Skip to main content
Entidex

PHP2Shell · CVE-2026-109618 · CVE-2026-109619

PHP2Shell: what to ask your web host or agency

Updated 23 October 2026 · By Dean, founder of Entidex Ltd

Not sure if your site is exposed? Three questions, two minutes.

Run the free check

Small businesses should ask their web host or agency for a written yes or no on whether the PHP serving their site has been patched for PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which PHP fixed on 21 October 2026. The copy-paste emails below ask that question, plus which PHP version is running, whether PHP was restarted, and whether there are signs of compromise.

Why do I need to ask my host about PHP2Shell?

PHP2Shell is the name for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, fixed by PHP on 21 October 2026, that let an attacker run code on a web server without logging in. The PHP2Shell fix has to be applied to the server, by whoever runs the server.

Most small businesses do not run their own server; a host or agency does. Many managed hosts patched for PHP2Shell automatically. Other hosts have not, and some sites built by agencies have nobody looking after them at all.

A written answer from your host or agency gives you certainty about PHP2Shell. A written answer also gives you a record if your insurer or a client asks later.

What email should I send my web host about PHP2Shell?

The web host email below asks for written confirmation that your site is patched for PHP2Shell. Copy the email, fill in the brackets and send.

Subject: PHP2Shell (CVE-2026-109618 / CVE-2026-109619): please confirm my site is patched

Hello,

My account: [ACCOUNT NAME OR NUMBER] My website(s): [DOMAIN]

PHP released fixes on 21 October 2026 for CVE-2026-109618 and CVE-2026-109619 (PHP2Shell). Please confirm in writing:

  1. Has the PHP that serves my website been patched for both CVEs? Yes or no.
  2. Which PHP version and package build is serving my site now?
  3. Were PHP processes (PHP-FPM, Apache or LiteSpeed) restarted after the update?
  4. If my site uses PHP 8.1 or older, has the backported fix been applied, or do I need to move to a newer version?
  5. Have you seen any signs of compromise on my account?

Thank you, [NAME] [BUSINESS NAME]

What email should I send my web agency or developer about PHP2Shell?

The web agency email below asks the agency or developer who built or looks after your site to confirm who is responsible for PHP and whether PHP2Shell has been patched.

Subject: Is our website patched for PHP2Shell?

Hi [NAME],

You built / look after our website at [DOMAIN]. PHP released emergency fixes on 21 October 2026 for two critical flaws (CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell). The UK NCSC has advised updating straight away.

Could you confirm by [DAY]:

  1. Who is responsible for updating PHP on our server: you, our host or us?
  2. Has PHP been updated and restarted for both CVEs? Yes or no.
  3. Which PHP version is the site running? If it is 8.1 or older, what is the plan?
  4. Have you checked for signs of compromise, such as unexpected PHP files in upload folders?

If this is outside our current arrangement, please let me know the cost or who we should speak to.

Thanks, [NAME] [BUSINESS NAME]

What does a good PHP2Shell answer from my host look like?

A good host or agency reply about PHP2Shell:

  • says yes, patched, and names the PHP version or package build
  • confirms PHP services were restarted
  • covers every site on your account, not just one

A weak host or agency reply about PHP2Shell:

  • "We keep everything up to date" with no detail
  • "You are on the latest WordPress" (WordPress updates do not fix a PHP flaw)
  • a PHP version number with no mention of the CVEs, especially on 8.1 or older

If the host or agency answer is vague, ask again for a yes or no.

What can I do if my host or agency does not answer about PHP2Shell?

Unanswered PHP2Shell questions are common: the agency has closed, the freelancer has moved on, or the host passes you back to "your developer".

Here is what you can do:

  1. Check what you can yourself. In WordPress, go to Tools > Site Health > Info > Server for the PHP version. Compare the PHP version with our list of safe PHP versions.
  2. Take the free self-check. Three questions, a clear next step: entidex.com/php2shell#check
  3. Get a Patch Check (£49 per server). Whoever has server access runs one command; the verdict comes back within a minute and the signed, dated result once payment has cleared, with a link your insurer or client can verify.
  4. Book an Emergency Fix (£149 or £299 per server). If the server is yours or you are authorised to manage it, one command checks for compromise, updates and restarts PHP once you approve, and confirms your sites still load. £299 on PHP 8.1 or older. Limited slots each day. See prices.

Entidex Ltd only works on systems you own or are authorised to manage. If an agency or host controls the server, we will need their access or your written authority.

Host says it is patched but you want proof? A Patch Check result carries a public verification link you can share with clients, insurers or auditors. Order a Patch Check.

Questions? Email hello@entidex.com or take the self-check.

Where does this PHP2Shell information come from?