PHP2Shell: the October 2026 PHP vulnerability and what to do about your website

PHP2Shell is the shared name of two PHP bugs (CVE-2026-109618 and CVE-2026-109619). The PHP developers released a fix on 21 October 2026. The bug sits in the upload progress feature of PHP (session.upload_progress), and it lets an attacker run code on the server remotely, without logging in. For a WordPress site this is the worst case: whoever exploits it can do anything the site itself can do.

The next day, 22 October, I went through more than 60 websites that I maintain or have access to. Here is what I checked, what I found, and what you can do if your site may be affected too.

What is PHP2Shell, and who does it affect?

PHP is the programming language WordPress runs on. It is installed on your hosting server, and your hosting provider updates it. That is why updating WordPress or your plugins does not fix this bug. The PHP running on the server has to be updated.

The patched official versions:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

The PHP project no longer releases new versions for the 8.1 branch and older. These versions have had no official support for years.

Why is the version number misleading?

This is the catch. Most cPanel hosting runs on CloudLinux, and on 21 October CloudLinux released the fix for every PHP branch while keeping the old version numbers, including 8.1 and 7.4. Hostinger says every version on its managed hosting is protected too. So a PHP 8.1.34 can be patched, and a PHP 8.3.35 can be unpatched.

The reliable sign is when the PHP was built (the build date). If the output of the php -v command shows "built: Oct 21 2026" or a later date, the fix is included.

I saw both cases in the survey. One site ran on 8.3.35. That sounds recent, but the build was from 6 October, so it was unpatched. Another ran on 8.1.34 with a CloudLinux build from 21 October, so it was protected.

What did I find on the 60+ sites?

• Most were fine. They ran either the patched official version or the patched build of their host.
• I moved two sites from 8.1 to 8.3. The 8.1 build was patched, but that branch no longer gets support. Along the way I found that the CloudLinux PHP selector stores settings (memory, execution time, upload size) per version. After switching, you have to copy them over, otherwise the site starts with 128 MB of memory. On a webshop this could have stalled the checkout as well.
• I left one site on its old version on purpose. It runs a page builder and a slider plugin from 2019, and these will probably throw errors on newer PHP. There the plugins have to be updated first, and only then PHP.
• I put a temporary mitigation on five sites. On these the host had not released the fix yet, or they run a system so old that it will never get one. I added a .user.ini file to the web root that turns off upload progress tracking. It protects against only one of the two bugs, and only partly.
• A few sites run on institutional or cheap hosting with PHP 7.4. There is no fix for these. I wrote to the operators and told them what is needed.
• For more than twenty sites I have no server access. There the exact build has to be checked with the host or the client.

What should you do now?

• Ask your hosting provider. This is enough: "Which PHP version does my site run on, and does it include the 21 October 2026 PHP2Shell fix (CVE-2026-109618, CVE-2026-109619)?"
• If you are on PHP 8.1 or older, move to 8.3 or 8.4. Before that, test on a copy that the theme and plugins work on it. On a webshop, try the cart and the checkout as well.
• If your host cannot provide a fix, add a temporary mitigation. The web root needs a .user.ini file with this line: session.upload_progress.enabled = 0. It does not replace the fix, but it narrows the attack surface.
• If your host runs an old system and cannot update it, move to another host. A server that gets no security fixes will be just as exposed at the next bug.

In the WordPress admin you can see the PHP version under Tools → Site Health → Info → Server. The build date is not shown there. For that you need your host or SSH access.

In short

PHP2Shell is a flaw in the PHP on the server, so the fix is the job of your host. The version number alone does not tell you whether you are protected. The build date does. If you do not know where your site runs and who updates its PHP, send me your site's address and I will take a look.