Skip to content
pryoraContactGet my free demoFree demo
Blog

PHP2Shell: what to ask your web host this week

By Pryora

On 21 October 2026, the people who maintain PHP released fixes for two serious security flaws. They are known together as PHP2Shell. PHP is the software that runs most WordPress websites, so many small business sites are affected. On 26 October, the US cyber agency CISA added both flaws to its list of vulnerabilities that attackers are known to be using.

In Australia, the Australian Signals Directorate issued a rare critical alert, and some Australian hosts and organisations restricted uploads or took services offline while they patched, as ABC News reported on 22 October.

If your host has already patched your site, you have nothing to worry about. If it hasn't, the time to find out is now, not next month, because attackers are already looking for unpatched servers. For most owners the fix is one message to their web host. This post explains what happened and what to ask.

What PHP2Shell is

PHP2Shell is two flaws in PHP itself, not in WordPress or any plugin. Each lets an attacker who can reach your website run their own commands on the server it lives on, without a password. Both are rated 9.2 out of 10 for severity.

The attack is not easy. It depends on how the server is set up, and it works best on servers running PHP through Apache's "mod_php", a common arrangement on shared hosting. But researchers have shown it working, and CISA's listing means it is being used against real sites.

WordPress has said this is not a WordPress flaw and that it will not release a WordPress update for it. Updating WordPress or your plugins does not fix it. PHP has to be updated.

Who is affected

Any website that runs on PHP and has not had the fix. That includes most WordPress, WooCommerce and older custom sites. You are most at risk if your site runs one of these PHP versions:

  • 8.2.34 or older, 8.3.35 or older, 8.4.26 or older, or 8.5.11 or older. The fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
  • PHP 8.1 or older. These versions no longer receive official releases. PHP 7.4 stopped in November 2022, 8.0 in November 2023 and 8.1 in December 2025. For these two flaws, PHP's security team made an exception and published patches for 7.4, 8.0 and 8.1 as source code only, so an old site is only safe if its host has applied them.

About one WordPress site in three still runs one of these older versions, according to WordPress.org's own statistics.

What to ask your host

Your host controls PHP, so start there. Send them these questions today:

  1. Which PHP version does my website run? You can also find it in WordPress under Tools, then Site Health, then Info, then Server.
  2. Has it been patched for CVE-2026-109618 and CVE-2026-109619? Some hosts apply the fix to older PHP versions without changing the version number, so the number alone does not tell you. Ask them to confirm.
  3. If it runs PHP 8.1 or older and has not been patched, can you move my site to PHP 8.3 or newer? WordPress itself recommends 8.3 or newer.
  4. Can you turn off PHP's "session upload progress" feature for my site? This is a partial protection that PHP's maintainers suggest while you wait. It does not replace the update.

Before a PHP upgrade, take a backup. Then check that the site still works, especially forms, checkout and booking. Older themes and plugins sometimes break on newer PHP, and that is the situation the next section is about.

A third, smaller issue

On 23 October, PHP's maintainers also published a notice about a related issue, CVE-2026-115560. It has no fix yet. It only applies to unusual setups, and turning off session upload progress (question 4 above) avoids it. A fix is expected in a regular PHP release.

When patching is not possible

Most sites can simply move to a newer PHP version. Some cannot. An older theme or plugin that is no longer maintained may stop working on PHP 8.3, and the host may have no safe patched build for an old version.

In that case you have three honest options:

  • Pay a developer to update or replace the parts that break.
  • Keep the old site offline until it is fixed. CISA's advice for unpatched systems is to take them offline, and for a brochure site that is often a reasonable short-term choice.
  • Move to a fresh website that has no PHP, plugins or database to patch.

If a fresh site is the right choice, we can help. Websites built by Pryora do not run PHP, so a flaw in PHP is not one they can have. Calls booked by 30 November 2026 get a website of up to 10 pages for $299 instead of $599. See the details, or ask for a free demo of your new site, which takes about 15 minutes.

Check your own site

Joel, who runs Pryora, built a free tool at phpscan.dev that estimates whether a website is likely to be running an exposed PHP version. It is a quick first look, not a guarantee, so your host's answer is the one that counts.

Sources

This post was last checked on 28 October 2026. Facts may change, so check the sources for anything newer.