On October 21, 2026, PHP released emergency fixes for two critical security flaws, nicknamed PHP2Shell. PHP is the programming language behind around 70% of all websites, including every WordPress and WooCommerce site. The flaws let an attacker take control of a web server without a password, and attacks started within minutes of the announcement. The fix is a PHP update on the server. WordPress itself does not need an update. The DataRoots team applied the patch to our hosting servers on October 21, the same day it was released, so websites hosted with us were protected without their owners having to do anything.
Key takeaways
- PHP2Shell is two flaws in PHP itself: CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 for severity.
- Almost every PHP version since 2012 is affected, so almost every PHP website was at risk.
- The only real fix is updating PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a version your host has patched.
- Websites on PHP 8.1 or older get no official fix and need to be upgraded.
- For most website owners, patching is the hosting company’s job. Check that yours has done it.
What is PHP2Shell, in plain language?
Think of PHP as the engine that runs your website on the server. WordPress, WooCommerce, Drupal and Joomla all run on top of it. PHP2Shell is not a problem in any of those, but in the engine underneath.
The flaws are in the way PHP cleans up after certain errors, such as when a request runs out of memory. A carefully crafted request can leave PHP in a broken state that the next request then reuses. Security researchers showed that an attacker could use this to run their own code on the server without logging in, or to read parts of the server’s memory, which can contain passwords, login sessions and API keys. According to Wiz Research, even a simple “Hello World” page on an affected PHP version could be vulnerable. In other words, a website did not need a weak plugin or a bad password to be at risk.
How big is the impact?
- Around 70% of websites. About 69% of websites with a known server-side language use PHP, according to W3Techs, as cited on Wikipedia.
- More than a decade of versions. Every PHP version back to 5.4, released in 2012, is affected by at least one of the two flaws.
- Attacks before the fix. Amazon detected an exploitation attempt on October 17, four days before the public disclosure, and Cloudflare reported early signs of exploitation before the patch was released.
- Attacks within minutes after it. The security firm watchTowr reported active exploitation attempts against both flaws at 14:19 UTC on October 21, 19 minutes after PHP published the fix (The Hacker News).
- Websites taken offline as a precaution. Organizations that could not patch straight away switched services off, including supporting services at Wikimedia, government sites in the Netherlands, Finland and France, and the HR platform BambooHR in the United States, Canada and Ireland.
- Government warnings worldwide. CISA in the United States urged immediate patching and said unsupported versions should be taken offline until upgraded. Canada, Japan and Singapore also issued advisories.
What happened, step by step
| Date (2026) | What happened |
|---|---|
| August | Researchers at Wiz and Calif, working with AI tools, independently found the flaws and reported them to the PHP security team. |
| October 17 | Amazon detected a first exploitation attempt. |
| October 20 | Details leaked online, and a video of a working attack was posted by mistake. PHP brought the release forward. |
| October 21, 14:00 UTC (7 am Pacific, 10 am Eastern) | PHP released the fixed versions. Attack attempts were reported 19 minutes later. |
| October 21 and 22 | Hosting companies, cloud providers and website owners worldwide rushed to patch; some services went offline until they could. |
One detail stands out: the researchers used AI tools to find and test the flaws. Wiz wrote that a single researcher completed in a week what would previously have taken a world-class team months. That speed works both ways. Security holes are now being found faster, so how quickly your website gets patched matters more than ever.
Is my website affected?
If your website runs on WordPress, WooCommerce, Drupal or Joomla, it runs on PHP, and it was affected until the server’s PHP was patched. These are the versions with the fix:
| PHP version | Fixed in |
|---|---|
| PHP 8.5 | 8.5.12 or newer |
| PHP 8.4 | 8.4.27 or newer |
| PHP 8.3 | 8.3.36 or newer |
| PHP 8.2 | 8.2.35 or newer (support ends December 31, 2026) |
| PHP 8.1 and older | No official fix: upgrade to PHP 8.2 or newer |
To see your PHP version in WordPress, go to Tools → Site Health → Info and open the Server section. Do not panic if the number looks lower than the list above: many hosting companies apply the fix to their own PHP packages without changing the version number. If you are not sure, ask your host one simple question: “Have you applied the October 21 PHP security release?”
What should you do now?
- Hosted with DataRoots? Nothing. We patched our servers on October 21.
- On managed or shared hosting elsewhere? Your host patches PHP for you. Look for their confirmation, and contact support if you have not heard from them.
- On your own VPS or cloud server? Nobody will patch it for you. Install the updated PHP packages and restart PHP today.
- Still on PHP 8.1 or older? Plan an upgrade to PHP 8.2 or newer straight away, test it on a staging copy first, and make a backup before you switch. CISA advises taking unsupported systems offline until they are upgraded.
- Using Cloudflare? Cloudflare added firewall rules against the known attacks, which is a useful extra layer, but not a replacement for the PHP update.
You do not need to update WordPress, plugins or themes for this issue. WordPress.org has confirmed that no WordPress update is required.
Signs your website may have been attacked
If your server was unpatched during the first days, watch for unusual activity: repeated “500 Internal Server Error” pages, memory-limit errors in the logs, administrator accounts or files you do not recognize, or your hosting company warning you about suspicious processes. A patch closes the hole, but it does not remove anything an attacker may already have left behind. If you see any of these signs, have the website checked, and change your passwords and API keys after the cleanup.
How DataRoots responded
The DataRoots team applied the patch to our hosting servers on October 21, the same day it was released. Websites on our managed hosting are also set up with Cloudflare, whose firewall rules add an extra layer against the known attack patterns. Our hosting clients did not have to do anything.
PHP 8.1 and older cannot be patched, because they no longer receive official updates. None of our servers run these versions. Is your website running on an older PHP version, or are you not sure? Contact us or call +1 (604) 880-5675, and we will check it for you.
This is what managed hosting is for: when a problem like PHP2Shell appears, someone is already watching, testing and patching, so your website is protected before most people have read the news.
Need help with your website?
- Want hosting where security updates are handled for you? See our managed WordPress hosting in Canada.
- Still on an old PHP version, or worried an update will break your site? Our WordPress support team upgrades it safely on a staging copy first.
- Think your website was attacked? Our hacked website repair removes malware and closes the backdoors, usually the same day.
Frequently asked questions
What is PHP2Shell?
PHP2Shell is the nickname for two critical security flaws in PHP, CVE-2026-109618 and CVE-2026-109619, disclosed and fixed on October 21, 2026. They let an attacker run code on a web server without logging in, and affect almost every PHP version released since 2012.
Do I need to update WordPress because of PHP2Shell?
No. The flaws are in PHP, not in WordPress, plugins or themes. The fix is updating PHP on the server, which is usually done by your hosting company.
How do I know if my website has been patched?
Check your PHP version under Tools, Site Health, Info in WordPress, and compare it with the fixed versions: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Because many hosts patch without changing the version number, the surest way is to ask your hosting company whether the October 21 PHP security release has been applied.
Is PHP 8.1 safe after PHP2Shell?
No. PHP 8.1 and older versions no longer receive official updates, so there is no official fixed release for them. Upgrade to PHP 8.2 or newer; PHP 8.3 or 8.4 is the better choice, because PHP 8.2 support ends on December 31, 2026.
Does Cloudflare protect my website against PHP2Shell?
Partly. Cloudflare added firewall rules against the known attack patterns, but attackers keep changing their requests to get around such rules. Updating PHP is the only complete fix.
Was my website hacked?
Not necessarily. Many servers were patched before they were attacked. If your server was unpatched for a while, or you notice errors, unknown accounts or files, have it checked. Patching stops new attacks but does not undo an earlier one.
