Last updated 21 October 2026. This is a fast-moving issue. Check the PHP and NCSC advisories for later changes.
PHP2Shell is the name given to two critical flaws in PHP itself, the language behind WordPress, Drupal, Joomla, Magento and a great deal of business software. They let an attacker run code on a web server without logging in. Details leaked before the fix was ready, and attack traffic has already been seen.
The NCSC has told organisations to update, or to consider taking unfixable systems offline. If you run a website, portal, online shop or any appliance with a web login page, here is what to do today.
Updating WordPress, Drupal or your plugins will not fix PHP2Shell. The flaw is in the PHP runtime on the server, so the server is what has to be updated, and on most managed plans that is your host’s job rather than yours.
Your PHP2Shell Checklist for Today
- List every PHP system you run, internet-facing first, and check its PHP version.
- Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to your Linux vendor’s patched package. If a host manages PHP for you, ask them to confirm in writing.
- On PHP 8.1 or older? Get a vendor backport or upgrade. Until then, isolate it or take it offline.
- If you cannot patch today, use a web application firewall, PHP’s interim settings and access restrictions as stopgaps.
- Look for signs of compromise: unknown admin users, new plugins or files, odd cron jobs, unexpected outbound connections.
- If in doubt, assume compromise. Restore a clean backup and rotate every password, key and salt the server held.
- WordPress sites: also check whether Rank Math PRO 3.0.123 was installed between 15 and 16 October.
One detail catches people out immediately. A hosting panel that says “PHP 8.5” is not telling you whether you are patched, because the fix is in the third number. You need 8.5.12, not 8.5.
What Is PHP2Shell?
PHP2Shell covers two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, disclosed on 21 October 2026. The PHP security team rates both Critical, with a CVSS v4.0 score of 9.2.
Both involve how PHP handles memory when something goes wrong mid-request, such as running out of memory:
- CVE-2026-109618, out-of-memory corruption. An out-of-memory error interrupts PHP while request data is only partly set up, and clean-up then treats that invalid data as valid.
- CVE-2026-109619, stale global state. State from one request survives after its memory is freed, and a later request on the same worker may use it.
A specially crafted HTTP request can trigger either condition, causing denial of service, data exposure or remote code execution. Wiz achieved unauthenticated code execution against current WordPress, Drupal and Joomla images, and could read worker memory holding passwords, tokens and API keys.
Why the timing matters. Details leaked on 20 October, before the planned coordinated disclosure, so the PHP team brought its release forward to 21 October. Cloudflare saw attack traffic against its customers, with attackers changing payloads to evade its rules. Multiple public proof-of-concept exploits exist, and a working exploit needs only a single unauthenticated request.
Not sure which of your sites still run an unpatched PHP?
Our team will map your internet-facing web estate, including forgotten subdomains and staging sites, tell you which systems run which PHP version, and give you a prioritised list to patch, isolate or take offline.
Book a PHP exposure checkWho Is Affected by PHP2Shell?
The PHP team says every PHP installation serving web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Risk is highest for mod_php, where an unauthenticated request can trigger the attack before any application code runs. Wiz says every PHP version back to 5.4 is affected by at least one of the two issues.
The NCSC puts it plainly: organisations using any version of PHP are affected. W3Techs data puts PHP behind almost 70 per cent of websites whose server-side language is known, and it also sits inside hosting platforms, control panels and software that does not advertise that it runs PHP at all.
The real risk usually sits in the systems nobody owns:
- Old subdomains and microsites built by an agency years ago
- Staging and development copies, often public and rarely patched
- Shop, booking and portal sites: WooCommerce, Magento, Laravel and custom PHP
- Hosting control panels such as cPanel and Plesk
- Vendor appliances and IoT devices with a web admin page, where you depend on the vendor
- Old Docker images pinned to an old PHP version
How to Check Your PHP Version and Patch It
Finding the version. On managed WordPress hosts it is usually in the site dashboard. In cPanel look under MultiPHP Manager or Select PHP Version, in hPanel under PHP Configuration, in Plesk under the site’s PHP settings. In WordPress, go to Tools, then Site Health, then Info, then Server. Over SSH, run php -v, but note the command-line version can differ from the one the web server uses, so check PHP-FPM or the Apache module too.
Applying the fix. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Linux distributions and long-term support vendors received the patches in advance, so check your distribution for updated packages. Restart PHP-FPM or Apache afterwards, then recheck the version.
| PHP branch | Patched version | If you are below it |
|---|---|---|
| 8.5 | 8.5.12 | Update now |
| 8.4 | 8.4.27 | Update now |
| 8.3 | 8.3.36 | Update now |
| 8.2 | 8.2.35 | Update now, and note end of life on 31 December 2026 |
| 8.1 and older | No fix from the PHP project | Vendor backport, or isolate and upgrade |
If a host or agency manages PHP, ask them today when the update was applied to each site. On most managed plans a PHP update is the host’s job, but you own the risk.
Avoid unofficial fix plugins and copied code snippets. They are not verified and can break your site. PHP 8.2 reaches end of life on 31 December 2026, so plan your next upgrade now.
On PHP 8.1 or older? Those branches no longer receive updates from the PHP project. Some distributions and LTS vendors provide backported fixes, and the PHP security team has published minimal source backports for 7.4, 8.0 and 8.1 for teams that build from source. For anything older there is no official fix, so isolate the system or take it offline until it is upgraded. Our guide to patch management covers how to keep on top of this routinely.
Stopgaps If You Cannot Patch Yet
Only an update fully fixes this. PHP is explicit that the measures below reduce exposure but do not make an installation safe. If you need hours or days:
- Put a web application firewall in front. Cloudflare says its WAF has protected free and paid plans by default since 03:02 UTC on 21 October. Paid customers should confirm the Managed Ruleset is in block mode rather than log. Cloudflare’s own CTO called it a stopgap only, and it helps only if your server accepts traffic solely from Cloudflare.
- Apply PHP’s interim settings. For the stale-state flaw, set
session.upload_progress.enabled=0somewhere that applies before request parsing, and on PHP 8.5 also setfatal_error_backtraces=0, then restart every worker. For the out-of-memory flaw, PHP recommendsmemory_limit=-1viaphp_admin_valuein the FPM pool or Apache config, and a reducedpost_max_size. - Cap request sizes at the web server or proxy. Limit decoded request size, input field count, multipart part count, header count and nesting depth, including for requests with no usable Content-Length.
- Restrict access to admin pages and non-public sites by VPN or IP address.
- Take it offline. The NCSC says that where immediate remediation is not feasible, consider taking the system offline until it can be fully mitigated. Dutch services including DigiD went offline as a precaution.
How to Tell If PHP2Shell Was Used Against You
The flaw acts below the application, so application logs may show very little. Wiz suggests looking for unusual multipart requests followed by memory-limit errors or repeated HTTP 500s, large or malformed PHPSESSID cookies, and unexplained PHP worker restarts.
Then look for what attackers do once inside:
- Unknown administrator accounts in WordPress or your CMS
- New plugins, themes or PHP files, especially in upload folders. Webshells are often small, obfuscated PHP files
- New cron jobs, both at server level and in WordPress scheduled tasks
- Unexpected outbound connections from the web server
- Files that differ from a known-good backup, and odd log entries from 20 October onwards
If you find something: isolate the site, restore files and database from a clean backup taken before the suspected compromise, and patch PHP before reconnecting. Rotate everything the server held, including database, SSH, FTP and hosting panel passwords, API keys, cloud credentials, WordPress admin passwords and the salts in wp-config.php. Do that on warning signs alone, because these flaws can expose memory. Then check whether personal data was involved and start your incident response plan.
A Second WordPress Risk This Week: Rank Math PRO
Separately, some downloads of the Rank Math PRO SEO plugin version 3.0.123 from the vendor’s own website carried malware, between 20:02 UTC on 15 October and 07:12 UTC on 16 October.
Sites that activated one of those builds should be treated as compromised, and updating or deactivating the plugin does not remove the backdoor. The clean version is 3.0.124. The free WordPress.org version was not affected.
Indicators to check for are administrator accounts prefixed wpsupport_ and outbound connections to rank1cdn[.]com.
The practical test is when your copy was installed, not which version number it shows. A site running 3.0.123 that was installed before 15 October has the clean build of that version. Check the plugin file dates against the window above, then check for the two indicators, and update to 3.0.124 either way.
Why PHP2Shell Matters for UK Firms
UK GDPR. Websites hold customer data. If this leads to a personal data breach you must report it to the ICO without undue delay and, where feasible, within 72 hours of becoming aware, unless it is unlikely to risk individuals’ rights. The ICO sets out the duty in full.
Cyber Essentials. The scheme requires critical and high-risk updates within 14 days of release, and unsupported software to be removed or cut off from the internet. Fourteen days is a ceiling, not a target: NCSC vulnerability management guidance says internet-facing services should be updated within five days, and faster when exploitation is rife. This one needs fixing in hours, and a server on PHP 8.1 or older is unsupported software. See our guide to the Cyber Essentials controls.
Supply chain. Many websites are run by agencies, and customers and insurers will ask how fast your suppliers responded. Supplier accountability is the direction of travel under the Cyber Security and Resilience Bill. The lesson is the same one we drew about Copilot agent governance: know what exists, who owns it, and what it can reach.
How Transputec Can Help
Transputec is an independent London managed IT and cyber security provider with ISO 27001, Cyber Essentials Plus and a 24/7 UK security operations centre.
For this, we are offering a free 48-hour PHP and website exposure check. We will map your internet-facing web estate, including forgotten subdomains, staging sites and appliances, identify which systems run PHP and which versions, give you a prioritised list to patch, isolate or take offline, and flag signs of compromise.
Our engineers can also apply the patches, chase your hosts and agencies, and run incident response if something has already got in. Talk to our team about the security work behind Transputec’s managed SOC services.
Frequently Asked Questions
Which PHP versions fix PHP2Shell?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, all released on 21 October 2026, plus patched packages from Linux distributions and long-term support vendors. The third number is the one that matters: a panel showing “PHP 8.5” does not tell you whether 8.5.12 is running.
Does updating WordPress fix PHP2Shell?
No. The flaw is in the PHP runtime on the server, not in WordPress, Drupal or any plugin. Updating your CMS changes nothing here. PHP itself has to be updated at server level, which on most managed hosting plans is your host’s job. Ask them to confirm the patched build is live and to restart PHP-FPM afterwards.
We run PHP 8.1 or older. What should we do?
Ask your distribution or long-term support vendor for a backported fix, or upgrade to a supported version. The PHP security team has published minimal source backports for 7.4, 8.0 and 8.1 for teams that build from source. If you cannot do either quickly, isolate the system or take it offline, because under Cyber Essentials an unsupported, internet-facing server is a finding in its own right.
Is a web application firewall enough to stop PHP2Shell?
No. A WAF buys time and is a stopgap, not a fix. Attackers were already changing payloads to evade rules within hours of disclosure, and a WAF only helps if all traffic reaches your server through it. If your origin still accepts direct connections, it can be bypassed entirely. Patch PHP properly as well.
How do we know if we were compromised?
Look for unknown administrator accounts, new plugins, themes or PHP files in upload folders, new cron jobs, unexpected outbound connections, and unusual memory-limit errors or worker restarts from 20 October onwards. Application logs may show little, because the flaw acts below the application. If you find any of it, restore a clean backup, patch, and rotate every credential the server held.
This article was drafted with AI assistance and reviewed by the Transputec team. Featured image: AI-generated.
