PHP2Shell Explained: The Critical PHP Flaw and How to Protect Your Website
Short answer
PHP2Shell is the nickname for two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4.0. They can let an attacker run code on a server without logging in. Because PHP powers WordPress, Drupal, Joomla and many custom sites, the risk is wide. PHP released fixes on 21 October 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If your site runs PHP, confirm with your host that it is on a fixed version or newer.
Key takeaways
- ✓The flaw is in PHP, not in a plugin or theme.
- ✓Fixed versions: 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- ✓Attacks were reported around the release, so act now.
- ✓Sites that do not run PHP are not affected by these flaws.
PHP2Shell at a glance
| Item | Detail |
|---|---|
| CVEs | CVE-2026-109618 and CVE-2026-109619 |
| Severity | CVSS v4.0 9.2 (critical) |
| Impact | Unauthenticated remote code execution |
| Fixed versions | 8.5.12, 8.4.27, 8.3.36, 8.2.35 |
| Fix released | 21 October 2026 |
| Most exposed | WordPress, Drupal, Joomla and custom PHP sites |
| Older PHP | 8.1 and earlier: limited or no fixes; upgrade |
What to do today
- Find out whether your site runs PHP (ask your developer or host).
- Check the PHP version in your hosting panel or WordPress Site Health.
- Ask your host in writing when the patched version is live.
- If you cannot patch at once, put the site behind a web application firewall.
- Plan an upgrade if you are on PHP 8.1 or older.
- After patching, check for signs of compromise.
- Change passwords and keys if anything looks wrong.
Want this applied to your brand?
We will find the psychology behind your lost sales and show you what to fix first.
Book a Growth AuditSigns a site may already be compromised
- Admin users you did not create.
- PHP files inside upload folders.
- Unexpected scheduled tasks or redirects.
- Spam pages appearing in Google results for your domain.
- Sudden spikes in server errors.
- Security warnings in browsers or Search Console.
A worked example
Imagine a Dubai clinic running WordPress on shared hosting. The owner checks Site Health, sees PHP 8.1, and emails the host. The host confirms it cannot patch 8.1, so the clinic moves to PHP 8.3 with the fix, enables a firewall, and runs a quick check for unknown admin users. The site stays online and patient enquiries keep flowing.
How Husbar helps
Husbar reviews business websites for security basics, speed and lead capture, and can coordinate fixes with your host or developer. Our funnel and sales page team can take this on end to end, or support your in-house team. book a free Growth Audit.
Questions to ask before you start
- Does our site run PHP?
- Which PHP version are we on?
- When will our host deploy the fix?
- Do we have a recent clean backup?
- Who checks for compromise after patching?
Key terms
- Remote code execution (RCE): an attacker running their own code on your server.
- CVE: a public ID for a known vulnerability.
- WAF: web application firewall that filters malicious traffic.
Mistakes to avoid
- Assuming WordPress updates fix it; this needs a PHP update.
- Assuming your host patched automatically.
- Staying on unsupported PHP versions.
Why a fast, secure website is a sales tool
Your website is often the first serious impression a buyer gets. A slow, broken or hacked site loses trust in seconds, while a fast, clear and secure one quietly turns visitors into enquiries. Security, speed and conversion are not separate projects: they are all part of making the site earn its keep.
Read our PHP2Shell WordPress checklist, is WordPress safe after PHP2Shell and the website security checklist.
What is PHP2Shell?+
The nickname for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619.
Is my WordPress site affected?+
If it runs on an unpatched PHP version, it may be exposed; check your PHP version.
Will a security plugin protect me?+
Not reliably, because the flaw is in PHP before WordPress loads.
What if my host has not patched?+
Ask for a date, use a WAF in the meantime, or move to a host that has patched.
Are non-PHP websites affected?+
No, these specific flaws affect PHP.
Does Husbar build websites?+
We plan conversion-focused site structures and build landing pages, sales pages and funnels, and we can work alongside your developer on the rest.
How do I get a website review from Husbar?+
Book a free growth audit and we will review your site for clarity, speed, tracking and lead capture.
Sources
- [Recorded Future: PHP2Shell exploitation explained](https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation)
- [watchTowr: PHP CVE-2026-109618 FAQ](https://watchtowr.com/intelligence/php-cve-2026-109618-faq/)
- [xCloud: PHP2Shell and WordPress emergency checklist](https://xcloud.host/php2shell-wordpress/)
Team Husbar
Husbar Editorial
Team Husbar is the strategy, psychology and research team at Husbar, a psychology-led growth agency headquartered in Dubai. Together we have worked with 100+ brands over 10+ years.
Want this applied to your brand?
We will find the psychology behind your lost sales and show you what to fix first.
Book a Growth Audit