build with the fix backported.^[1][13]

What to do now (15 minutes)

Run the free check on a domain you own.
Find your PHP version in your hosting control panel.
Send your host the questions in What to ask your host.
On a VPS or your own server, update PHP and restart PHP workers.^[6]
On PHP 8.1 or older with no fix, take the site offline until it is patched or upgraded. That is CISA's advice.^[5]

What happened

The bugs: CVE-2026-109618 and CVE-2026-109619. Both allow unauthenticated remote code execution.^[1][5]
Severity: 9.2 under CVSS v4.0 from the PHP security team; 9.8 under CVSS v3.1 from NVD.^[1][3][4]
Affected setups: PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP rates mod_php highest risk.^[1]
Age: Wiz says every PHP release of the last decade, back to 5.4, has at least one of the bugs.^[12]
Name: "PHP2Shell" comes from CISA and researchers. The PHP advisory does not use it.^[1][5]

Timeline (2026)

Aug 24: Wiz reports the flaws to the PHP security team. OpenAI says Calif found a critical flaw in its Patch the Planet program.^[11][12]
Oct 20: PHP gives advance notice of a critical release.^[1]
Oct 21: PHP releases the fixes. CISA and the NSA publish advisories. The Dutch government takes sites offline as a precaution.^[1][5][7][8] Yle reports Finnish government web services offline.^[9] Canada's Cyber Centre says some websites may be unavailable while patches are applied.^[15]
Oct 21: watchTowr reports exploitation in the wild.^[6]
Oct 22: GoDaddy says Web Hosting is fully patched. Canada's Treasury Board says it has no indication any Government of Canada systems were compromised.^[13][10]

Who is affected

Anyone whose website or app runs on a PHP server that has not been patched. W3Techs reports PHP on 69.3% of websites whose server-side language it can identify (Oct 22, 2026).^[16] WordPress, Drupal and Joomla run on PHP.^[12] The NSA says the flaws are in PHP itself, not in your application, so a well-built site on unpatched PHP is still exposed.^[7]

WordPress and shared hosting

A WordPress update does not update PHP. Whoever runs the server does.
On shared or managed hosting, that is your host. On a VPS, it is you.^[13]
Some hosts backport the fix and keep the old version number. GoDaddy says a fixed site can still show 8.5.11; check the phpinfo() build date instead.^[13] The checker on this site reads only the version number, so it can say "Likely vulnerable" for a patched backport. Confirm with your host.

How to check your PHP version

Control panel: cPanel and Plesk show the PHP version for each site.
Command line: run php -v. The command-line PHP can differ from the one serving web requests, so compare with step 3.^[6]
phpinfo(): a private page with <?php phpinfo(); shows version and build date. Delete it right after.
From outside: the free check reads what your server announces.

What to ask your host

Copy and send:

Are my sites on PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later, or on a build with the Oct 21, 2026 PHP2Shell fix (CVE-2026-109618, CVE-2026-109619) backported? Have PHP workers been restarted? If I am on 8.1 or older, what is my upgrade path and date?

If you are on PHP 8.1 or older

The PHP project shipped no new release for 8.1 or older. It published minimal source backports for 7.4, 8.0 and 8.1.^[1] CISA says to take these systems offline until patched or upgraded.^[5] Plan your move to a supported branch. PHP 8.2 itself reaches end of life on Dec 31, 2026.^[1]

FAQ

What is the PHP vulnerability?