↓Skip to main content
  1. News/

PHP2Shell: What to Ask Whoever Runs Your Website

·10 mins
PHP PHP2Shell WordPress WooCommerce CPanel Small Business
Table of Contents
On October 21, 2026, the PHP project released fixes for two critical flaws in PHP, the programming language behind a large share of websites. Updating WordPress or its plugins does not fix them. The update has to happen on the server, by whoever runs it, so the useful question is “who updates PHP for our website, and have they?”

What happened #

The PHP project’s advisory covers two remote code execution flaws, CVE-2026-109618 and CVE-2026-109619. Researchers call them “PHP2Shell”, a nickname for the two flaws, not a product or a piece of malware. “Remote code execution” means an outsider could run commands on the server. Researchers at Wiz add that an attacker could read data held in the PHP process’s memory, which may include passwords, login tokens and API keys.

The PHP project says the risk covers “all PHP installations serving web requests”. Temporary measures “reduce exposure to specific attack paths but do not make an installation safe”. Datadog Security Labs puts it this way: “Only patching fixes these vulnerabilities.” The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Huntress’s timeline says details leaked on October 20 and the PHP project moved its release up to October 21.

Exploitation reports differ, and the picture is changing. Datadog reports “multiple reports of active exploitation in the wild”, and watchTowr says exploitation has been observed since October 21. Other firms describe those as attempts, not confirmed break-ins, and as of October 23 SecurityWeek reported that none had been confirmed. Sansec says mass exploitation is less likely than it first expected, because an attack needs specific knowledge of the target server, and it cites a researcher who found that the public exploits do not work against a default PHP installation. The October 24 update below has the details.

What runs on PHP #

Huntress says PHP runs WordPress, Drupal, Joomla and Magento sites, shared hosting platforms, and control panels such as cPanel and Plesk. Some vendor software bundles its own copy. Sansec also lists MediaWiki, phpMyAdmin and Nextcloud among the programs researchers reported as exploitable. W3Techs figures, which we could see only as a search-result summary, put PHP at roughly seven in ten websites whose language is known.

Many owners do not know whether their site is one of these, which is normal. A site running PHP is exposed until PHP is updated, and your host or IT person can tell you whether yours is. If a vendor runs the whole service, such as a hosted store or booking service, the question goes to the vendor. We found no source settling which website builders use PHP, so we will not guess.

If your website runs on WordPress or WooCommerce #

WooCommerce is an online-store add-on for WordPress; its own site calls it “the Open Source commerce platform for WordPress”. If your website takes orders, deposits or bookings, it may run on it. GravityKit’s analysis of HTTP Archive data found WooCommerce on 6.64% of measurable web origins in May 2026, ahead of Shopify at 4.76%. TechnologyChecker’s data shows no dominant industry among its users.

Meow Apps, a WordPress plugin company, says updating WordPress or your plugins won’t fix this. Wiz demonstrated code execution against the latest WordPress, Drupal and Joomla container images, and Sansec says WooCommerce stores are affected even when their own code is clean. Inside WordPress, Tools, then Site Health, then Info, then Server shows the PHP version. Treat it as a clue, not proof. GoDaddy warns that “Your PHP version number may not change after this update”, because some fixes are added without changing the number.

If your website is hosted on cPanel #

cPanel is a control panel many hosting companies use. Two situations put the work in different hands.

Shared hosting. The hosting company updates PHP. Your job is to ask and get a clear answer. GoDaddy’s guidance is “Check with your provider”. Meow Apps adds that some hosts put a protective layer in front of PHP while the real update rolls out. That is useful, but it is not an updated PHP.

A server your business or IT person runs. Nobody else will do it. cPanel’s October 21 release notes list updated cPanel and WHM versions and EasyApache 4 packages for PHP 7.4 through 8.5. watchTowr and Datadog both say every PHP worker must be restarted after updating, or the old code keeps running, and watchTowr says PHP 7.3 and older, including PHP 5, have no fix. We could not read cPanel’s support article, so ask your IT person to confirm the restart happened.

If you run software installed on a server #

Some business software is installed on your own or a vendor’s server and is written in PHP, or needs it. Examples: OpenEMR, practice-management software for clinics; SuiteCRM, a customer-records (CRM) system; Dolibarr, business-management software; Nextcloud, self-hosted file sharing; and phpMyAdmin, a database administration tool.

We found no source saying any clinic or business has been attacked through these programs. Sansec says the research team Calif reported that an attacker without a login can run code on phpMyAdmin and Nextcloud, among others, and we found nothing either way for OpenEMR, SuiteCRM or Dolibarr. All of them run on PHP, so they depend on the server’s PHP being updated. If a vendor runs the software for you, the question goes to the vendor. If you run your own practice-management software, ask your IT person or software vendor what applies to you.

Five questions to ask this week #

  1. Who hosts our website, and each portal or booking page, and who is responsible for updating PHP on it? Sansec advises owners who don’t manage their server to ask the hosting provider.
  2. Has PHP been updated on it since October 21? Please answer in writing. A firewall rule is not the same as an updated PHP, and a version number alone can mislead.
  3. Does anything we own still run PHP 8.1 or older, and if so, what is the plan? The PHP project no longer updates those versions beyond minimal source backports, and CISA advises taking PHP-based systems that cannot be updated, or that run PHP 8.1 or earlier, offline until they can be.
  4. Can you give us a complete list of every website, portal and web-based program we have, including old ones nobody uses? Huntress advises inventorying every PHP installation, including those bundled in vendor software.
  5. After the update, did anyone check for accounts, files or scheduled tasks nobody recognizes? The update closes the flaws; Huntress separately advises looking for signs of compromise.

These questions will not prevent an attack. The sources say an update is the only complete fix, and other measures only reduce exposure.

If you think a site was already compromised #

Call your host or IT person right away. Huntress advises isolating the affected server and preserving the web server and PHP logs, so avoid cleaning up first.

What to do next #

Send the five questions today and ask for written answers. If you are not sure who your host or IT person is, that is the first thing to find out.

If your IT person wants to search server logs for the signs researchers have published, we collected them, with sources and a short hunt guide, in an open repository: PHP2Shell indicators on GitHub.

At SOC-Lite, a named analyst reviews your alerts, calls you when one is real, works with your IT person or MSP on the fix, and keeps the evidence. A visibility check is free, it takes 20 minutes, and you talk to us by phone or at your office. Book a visibility check

Updates #

2026-10-24: What changed since October 22.

  • Attempts, but no confirmed break-ins. SecurityWeek, The Record and Cybersecurity Dive report widespread exploitation attempts. Amazon saw the first one on October 17, four days before the fix, and Cloudflare reported millions of attempts by early October 22. Some attempts were tied to Potassium, a Mirai-derived botnet that can launch DDoS attacks. Sophos retracted an earlier report of a successful exploitation, and as of October 23 no security firm quoted in those reports had confirmed a compromise.
  • Why it is still urgent. VulnCheck says it built an exploit that works on production-style setups, with memory randomization on and error display off, and offers it to its customers. Mandiant says some public exploits can run code against default Apache mod_php setups, though not PHP-FPM. Several researchers quoted by The Record warn the quiet period may not last, and that attackers are already scanning for vulnerable servers.
  • CISA’s revised alert (October 23). It lists Apache mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed as affected, and says mod_php carries the highest risk. It repeats the advice to take PHP-based systems offline if they cannot be updated, and says a web application firewall may provide some protection. As of the morning of October 23, SecurityWeek reported that neither CVE was in CISA’s Known Exploited Vulnerabilities catalog.
  • WordPress. The WordPress Security Team said no WordPress update is required or planned, and that owners should look for PHP updates from their host, according to The Repository. The same report says 35.1% of WordPress sites run a PHP version the PHP project no longer patches. PCrisk warns that WordPress Site Health can show a green check for PHP 8.3 or newer even when the fix is missing, so read the full version number or ask your host.
  • Hosts are moving at different speeds. As of October 22, The Repository reported several hosts finished and others still rolling out. At least one large host’s standard web hosting was waiting on patched packages from its vendor and relying on temporary protections. That is why question 2 asks for a written answer.
  • If your site was exposed before the update. Mandiant, quoted by Cybersecurity Dive, advises rotating keys and passwords on internet-facing systems that were exposed before patching. Wordfence, as relayed by The Repository, advises keeping server and firewall logs from at least 48 hours before the release. Sucuri advises checking for unfamiliar PHP files, unexpected scheduled tasks, unknown admin accounts and suspicious outbound connections.
  • Scale. The Hacker News reports that Censys still counted 34.4 million PHP services as vulnerable on October 23. SecurityWeek reports that Qualys found about 71% of PHP instances in its data run versions past end of life.
  • Indicators repository. We published the indicators researchers have reported, each with its source, and a log-hunting guide for IT staff: PHP2Shell indicators on GitHub. It is aggregated from the public research credited there, it is not tested, and it will go stale, so check the dates in it.
  • Correction. The cPanel restart step now rests on watchTowr and Datadog instead of a secondary write-up, which has been removed from the sources.

2026-10-22: First published, based on the sources below as of this date.

Sources #