PHP2Shell: Two Critical PHP Flaws Put Millions of Sites at Risk — Check Your Version and Fix It Today

Most PHP security stories are about a plugin. This one is about PHP itself. On 20 October 2026 the PHP security team warned of two critical vulnerabilities in the PHP core, and the emergency fixes landed a day later, on 21 October. The pair — nicknamed PHP2Shell — let an attacker run code on your server without a username, a password, or any account at all.

PHP powers a large share of the public web — WordPress, WooCommerce, Moodle, Magento, Laravel and millions of custom sites. That is why governments reacted the way they did: CISA in the US, the NCSC in the UK and CERT teams in Europe and India all pushed the same message within hours. Update immediately, prioritise anything facing the internet, and if you cannot patch, consider taking the site offline until you can.

What PHP2Shell actually is

The two flaws — CVE-2026-109618 and CVE-2026-109619 — sit in how PHP handles multipart form data (the encoding used by file-upload forms) together with the session upload progress mechanism. Under the right conditions, memory gets corrupted: one bug trips an out-of-memory path that leaves request data half-initialised, the other leaves stale internal state behind after its memory has been freed. The result, in both cases, is the worst category of web bug: unauthenticated remote code execution.

Three facts decide what you should do. First, the bug is in the runtime, not your application — no plugin, theme or code change can patch it; only updating PHP on the server works. Second, the flaws are old: they affect PHP versions going back years, which is why the exposed tail is so long. Third, this is not theoretical. Cloudflare reported observing exploit attempts within the first day, with attackers already adjusting their approach to slip past filters. The researchers who found the flaws (Wiz, and Calif working with AI models) coordinated with the PHP team, but details leaked early — which is why the patch shipped on an emergency schedule.

Step 1: Check your PHP version (takes a minute)

WordPress: in your dashboard go to Tools → Site Health → Info → Server. Your PHP version is listed there. cPanel hosting: open MultiPHP Manager — it shows the PHP version for every domain on the account. Server or VPS: run php -v over SSH, or temporarily place a phpinfo() page and delete it afterwards. Moodle: Site administration → Server → Environment shows the PHP version Moodle is running on.

Now compare your version with the fixed releases. If you are already on one of these — or newer — you are patched:

Step 2: Apply the fix for your situation

On PHP 8.2–8.5: this is a routine minor update. Update PHP through your host's panel or your server's package manager, then restart Apache and PHP-FPM — long-running PHP workers keep the old, vulnerable code in memory until they restart. Skipping the restart is the most common way a "patched" server stays vulnerable.

On shared hosting: you cannot patch the server yourself, but most hosts let you switch the PHP version per site (MultiPHP Manager in cPanel, or the equivalent in Plesk/DirectAdmin). Switch to the newest 8.3 or 8.4 your host offers, then test your site properly — login, checkout, contact and upload forms. If your host only offers unpatched or end-of-life versions, open a ticket today and ask directly which fixed build they are deploying; hosts worldwide are rolling these patches out this week. If they have no answer, that is a hosting problem, not a you problem.

On PHP 8.1 or older: this is the hard case, and it is where most of the risk sits. There is no security release coming for your branch, so the fix is a real upgrade to PHP 8.2 or newer — and real upgrades break old code: removed functions, stricter typing, deprecated features finally deleted. Take a full backup first, upgrade on a staging copy if you can, fix what breaks, then switch production. It is more work than a patch, but the alternative CISA spells out is blunt: systems that cannot be updated should be taken offline until they can be.

Step 3: After patching, check nobody is already inside

Patching closes the door. It does not remove anyone who already walked through it, and exploit attempts started immediately. Once your version is updated and services restarted, verify the new version is actually live, smoke-test the journeys that matter (login, checkout, file uploads — uploads are the attack surface here), and scan for the obvious fingerprints of a compromise:

• Admin accounts you do not recognise (WordPress users, Moodle admins, hosting logins).
• New or recently modified PHP files, especially inside uploads or cache folders where PHP files should never exist.
• Cron jobs or scheduled tasks you did not create.
• PHP worker processes launching shells or downloading tools — the behaviour CISA specifically flags.
• Unexpected changes to .htaccess, wp-config.php or other core configuration files.

Find any of those and the job changes from patching to incident response: preserve logs, rotate passwords and keys, and clean before you reopen the doors. If the list is clean, rotate your admin and database passwords anyway — it costs ten minutes.

Running Moodle, WordPress or WooCommerce?

Current WordPress and WooCommerce releases run happily on PHP 8.2 and 8.3, so for most WordPress sites this is a same-day fix. Moodle needs one extra check: every Moodle version supports a specific PHP range, so moving an older Moodle from PHP 7.4 or 8.0 to a patched branch can mean a Moodle upgrade in the same maintenance window. That pairing — PHP upgrade plus application upgrade, tested together — is exactly where sites break when it is rushed, and exactly why a backup and a staging pass matter more than speed alone.

Sources: the PHP security advisory and fixed releases at php.net (21 October 2026), CISA's alert "Critical Vulnerabilities in PHP Require Immediate Patching", and Kaspersky's PHP2Shell technical overview. If you only do one thing after reading this: go and check your PHP version now. It takes a minute, and this week, that minute is the whole game.