Skip to main content
Entidex

PHP2Shell · CVE-2026-109618 · CVE-2026-109619

PHP2Shell: what UK small businesses need to do today

Updated 23 October 2026 · By Dean, founder of Entidex Ltd

Not sure if your site is exposed? Three questions, two minutes.

Run the free check

PHP2Shell is the nickname for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, that let an attacker run code on a web server without logging in. PHP fixed both flaws on 21 October 2026, so UK small businesses need to confirm today that the PHP serving their website has been updated, because updating WordPress does not fix PHP2Shell.

Key facts: PHP2Shell - CVE IDs: CVE-2026-109618 and CVE-2026-109619, both unauthenticated remote code execution - Severity: CVSS v4.0 9.2 out of 10 for each flaw - Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (PHP project, 21 October 2026) - NCSC advice: update internet-facing PHP systems straight away, or take them offline until you can (NCSC)

What is PHP2Shell?

PHP2Shell is the name researchers gave to two critical PHP security flaws, CVE-2026-109618 and CVE-2026-109619, which the PHP project fixed in emergency releases on 21 October 2026. Both PHP2Shell flaws are rated 9.2 out of 10 on the CVSS v4.0 scale.

Both PHP2Shell flaws allow unauthenticated remote code execution. In plain terms, an attacker can run their own code on your web server without a password or an account.

When did PHP2Shell happen?

PHP2Shell details leaked on 20 October 2026, before the fix was ready, and the PHP project released its fixes a day early as a result.

  • 20 October 2026: PHP2Shell details leaked and working exploit code appeared in public.
  • 21 October 2026: the PHP project released the fixes, moved forward by a day because of the leak (PHP project, 21 October 2026).
  • 21 October 2026: security firms reported PHP2Shell exploit attempts on the day of the release.

Why does PHP2Shell matter to a UK small business?

PHP is the programming language behind a very large share of websites, including WordPress, Drupal, Joomla, WooCommerce shops and many custom booking or quote systems. Any PHP website whose server has not been updated for PHP2Shell could be taken over by an attacker.

A PHP2Shell compromise can mean defaced pages, stolen customer details, a hidden spam or phishing site on your domain, or your server being used to attack others.

The UK National Cyber Security Centre (NCSC) has advised organisations to update internet-facing systems that use PHP straight away, or take them offline until they can (NCSC). CISA, the US cyber agency, has also urged immediate patching (CISA, 21 October 2026).

Does updating WordPress fix PHP2Shell?

WordPress updates do not fix PHP2Shell, because PHP2Shell is a flaw in the PHP software on the server, separate from WordPress, your theme and your plugins. The belief that a WordPress update fixes PHP2Shell is the most common misunderstanding about CVE-2026-109618 and CVE-2026-109619.

Updating WordPress and plugins is still good practice. The PHP2Shell fix has to be applied to the server, by whoever runs the server.

Which PHP setups are affected by PHP2Shell?

Every PHP installation that serves web pages is affected by PHP2Shell unless it has been updated, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP2Shell flaws go back as far as PHP 5.4.

Who is most at risk from PHP2Shell?

Managed hosts, including GoDaddy managed WordPress, patched many of their customers for PHP2Shell automatically. A business on a fully managed hosting plan may already be safe, but should get that confirmed in writing.

PHP2Shell risk is concentrated in:

  • self-managed VPS or cPanel servers where you, or a freelancer, are responsible for updates
  • sites built by an agency that nobody now maintains
  • sites still on PHP 7.4, 8.0 or 8.1, which no longer get official PHP releases
  • in-house PHP applications such as portals, booking systems or stock tools

Which PHP versions fix PHP2Shell?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are the versions that fix PHP2Shell (PHP project, 21 October 2026). Any later release in the same branch is also fixed.

PHP branch Fixed version
8.5 8.5.12 or later
8.4 8.4.27 or later
8.3 8.3.36 or later
8.2 8.2.35 or later
8.1, 8.0, 7.4 End of life. Source patches only.

A lower PHP version number does not always mean a site is exposed to PHP2Shell. Linux distributions such as Ubuntu, Debian and Red Hat often add the fix to an older-looking version number. Only the package changelog tells you for certain. Our guide on which PHP versions are safe explains how to check.

What should a UK small business do about PHP2Shell today?

UK small businesses can deal with PHP2Shell in five steps, starting with finding out who runs the web server.

  1. Find out who runs your server. Look at who you pay for hosting. If the hosting is a managed WordPress plan, the host is usually responsible. If you have a VPS, a dedicated server or a cPanel account you manage yourself, the person responsible is probably you or your developer.
  2. Check your PHP version. In WordPress, go to Tools > Site Health > Info > Server, where the PHP version is listed. Compare the PHP version with the fixed versions table.
  3. Ask your host or agency for written confirmation. Ask a simple question: "Has the PHP serving my site been patched for CVE-2026-109618 and CVE-2026-109619?" Ask for a yes or no in writing. We have copy-paste emails for your host and your agency.
  4. If you manage the server, update now. Install the updated PHP packages from your distribution or control panel. Then restart PHP-FPM, Apache or LiteSpeed so the old code stops running, because a server can have new packages installed while old processes are still serving pages.
  5. Look for signs someone got in. PHP2Shell exploit code was public before the fix. After patching, check for unfamiliar PHP files in upload or temporary folders and WordPress core files that changed recently without explanation.

PHP says updating is the only complete fix for PHP2Shell. Some settings reduce specific attack paths, but those settings are not complete protection. If you cannot update today, follow the NCSC advice and consider taking the site offline until you can. Already updated and still unsure? See why a patched server can still show as vulnerable.

How can I check if my website is vulnerable to PHP2Shell?

You can check if your website is vulnerable to PHP2Shell in two minutes with our free three-question website vulnerability check, which tells you whether you need to act and who should act. To confirm it on the server itself, the free read-only PHP2Shell Check script reads every PHP installed and its package changelog.

Online website vulnerability scanners cannot reliably answer the PHP2Shell question from outside. They usually read the PHP version a site advertises, which is often hidden and does not show distribution backports, so a scanner can call a patched site vulnerable or an exposed one safe. The check has to happen on the server.

How can Entidex Ltd help with PHP2Shell?

Entidex Ltd offers the following PHP2Shell options, all for systems you own or are authorised to manage.

Free self-check. The PHP2Shell self-check asks three questions and gives you a clear next step. Take the self-check.

Free PHP2Shell Check script. The PHP2Shell Check script is a read-only script for Linux servers. The script finds every PHP runtime on the server, checks version and distro package changelogs to catch backported fixes, flags processes still running old code, and looks for common signs of compromise. The PHP2Shell Check script never changes anything.

Patch Check, £49 per server. Run one command on your server and the report comes straight to us. It is checked automatically within a minute, and once payment has cleared you get a signed, dated result with a link your insurer or client can verify.

Emergency Fix, £149 or £299 per server. One command checks your server for compromise first, shows you the plan and changes nothing until you approve. It then updates PHP through your server package manager, restarts it, checks your sites still load and sends a signed, dated "fixed" result. £149 per server on supported PHP (8.2 to 8.5), £299 per server on PHP 8.1 or older. Limited slots each day. See prices.

What are the most common questions about PHP2Shell?

What is PHP2Shell?

PHP2Shell is the nickname for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619. Both let an attacker run code on a web server without logging in. PHP fixed them on 21 October 2026.

Does updating WordPress fix PHP2Shell?

No. PHP2Shell is a flaw in PHP on the server. WordPress, themes and plugins sit on top of PHP, so your host or server administrator has to update PHP itself.

My host says I am on PHP 8.1. Am I at risk?

PHP 8.1 is end of life, so there is no new official release for it. The PHP security team published source patches for PHP2Shell, and some distributions and hosts apply them. Ask your host to confirm the fix in writing, or plan a move to a supported version.

My PHP version number looks old. Does that mean I am vulnerable?

Not always. Linux distributions often backport PHP2Shell fixes without changing the main PHP version number. The package changelog is the reliable check.

Is there a setting I can change instead of updating?

PHP says updating is the only complete fix for PHP2Shell. Some settings block specific attack paths but leave others open.

Can I use your script to check someone else's website?

No. The PHP2Shell Check script is only for servers you own or are authorised to manage.

How quickly can you help?

A Patch Check verdict comes back within a minute of running the check on your server; the signed result follows once payment has cleared. Emergency Fixes depend on daily capacity, as we take a limited number each day. Check availability or email hello@entidex.com.

Take the 3-question self-check now: entidex.com/php2shell#check

Entidex Ltd, registered in England and Wales, Company No. 17250646.

Where does this PHP2Shell information come from?