AMDigitec InsightsKey takeaways
- PHP2Shell is the name given to two critical PHP vulnerabilities that let an attacker run code on a web server without logging in.
- It affects almost every PHP version, and attacks began the same day the fix was released.
- Updating WordPress or its plugins does not fix it. The PHP software on the server itself must be updated.
Most business websites never mention the language they are built on. Yet a large share of them, including most WordPress sites, run on PHP. In October 2026, two serious flaws in PHP were disclosed together under the name PHP2Shell, and attackers started using them almost immediately.
This article explains what PHP2Shell is, why it matters to businesses that are not technology companies, and the questions to ask today. It reflects what was publicly known as of 24 October 2026.
What PHP2Shell is
PHP2Shell covers two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 for severity. In plain terms, they let an attacker send specially crafted requests to a website and run their own code on the server, without a password and before the website’s own code has done anything.
Once an attacker can run code on a server, they can change the website, plant malicious files, steal data stored on it, or use it as a foothold into other systems.
This is not a WordPress problem or a plugin problem. It sits underneath them, in the PHP software that runs the website.
Why it matters to your business
- It is widespread. PHP powers a large share of the web, including WordPress, Drupal, Joomla, online stores and many hosting control panels.
- It is already being exploited. Details leaked before the planned announcement, and attacks were reported from the day the fix was released.
- No login is needed. An attacker does not need a stolen password or a weak plugin to get in.
- It can be hidden. PHP is often running inside client portals, intranets, booking systems and other tools, not only your public website.
Am I affected?
According to PHP’s security release, every PHP version before the fixed releases is affected, on every common type of web server setup. The risk is highest where PHP runs as an Apache module.
| PHP version family | Fixed release | What to do |
|---|---|---|
| 8.5 | 8.5.12 | Update to 8.5.12 or later |
| 8.4 | 8.4.27 | Update to 8.4.27 or later |
| 8.3 | 8.3.36 | Update to 8.3.36 or later |
| 8.2 | 8.2.35 | Update to 8.2.35 or later |
| 8.1, 8.0 and 7.4 | No official release | Use a patched package from your Linux distribution or support vendor, or upgrade to a supported version |
| 7.3 and older | No fix | Upgrade to a supported version, and restrict access until you do |
Get AMDigitec Insights by email
Questions to ask your web host or IT provider today
You do not need to be technical to get the right answers. Ask whoever runs your website and servers:
- Which of our systems run PHP, including portals and internal tools, not only the public website?
- Which PHP version is each one actually running, and has it been updated to a fixed release?
- Were the PHP processes restarted after the update, so the fix is really in use?
- Have the systems been checked for signs that they were attacked before the update?
If your site is on shared hosting, the update is your host’s job. Ask them to confirm, in writing, that the fixed version is running on your account.
What to do now
- Update PHP first. PHP has stated that no configuration change fully protects an affected system. Only the update does.
- Check the version that is actually running. A server can have the new package installed while still running the old version until PHP is restarted.
- Restrict access to anything you cannot update yet. Some organizations took sites offline or limited access to them until patches were in place.
- Treat filtering as temporary. Some web security services added temporary rules to block known attack patterns. They help, but they do not replace the update.
- Look for signs of compromise. Because attacks started before many systems were patched, check for unfamiliar files, new administrator accounts and unexpected changes.
The bigger lesson
PHP2Shell is a reminder that a website is not only its pages and plugins. It runs on software layers that need owners, an up-to-date inventory and a clear process for urgent updates. Businesses that know what they run, and who is responsible for each part, can act on a warning like this in hours instead of days.
If you are not sure what is running across your systems, or who is responsible for updating it, our cybersecurity services can help you take stock and close the gaps. An IT & Security Assessment gives you a verified picture of where you stand and a written plan for what to fix first.
Common questions
Does updating WordPress fix PHP2Shell?
No. WordPress and its plugins run on top of PHP. The fix is an update to PHP itself on the server, followed by a restart of PHP.
Is my website affected if it uses a website builder or a hosted platform?
Possibly, depending on the platform. If you do not manage the server, ask your provider to confirm whether PHP is involved and whether it has been updated.
We updated PHP. Are we safe now?
The update closes the vulnerability, but it does not undo anything that happened before it. Because attacks began before many systems were patched, it is worth checking for signs of compromise.
What if we are running an old PHP version?
Older versions have no official fix. Use a patched package from your Linux distribution or support vendor if one exists, plan an upgrade, and restrict access in the meantime.