PHP2Shell: is your website or business system affected?

On 21 October 2026, PHP released an urgent update for two flaws that let an attacker run their own code on a web server, without logging in. PHP's own advice is short: everyone should update immediately.^⁠[1]

The pair has been nicknamed PHP2Shell. Singapore's Cyber Security Agency reports widespread attempts to exploit them already.^⁠[2]

Are you affected?

PHP is the language behind WordPress and WooCommerce, and behind many custom business systems, including those built with Laravel or CodeIgniter. The flaws sit in PHP itself, not in your code. So every PHP installation that serves web pages is at risk, whatever runs on top of it.^⁠[1]

Check the places you might not think of too. A system written in another language can still share its server with PHP: a WordPress blog, phpMyAdmin for the database, an old admin panel or a forgotten staging copy. Singapore's agency asks organisations to check every web server for PHP, including where only another application uses it.^⁠[2]

Why a WordPress update doesn't fix it

WordPress and its plugins run on PHP, and PHP is installed on the server. Updating WordPress changes WordPress. It doesn't touch the PHP underneath.

The fix is PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or a Linux package that includes the same fix. Whoever runs your server has to install it.^⁠[1]

Who that is depends on where your site or system runs:

• Shared hosting with cPanel or Plesk: your hosting company. Ask: “Is the PHP version my site uses fixed for CVE-2026-109618 and CVE-2026-109619?”
• A cloud server or VPS your developer set up: your developer, or whoever has the server login. Ask: “Have you installed the fixed PHP and restarted it?”
• Docker containers: your developer. Ask: “Have you rebuilt the images on a fixed PHP image and redeployed them?”

On shared hosting, each site often picks its own PHP version in the hosting panel. Check which one yours uses.

What to ask this week

Send your developer or host these four questions:

1. Which PHP version does each of our sites and systems use? Include anything else on the same servers.
2. Is the fix for CVE-2026-109618 and CVE-2026-109619 installed, and has PHP been restarted? Linux vendors got the fix in advance and ship it in their own PHP packages.^⁠[1] Those packages don't always carry PHP's new version numbers, so ask about the fix, not just the number.
3. Are any of them on PHP 8.1 or older? If so, see the next section.
4. Have you checked for signs that someone got in? Amazon saw an attack attempt on 17 October, four days before the fix came out.^⁠[3] So patching now still leaves the days before it unchecked. Ask for a look at new admin accounts, unfamiliar files and unusual activity since mid-October.

If the answer to the last one turns up a break-in that touched customer data, Malaysian law starts a clock. A breach likely to cause significant harm, or one affecting more than 1,000 people, must be reported to the Personal Data Protection Commissioner within 72 hours.^⁠[4]

If you're on PHP 8.1 or older

The PHP project no longer updates PHP 8.1 and older, so there is no regular fix for them. Some Linux vendors provide one for their own packages, so ask whoever runs the server first.^⁠[1]

PHP lists temporary settings that reduce the risk, but says plainly that they don't make a server safe.^⁠[1] They buy time for an upgrade. They aren't the fix.

The lasting answer is to move to PHP 8.3 or newer. Skip 8.2: its security fixes end on 31 December 2026.^⁠[5]

On an old system, that upgrade usually means changing code and testing it, not just flipping a switch. The framework often has to move up a few versions too. So split the work in two:

• This week: whatever can be done now, from a vendor's fixed package to the temporary settings and tighter access.
• Next: the upgrade itself, planned and tested before it goes live.

Why a working system can still be a risk explains why old versions keep causing this.

If nobody can answer

This is where many businesses find out that the developer who built the system has moved on, or that nobody in the company has the hosting login.

Start by getting access back. The hosting account, the domain and the server should be in your company's name, with a person you can reach looking after them. Who should own the code, hosting and accounts? covers what to hold. Taking over software from another vendor covers what to check when a new team steps in.

Common questions

Our website is behind Cloudflare. Are we covered?

Partly, for now. Cloudflare added firewall rules for the known attacks. It calls them a stopgap, and they only cover traffic that passes through Cloudflare.^⁠[3] Update PHP anyway.

How do I see which PHP version my WordPress site uses?

In the WordPress dashboard, go to Tools, then Site Health, then Info, and open Server. That shows the version number. It doesn't show whether your host's build has the fix, so still ask.

Is this the last PHP update for now?

Probably not. On 23 October, PHP flagged a related problem that affects some setups. PHP is dealing with it in its next regular release, and until then suggests turning off a setting called session upload progress.^⁠[6] Whoever updates your PHP should watch for that release too.

We only have a simple company website. Do we need a developer?

Usually not. If your site runs on shared hosting, the host does the update. Send them the questions above and keep their reply.

How we can help

We work on PHP systems, including Laravel, CodeIgniter and plain PHP.

• Upgrading an old PHP system to a supported version. This is usually one contained job, which is what a fixed-price Fix Sprint is for, at RM3,000 to RM10,000. If it turns out bigger than that, we tell you before we start.
• Not sure whether to upgrade the old system or replace it. A Decision Review gives you a second opinion for RM1,000.
• Someone to watch for updates like this every month. That is part of Managed Delivery with technical ownership.