What PHP2Shell is, in plain terms
PHP is the programming language underneath most association websites. WordPress, Drupal and Joomla all run on it, and so do thousands of plugins and themes. Every time someone opens a page, the web server runs PHP to build that page.
PHP2Shell is the name for two flaws in that underlying layer. They are not WordPress bugs or Drupal bugs, and they are not in any plugin. In Patchstack's words, "the flaws are in the PHP interpreter, not in any one application, so any site on a vulnerable PHP version is exposed." An attacker who uses them can take control of the web server, and with it the website and whatever is stored there, which for many associations includes member details.
9.2 / 10
Source: Tenable, PHP2Shell FAQ, October 2026
The timeline was short. The vulnerability identifiers leaked on 20 October, and PHP moved its release forward a day to 21 October. Cloudflare has reported attack traffic aimed at the flaws, and Patchstack has had exploitation incidents reported by hosting partners. The US Cybersecurity and Infrastructure Security Agency (CISA) said in its 21 October alert that it had not observed exploitation as of publication. The advice from all of them is the same: update now.
Check your own site in ten minutes
You do not need to be technical for this. You need a login to your website, or to your hosting account.
1. Confirm the site runs on PHP. If it is WordPress, Drupal or Joomla, it does. If you are not sure what it is built on, whoever set it up will know, and so will your hosting company.
2. Find the PHP version.
- WordPress: in the dashboard, go to Tools, then Site Health, then the Info tab, and open the Server section. The PHP version is listed there.
- Drupal: go to Reports, then Status report. The PHP version is among the server details.
- Any host: most hosting control panels show the PHP version on a page called something like "PHP version" or "PHP settings".
3. Compare it with the fixed releases. Your series is fixed at or above 8.5.12, 8.4.27, 8.3.36 or 8.2.35. If you see 8.1 or anything older, your site is on a version PHP no longer supports, which is its own problem (more on that below).
4. Ask your host, even if the number looks old. Linux distributions and hosts often patch PHP while keeping an older version number. Qualys notes that "backported fixes may retain an older upstream version number." So the version alone does not settle it. Send this:
The patch checklist
What you do next depends on who looks after the server. Find your row.
- Who patches PHP
- The host
- What your association does
- Send the email above and keep the reply. Nothing else unless they say so.
- Who patches PHP
- Usually the host, sometimes you
- What your association does
- Ask the host. If the panel lets you pick a PHP version, choose a supported one.
- Who patches PHP
- Whoever runs it
- What your association does
- Ask them to install the fixed release today and to tell you when it is done.
- Who patches PHP
- Nothing to patch for this flaw
- What your association does
- Check who runs any forms or payments, and that they have patched.
Managed WordPress or Drupal hosting
Shared hosting with a control panel
A server someone set up for you
A static site with no PHP
| Who patches PHP | What your association does | |
|---|---|---|
| Managed WordPress or Drupal hosting | The host | Send the email above and keep the reply. Nothing else unless they say so. |
| Shared hosting with a control panel | Usually the host, sometimes you | Ask the host. If the panel lets you pick a PHP version, choose a supported one. |
| A server someone set up for you | Whoever runs it | Ask them to install the fixed release today and to tell you when it is done. |
| A static site with no PHP | Nothing to patch for this flaw | Check who runs any forms or payments, and that they have patched. |
Managed hosts. If you pay a hosting company that looks after WordPress or Drupal for you, patching PHP is normally part of what you pay for. Your job is to confirm it, in writing, and to put the reply somewhere the next board can find it.
Self-hosted servers. If a volunteer or a contractor set up a server for you, they need to install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or the patched package from their Linux distribution, and restart the web server. Qualys advises starting with sites running Apache with mod_php, the setup PHP itself rates as the highest risk, but every PHP installation that serves web pages needs the update. Ask them to check staging copies and old test sites as well. Patchstack's advice is to "find every PHP install you run."
End-of-life versions (8.1 and older). PHP 7.4, 8.0 and 8.1 got source-code fixes only, for people who build PHP themselves. There is no official release to install. Anything older than 7.4 gets nothing. If your site is on one of these, the real fix is to move to a supported version, and that can break an old theme or plugin. Ask your host or developer to plan it with you this week, not next quarter.
Plugins. No WordPress or Drupal update fixes this, because the flaw sits underneath them. Patchstack warns against "unofficial 'fix' plugins and copy-pasted snippets", which are unverified and can break your site. Keep your plugins updated as usual, but do not expect one to solve PHP2Shell.
Firewalls are a stopgap. CISA says a web application firewall "may provide some protection until systems are updated or patched", and Cloudflare has published rules. Patchstack points out that those rules only help if your server accepts traffic exclusively through Cloudflare. Qualys is blunt: interim measures "do not make an unpatched installation safe." Updating PHP is the fix.
When staying on WordPress or Drupal is the right call
For many associations it is. A flaw in PHP is not a reason to rebuild your website, any more than a recall is a reason to sell the car. If your host patched promptly, and someone on the board knows who to call next time, you are in a reasonable position.
Stay where you are if your site depends on things a simpler site cannot do: a forum, an online shop, a learning library, or plugins your members use every week. Stay if you have a developer you trust who keeps the site updated. And stay if the site works and the only problem was this week. Patching is cheaper than moving.
What is worth noticing is how this week went. If nobody on the board knew who hosted the site, which PHP version it ran, or who was meant to update it, that is the thing to fix, whatever you decide about the website itself. Write the answers down and hand them to the next board.
Why a static site has no PHP to patch
There is another way to build a website, and it changes what a week like this asks of you.
A static site is built in advance. The pages are finished files, like a set of PDFs, and the server simply hands them out. There is no PHP, and no application assembling the page while the visitor waits, so a flaw like PHP2Shell has nothing to attack. The parts that do need a server, such as a join form or a dues payment, run separately, and somebody still has to keep those patched.
That is how Veldun builds association websites. Each site is generated ahead of time and served as plain files through Amazon Web Services, with no PHP anywhere. Joining, renewing, event registration and payments run on Veldun's own application, which we maintain, so keeping it patched is our job rather than your board's. It is not the only way to avoid a week like this one. A well-run managed host gets you most of the way there.
See your association's site rebuilt, free
Send us your current website address. Veldun rebuilds your site as a static preview at a private link nobody else is shown, so you can compare it with what you run today.
Sources for this guide
The fixed versions and CISA's position on exploitation come from CISA's alert of 21 October 2026, "Critical Vulnerabilities in PHP Require Immediate Patching". The severity score, the leak of the identifiers, PHP's risk rating for mod_php and the backports for 7.4 to 8.1 come from Tenable's PHP2Shell FAQ. Cloudflare's report of attack traffic, the note on version numbers and the limits of interim measures come from Qualys's post of 20 October 2026. The exposure of WordPress and Drupal, the exploitation incidents from hosting partners and the advice on fix plugins come from Patchstack's PHP vulnerability alert. Each was read on 22 October 2026. This guide will be updated if the picture changes.
Frequently asked questions
- What is PHP2Shell?
- PHP2Shell is the name given to two security flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619. PHP is the programming language that WordPress, Drupal, Joomla and many other website systems run on. Both flaws can let an attacker run their own code on a web server without logging in. PHP released fixes on 21 October 2026, and its security team rates both 9.2 out of 10 on the CVSS v4 scale.
- Is my WordPress site affected by PHP2Shell?
- Yes, if it runs on a PHP version without the fix. Every WordPress site runs on PHP. The flaws are in PHP, not in WordPress, so any WordPress site on an unpatched PHP version is exposed whatever plugins it uses. Look up your PHP version under Tools, Site Health, Info, Server, then ask your host whether it has applied the 21 October PHP security release. Updating WordPress or its plugins does not fix this.
- Which PHP versions fix PHP2Shell?
- PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or a later release in each series. PHP 7.4, 8.0 and 8.1 are past their end of life and got only source-code fixes for people who build PHP themselves, with no official release. Older versions get no fix at all. Hosts and Linux distributions sometimes patch an older version number, so ask your host directly rather than relying on the number alone.
- Is PHP2Shell being exploited?
- Security firms report attacks. Cloudflare has reported attack traffic aimed at these flaws, and Patchstack has had exploitation incidents reported by hosting partners. The US Cybersecurity and Infrastructure Security Agency said in its 21 October alert that it had not observed exploitation as of publication. Either way, all of them say to update now.
- Does a static website need to worry about PHP2Shell?
- Not about this flaw. A static website is a set of finished pages served as files, with no PHP running when someone visits, so there is nothing for PHP2Shell to attack. Anything on the site that takes input, such as a join form or payments, still runs somewhere, and whoever runs that part is responsible for patching it.