Is your website vulnerable to PHP2Shell?
PHP2Shell is the critical PHP vulnerability of October 2026: a pair of PHP flaws, fixed on 21 October 2026, that let attackers take over a web server without logging in. Working PHP2Shell exploits were public before the fix. If your site runs WordPress, WooCommerce, Drupal, Joomla or any PHP app, find out in two minutes whether you need to act.
Updated 23 October 2026 · By Dean, founder of Entidex Ltd
Free website vulnerability check
Do you need to do anything about PHP2Shell?
Three questions. Nothing is sent anywhere; the answer appears below.
Answer the three questions above and your result appears here.
Free tool for servers
Free PHP2Shell scanner for Linux servers
A version number alone can mislead. Ubuntu, Debian and Red Hat backport the PHP2Shell fix into older-looking versions, so 8.3.6 can be patched while a newer-looking self-compiled build is not. The free PHP2Shell Check script reads what is really installed:
- Every PHP on the box: command line, each PHP-FPM version, Apache mod_php, LiteSpeed, cPanel, Plesk and CloudLinux builds.
- Patched or not, using the fixed releases and your distribution's package changelog.
- PHP workers still running old code after an update, which need a restart.
- Signs of compromise: web-shell code patterns, PHP files in upload and temp folders, changed WordPress core files.
- PHP programs in places other users can change, which it lists but never runs, and PHP inside containers, which it reports rather than guessing.
curl -fsSLO https://entidex.com/downloads/php2shell-check.sh sudo bash php2shell-check.sh --json report.json
Read-only: it never installs, updates, restarts, deletes or edits anything. Exit codes (0 patched, 1 action needed, 2 not confirmed) make it easy for agencies and MSPs to run across many servers. Download the script. Only run it on servers you own or are authorised to manage.
Need proof for an insurer, client or manager? With a Patch Check order you add --submit and your check code. The report (hostname, OS, PHP versions and any flagged file paths) is sent to us, verified automatically and you get a signed, dated result. Nothing leaves your server without --submit.
Fixed prices · UK small businesses
Get PHP2Shell checked or fixed
Free check
Free
- The three-question self-check
- The read-only PHP2Shell Check script
- Plain-English next steps
Patch Check
£49 per server
- Order online: pay by bank transfer or card
- Run one command on your server; the report comes straight to us
- Checked automatically within a minute
- Signed, dated result once paid, with a link your insurer or client can verify
Emergency Fix
£149 per server
- One command: shows every package it will change, then waits for YES
- Checks for compromise first and stops if anything looks wrong
- Backs up, updates, restarts PHP only, checks your sites still load
- Rolls back automatically if a site stops loading (when your system still has the old packages)
- Tested on Ubuntu, Debian and AlmaLinux; cPanel, Plesk and LiteSpeed servers are patched by hand
- Signed, dated "fixed" result; £299 per server for PHP 8.1 and older
Every order gets a numbered pro-forma straight away. Pay by bank transfer, or reply for a card payment link. The Patch Check is £49 per server, re-checks included. The Emergency Fix is £149 per server on supported PHP (8.2 to 8.5) and £299 per server on end-of-life PHP (8.1 or older). It runs on your server with one command, shows you every package it will change and changes nothing until you type YES. If it finds signs of compromise, or anything it can't fix safely, it stops before changing anything and we take over. Only run it on systems you own or are authorised to manage. Questions? Email hello@entidex.com with your website address and who hosts it.
Emergency Fix · step by step
What the Emergency Fix does on your server
- Checks first, read-only. It runs the PHP2Shell Check. If it finds signs of compromise, PHP it can't fix safely, or a hosting control panel (cPanel, Plesk, LiteSpeed), it stops and we take over.
- Confirms your order. It checks the order is paid and covers this server. A server once flagged for possible compromise needs a person to look at it first.
- Shows the plan. It refreshes your package lists (waiting if automatic updates are running) and lists every package the update will change, including anything PHP needs updated with it. It stops if anything would be removed or a PHP package is held, and tells you whether it can roll back.
- Waits for YES. Nothing changes until you type YES. Add --dry-run to see the plan without installing anything (it only refreshes your package lists, and you can do it before paying).
- Backs up and updates. It saves your PHP settings and current packages, updates through your own package manager, and restarts PHP services only.
- Checks your websites. If a website that loaded before stops loading, it puts the old packages and settings back and we contact you.
- Re-checks and signs. It runs the check again and sends both reports to us. Only a clean re-check with your sites still loading gets a signed, dated "fixed" result.
PHP2Shell guides
- PHP2Shell: what UK small businesses need to do today
Two critical PHP flaws let attackers run code on web servers without logging in. Here is how UK small businesses check and fix their sites today.
- Is my WordPress site affected by PHP2Shell?
PHP2Shell is a PHP flaw, so updating WordPress will not fix it. Check your PHP version in Site Health and confirm your host has patched.
- CVE-2026-109618 and CVE-2026-109619: which PHP versions are safe?
Fixed PHP versions for PHP2Shell, why distro backports make old version numbers misleading, and how to check the PHP-FPM version serving your site.
- Still on PHP 7.4, 8.0 or 8.1? Your PHP2Shell options
PHP 8.1, 8.0 and 7.4 are end of life and got no PHP2Shell release; PHP 8.2 follows on 31 December 2026. Dates, security updates and your options.
- PHP2Shell patch not working? 7 reasons a server still shows as vulnerable
Patched for PHP2Shell but still flagged as vulnerable? Seven reasons, from PHP not restarting to the wrong PHP build, and how to confirm the fix worked.
- PHP2Shell: what to ask your web host or agency
Copy-paste emails to ask your host or web agency if your site is patched for PHP2Shell, plus what a good answer looks like.
PHP2Shell, answered
What is PHP2Shell?
PHP2Shell is the name for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, fixed by the PHP project on 21 October 2026. Both let an attacker run code on a web server without logging in. It is sometimes written PHP 2 Shell or PHP Shell.
How do I check if my website is vulnerable to PHP2Shell?
Take the free three-question self-check on this page to see whether you need to act. To confirm on the server, run the free read-only PHP2Shell Check script, which reads every PHP installed and its package changelog. Online scanners cannot reliably tell from outside, because they cannot see distribution backports.
Is PHP2Shell being exploited?
Yes. Working PHP2Shell exploit code was public on 20 October 2026, before the fix, and security firms reported exploit attempts on 21 October 2026, the day the fix was released.
Is my WordPress site affected by PHP2Shell?
Yes, until the PHP underneath it is updated. The flaw is in PHP, not WordPress, so updating WordPress or plugins does not fix it. Many managed hosts patched within hours; self-managed servers and agency-run sites need checking.
Which PHP versions fix PHP2Shell?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1, 8.0 and 7.4 are end of life and need a source patch or an upgrade. Linux distributions such as Ubuntu also ship backported fixes under older-looking version numbers.
I patched PHP but my server still shows as vulnerable. Why?
Usually PHP was not restarted, so the old code is still running, or the site uses a different PHP build from the one that was updated. Other causes are an update that did not install, PHP inside a container, or end-of-life PHP with no backport. The free check script spots each of these.
What does the NCSC say about PHP2Shell?
The UK National Cyber Security Centre advised organisations to update internet-facing systems that use PHP straight away, or take them offline until they can.
Does the free check script change anything on my server?
No. The PHP2Shell Check script is read-only. It reads package data, process data and file metadata and never installs, updates, restarts, deletes or edits anything. It only asks a PHP program for its version if root owns it and no other user can change it, so a program an attacker planted is listed, never run. Only run it on servers you own or are authorised to manage.
What does the Emergency Fix change on my server?
Only what it shows you first. It refreshes your package lists, asks your package manager exactly what the update would change, and lists every package, including anything PHP needs updated with it. It stops if the update would remove anything. Nothing changes until you type YES. Then it backs up your PHP settings, updates those packages, restarts PHP services only and checks your websites still load. Any other service still running old code is listed for you to restart yourself.
What happens if a website stops working after the fix?
Before changing anything, the fix saves your current PHP packages and tells you whether it can roll back. If a website that loaded before stops loading afterwards, it puts the old packages and settings back and restarts PHP, and you do not get a "fixed" result: we are told and contact you. Some systems, including Ubuntu, remove older security builds from their servers, so rollback is not always possible; the plan says so before you approve it.
Which servers does the Emergency Fix work on?
Linux servers where PHP comes from the system's own packages: Ubuntu and Debian (apt) and AlmaLinux, Rocky Linux and Red Hat (dnf). We test it on Ubuntu 24.04, Debian 12 and AlmaLinux 9 with a live site, including a site that breaks after the update. On cPanel, Plesk, LiteSpeed and DirectAdmin servers the panel manages PHP, so the fix stops before changing anything and we patch the server by hand under the same order. It doesn't change PHP that you compiled yourself or that runs inside containers: it tells you, and we help.
My server says PHP 8.3.33 (or 8.0.30). Is it still vulnerable?
Not necessarily. AlmaLinux, Red Hat, Ubuntu and Debian often add the PHP2Shell fix to an older version number. The free check reads your package's changelog as well as the version, so it can tell a patched 8.3.33 from an unpatched one.
Facts as published by the PHP project, CISA and the NCSC on 21 October 2026. Entidex Ltd, registered in England and Wales, company no. 17250646.