Your Website Runs on PHP, and PHP Just Had an Emergency Fix: What to Ask Your Web Host This Week

Updated October 27, 2026: On October 26, CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities list.

PHP is the software that runs a WordPress site, and sites built with Drupal, Laravel, or Magento. On October 21, 2026, PHP published a fix. This page shows how to find out whether your server has it, with one email.

It's written for an owner or office manager at a business of about 5 to 50 people.

The short answer

Is my business website affected by php2shell? If the site runs on PHP, the fix goes on the server. Updating WordPress or its plugins does not install it.

Vercel's security bulletin says: "Updating your application code or plugins does not fix these vulnerabilities." It also says: "The vulnerabilities affect PHP 5.4 and later in default configurations." And: "Frameworks and CMSs built on PHP, including WordPress, Drupal, Laravel, and Magento, are affected when they run on a vulnerable PHP runtime."

On managed or shared hosting, ask the host to confirm the fix is in place. On a VPS, or a server your designer set up, the person who manages that server has to install it.

What happened, in plain words

On October 21, 2026, CISA (the Cybersecurity and Infrastructure Security Agency) published an alert on two flaws, known as "php2shell": CVE-2026-109618 and CVE-2026-109619. CISA says they "allow for unauthenticated remote code execution in PHP" and that the vulnerabilities "affect all PHP installations serving web requests". CISA says: "Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities."

PHP's October 21 security advisory says those four releases "fix two critical vulnerabilities that can allow unauthenticated remote code execution." The PHP 8.5.12 release note on that same page says: "There are no complete mitigations, updating is the only safe choice." The vendor advisory for CVE-2026-109618 and the vendor advisory for CVE-2026-109619 list the same patched versions.

The National Vulnerability Database entry for CVE-2026-109618 says: "Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE)." OOM means out of memory. The entry for CVE-2026-109619 says stale state "may then refer to request memory even after it has been freed," and: "Multiple strategies can trigger this condition and produce remote code execution (RCE)."

Vercel says: "Working public exploits are already available, and exploitation attempts have been reported across the industry." As of its October 21 alert, CISA had not observed exploitation. On October 26, CISA revised that alert and added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities list.

CISA's October 26 alert says it added those two vulnerabilities and updated its PHP alert. CISA's Known Exploited Vulnerabilities catalog, version 2026.10.26, checked October 27, 2026, lists both. Each entry names the vendor as PHP Group and the product as PHP. Each was added October 26, 2026, with a due date of October 29, 2026 for federal agencies. The October 26 alert says Binding Operational Directive 26-04 applies only to federal civilian executive branch agencies.

BleepingComputer's October 27 news report says the flaws are exploited in attacks and that CISA has not yet shared details of ongoing attacks.

The fix is the same: ask your host to confirm it is patched.

On October 23, PHP posted a separate note. PHP says: "We suggest you set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector."

Ask your host or developer to apply it.

PHP also says the follow-up "can only occur under an unusual combination of configuration and application code," and that it "will publish a full advisory for CVE-2026-115560 with the next release." That note does not replace the October 21 update. Catalog version 2026.10.26 does not list CVE-2026-115560.

Who's responsible for your site's server?

Managed or shared hosting

The host patches PHP. Ask for a dated answer, not a verbal "it's updated."

VPS or cloud server

Whoever manages the server patches it. That may be you, your designer, or an IT host.

If you don't know who hosts it

Check the hosting charge on an invoice or a card statement, or ask the person who built the site. The questions for your IT host cover the same ground: who does the work, and what a real answer looks like.

The three questions to send today

Copy these into an email (ten minutes).

Is a patched PHP build installed for our site, and on what date? Please name the build (8.5.12, 8.4.27, 8.3.36, or 8.2.35, or the vendor package that contains those fixes) and the date.
Is the PHP that answers our website that patched build? If applying it takes a restart or a redeploy, has that happened?
Are we on PHP 8.1 or older? If yes, what is the plan, and what date will it be done?

Date sent: YYYY-MM-DD · Answer received: · Checked by:

If you're on PHP 8.1 or older

CISA says: "Organizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated."

PHP's advisory says: "PHP 8.1 and older no longer receive updates from the PHP project. Some distributions and LTS vendors provide backported fixes, so contact your vendor for details, or upgrade to a supported version." LTS means long-term support.

Ask the designer to schedule the move. A short planned outage is how you follow that CISA sentence. If the host says a vendor package already contains the fix, ask for the package name and the date.

Pair it with the UpdraftPlus check

Same website, same week. This page covers the server. The UpdraftPlus and UpdraftCentral check covers the plugin. One update does not do the other job.

The evergreen habit

Add the website server and its PHP version to the monthly patch routine and the month-end security hub. The first 60 minutes after a cyber incident has the first-hour list if a later check turns something up.

FAQ

Does php2shell affect my WordPress site? WordPress runs on PHP. Vercel says those sites "are affected when they run on a vulnerable PHP runtime." CISA's fixed versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

Will updating WordPress or my plugins fix it? No. Vercel says: "Updating your application code or plugins does not fix these vulnerabilities." On managed hosting, the host installs the PHP fix. On a VPS, whoever manages the server does.

What should I ask my web host? Ask whether the patched build is installed and when, whether the site is serving that build, and whether you are on PHP 8.1 or older. CISA says they "should take PHP-based systems offline until they can be patched or updated."

Has anyone been broken into with php2shell? As of its October 21 alert, CISA had not observed exploitation. On October 26, CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities list. Catalog version 2026.10.26 lists both but not CVE-2026-115560. BleepingComputer's October 27 news report says the flaws are exploited in attacks and that CISA has not yet shared details of ongoing attacks. Vercel reports public exploit code and exploitation attempts.

Related guides

Educational content only — not legal, insurance, or compliance advice.