PHP Security Update Guide: What Website Owners Need to Do About PHP2Shell

Two critical flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were fixed in a security release on October 21, 2026, and both are rated 9.2 under CVSS v4.0. The flaws sit in PHP itself, so updating website content or plugins alone does not fix them. This guide explains who is affected, which PHP versions contain the fix, how to check your own site, and how InCreativeWeb can help.

What happened with the latest PHP security update

On October 21, 2026, the PHP security team released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix the two vulnerabilities.

Wiz Research, which took part in finding the flaws, says they can let unauthenticated attackers run code on affected servers or read sensitive process memory. That memory may hold passwords, authentication tokens, API keys and certificates.

Wiz also notes that the flaws are in PHP itself, independent of the application on top. Even a simple “Hello World” application on an affected PHP version can be vulnerable.

Governments and agencies reacted quickly:

• Cybersecurity agencies in the U.S., U.K., EU, Canada, Australia and Japan urged organizations to find and patch PHP systems.
• The FBI and NSA advised taking systems offline if they cannot be updated promptly.
• Websites in Finland, the Netherlands, Belgium and France were taken offline or became partly unavailable, and some of those shutdowns were precautionary.

Reports about real-world attacks are still limited. Cloudflare reported attack traffic targeting its customers and attempts to evade its protections, but that does not confirm any attempt succeeded.  CISA and the Canadian Centre for Cyber Security said their alerts had not identified active exploitation. Check CISA’s Known Exploited Vulnerabilities catalog for the current status of both flaws.

Who is affected

Any website running PHP on a server that has not been patched is in scope. Industry estimates put PHP at nearly 70% of websites with a known server-side language, and Palo Alto Networks identified more than 22.6 million potentially vulnerable internet-connected instances. That figure is not a count of unique websites or confirmed breaches.

PHP also powers WordPress, Joomla, Drupal and MediaWiki, so sites built on these systems can be exposed even when their own code is secure.

PHP’s own records list the 8.2 to 8.5 branches as affected, and PHP no longer supports 8.1 and older. Wiz’s researchers say affected releases go back to PHP 5.4.

Responsibility falls on website operators and hosting providers. On managed or shared hosting, the provider usually applies PHP patches, so ask when they plan to deploy this one.

Which PHP versions contain the fix

PHP branch	Fixed version	Notes
8.5	8.5.12	Official release, October 21, 2026
8.4	8.4.27	Official release, October 21, 2026
8.3	8.3.36	Official release, October 21, 2026
8.2	8.2.35	Official release; PHP 8.2 reaches end of life on December 31, 2026
8.1 and older	No official PHP release	Backported fixes exist through some distributions and package maintainers; a stopgap, not a long-term fix

For 8.1 and older, the PHP team did not publish new releases. Package maintainer Ondřej Surý backported the fixes as new package revisions, so the version number stays the same before and after the update. Check the package revision to confirm the fix, and consider moving to a supported PHP version.

How to check your PHP version and what to do next

Check your version

• WordPress: in the admin dashboard, go to Tools, then Site Health, then Info, and open the Server section.
• Managed or shared hosting: ask your provider which PHP version your site runs and when it will be patched.
• Your own server: run php -v, then run it again after updating to confirm the fixed version. PHP-FPM can be checked separately with php-fpm8.4 -v (replace 8.4 with your branch).

Update steps

1. Take inventory: List every place PHP runs, including web servers, containers, CI images and developer machines. PHP can also be bundled inside applications, control panels and appliances.
2. Update PHP itself: Move to the fixed release for your branch or a patched vendor build, then restart Apache, PHP-FPM and any long-running workers. Updating only the application does not fix the runtime.
3. Restart background processes: Processes started from the command line, such as queue workers, keep running the old PHP until restarted.
4. Verify: Confirm the running version matches the fixed version for your branch.
5. Handle unsupported versions: PHP 8.1 and older need a backported fix from your distribution or long-term-support vendor, or an upgrade to a supported version.

If you cannot patch right away

PHP lists temporary settings, such as turning off session.upload_progress.enabled for CVE-2026-109619. These reduce exposure but do not make a system safe. NCSC, CISA and NSA advise taking unpatched systems offline until they are fixed. CISA notes a web application firewall may offer some protection, while Cloudflare recommends patching even with a firewall in place.

Signs worth checking

Wiz says defenders should look for unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses, unexpectedly large or malformed PHPSESSID response cookies, and unexplained PHP worker churn. It adds that applying the PHP update remains the only complete fix. If you notice any of these signs, ask your developer or hosting provider to investigate.

How InCreativeWeb can help

InCreativeWeb is a Top Rated Plus agency on Upwork for UI/UX design and WordPress development, with 14+ years of professional experience in web design, front-end development and PHP and WordPress development. Our services include web development with WordPress and PHP, plus website maintenance and optimization.

Our experts can help you update PHP, strengthen website security and ensure smooth performance. The update work follows the steps in this guide:

• Finding every place your site and servers run PHP, and which version each one uses.
• Updating PHP to the fixed release for your branch, or to a supported version if you run 8.1 or older.
• Restarting PHP-FPM, the web server and long-running workers, then confirming the running version.
• Reviewing logs for the warning signs described above.

Need help updating your PHP version? Our team at InCreativeWeb is here to help. Contact us or book a meeting.

Frequently asked questions

1. Will updating my WordPress plugins fix this? 

No. The flaws are in PHP itself, so the PHP software on the server must be updated, either by you or by your hosting provider.

2. How do I find my PHP version in WordPress? 

Go to Tools, then Site Health, then Info, and open the Server section.

3. Which PHP versions have the fix? 

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

4. My site runs PHP 8.1 or older. What should I do? 

PHP has not released official fixes for these versions. Ask your distribution or long-term-support vendor for a backported fix, or upgrade to a supported version.

5. Who is responsible for applying the update? 

Website operators and hosting providers. Contact your host if you do not manage the server yourself.

6. What if I cannot update right away? 

Temporary PHP settings reduce exposure but do not make a system safe. Agencies advise taking unpatched systems offline until they are fixed.

7. Can I be infected just by visiting an affected website? 

The available information does not indicate that simply visiting an affected site infects your device, and some site shutdowns were precautionary.

Source:
https://www.wiz.io/blog/php2shell-php-rce

https://www.rescana.com/post/php-rce-flaws-patch-october-2026-prepare-now

https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching

https://it.uw.edu/help/servicestatus/php-cves/