How do I know if my website is safe from PHP2Shell?

Your site is safe from PHP2Shell if the PHP serving it was updated to a fixed version (or a distribution package listing both CVE fixes) and PHP was restarted. Your host can confirm this in writing, or the free check script tells you on the server.

My site is on WordPress. Am I safe if WordPress is up to date?

Not necessarily. PHP2Shell is a flaw in PHP on the server, not in WordPress, so updating WordPress or plugins does not fix it. The PHP underneath has to be updated.

Will an online scanner tell me if my site is safe?

Not reliably. Online scanners guess from the PHP version a site advertises, which is often hidden and doesn't show backported fixes. The reliable check runs on the server.

Was my website hacked through PHP2Shell?

Most sites were not, but attacks started on 17 October 2026, before the fix. Look for PHP files in upload or temp folders, unexpected admin users and pages you didn't create. The free check script looks for these signs and reads your server logs.

PHP2Shell · CVE-2026-109618 · CVE-2026-109619

Is my website safe from PHP2Shell? A plain-English check

Q: How much does it cost to be sure?

The self-check and the check script are free. A signed Patch Check result is £49 per server. If the server needs fixing, the automatic Emergency Fix is £149 per server, or £299 for PHP 8.1 or older.

Updated 23 October 2026 · By Dean, founder of Entidex Ltd

Not sure if your site is exposed? Three questions, two minutes.

Run the free check

Is my website safe from PHP2Shell?

Your website is probably safe from PHP2Shell if the PHP on its server was updated on or after 21 October 2026 and PHP was restarted. If you don't know who runs your server, or nobody has confirmed the update, it is worth two minutes to check, because attacks started on 17 October, before the fix existed.

PHP2Shell is a pair of critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, fixed by the PHP project on 21 October 2026. It affects the server your site runs on, not your website design or WordPress itself, so the question is always: has the PHP on my server been updated?

Three questions that tell you where you stand

Does your site run on PHP? WordPress, WooCommerce, Joomla, Drupal and most custom booking or quote systems do. Wix, Squarespace and Shopify sites are run by those platforms, so there is nothing for you to patch.
Who runs the server? On managed hosting, the host does. On a VPS or a server someone set up for you, you or your developer do.
Has anyone confirmed the update in writing? A yes from your host or developer that the PHP serving your site is patched for both CVEs is a good answer.

Our free three-question self-check walks you through this and tells you who should act.

Signs you are probably fine

Your site is on a fully managed host that has said it patched PHP2Shell.
Your PHP version is 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later, or your distribution's package lists both CVE fixes. See which PHP versions are safe.
PHP was restarted after the update, so the new code is the code running.

What if I'm not sure?

Ask whoever runs your server one question: "Has the PHP serving my site been patched for CVE-2026-109618 and CVE-2026-109619, and was PHP restarted?" Our copy-paste emails make it easy.

If you or your developer can log in to the server, the free, read-only PHP2Shell Check script answers it in a minute. It never changes anything, and it is open source on GitHub.

Was my website hacked?

Most sites were not. But attacks began on 17 October 2026, four days before the fix, so an unpatched site from that time is worth a look. Signs to check:

PHP files in upload or temporary folders, such as wp-content/uploads
new admin users, pages or plugins you didn't add
WordPress core files changed since 16 October without an update to explain it

The check script looks for these and reads your web server and PHP logs for known signs of the attack. If anything turns up, don't delete files yet: get help, because evidence matters for working out what happened.

Is there anything else to do?

Yes, one small thing. A separate flaw, CVE-2026-115560, isn't patched yet. The PHP project says it only affects unusual setups and no attacks have been reported, but the protection is one line in php.ini: session.upload_progress.enabled = 0, then restart PHP. Ask your host to set it, or see the third flaw.

How much does it cost to be sure?

Free: the self-check and the check script.
£49 per server: a Patch Check, a signed, dated result you can show an insurer or client.
£149 per server (£299 for PHP 8.1 or older): the automatic Emergency Fix, if the server needs patching.