PHP2Shell: Is My Website Running PHP, and How Do I Fix It? (October 2026)

On 21 October 2026 the PHP project released an emergency update for two critical security flaws, CVE-2026-109618 and CVE-2026-109619, now widely known as "PHP2Shell". The UK's National Cyber Security Centre (NCSC) has warned that they may allow attackers to run commands on any web server running PHP, without needing a password, and the Department for Education has told schools and colleges to get assurance from their IT providers straight away.

PHP powers a huge share of the web, including most WordPress websites. If you run a small business, a school, a charity or a club, there's a good chance your website uses it, even if you've never heard of it.

What Is PHP2Shell?

PHP is the programming language that runs behind many websites, building each page as a visitor requests it. The two flaws involve how PHP handles memory. Under the right conditions an attacker can corrupt that memory and run their own commands on the server, which is known as remote code execution. Because no login is needed, any PHP website that's reachable on the internet can be targeted.

A successful attack could let someone deface your website, steal customer or pupil data from its database, plant malware that infects your visitors, or use your server to send spam.

Is My Website Running PHP? Five Ways to Check

1. Is it a WordPress site? If you log in at yourwebsite.co.uk/wp-admin, it runs on PHP. In WordPress, go to Tools > Site Health > Info > Server to see the exact PHP version.
2. Do your page addresses end in .php? For example contact.php or index.php. If so, it's PHP.
3. Check your hosting control panel. In cPanel or Plesk, look for "Select PHP Version", "MultiPHP Manager" or "PHP Settings". The version shown is what your site uses.
4. Use a free website technology checker, such as a browser extension that shows what a site is built with. These usually list PHP and WordPress if they're in use.
5. Ask whoever built or hosts the site. It's a one-line question, and given the DfE and NCSC alerts, they should be expecting it.

Websites That Probably Aren't Affected

• Wix, Squarespace and Shopify sites: the platform runs and patches the servers for you, and your site doesn't run its own PHP.
• Modern JavaScript sites hosted on platforms like Vercel or Netlify, such as Next.js sites. These don't use PHP, though Node.js had its own security update the same week (see below).
• Hosted WordPress.com plans: the platform manages PHP updates, but check its status page to confirm.

Which PHP Versions Are Fixed?

PHP branch	Fixed version	Status
8.5	8.5.12	Update now
8.4	8.4.27	Update now
8.3	8.3.36	Update now
8.2	8.2.35	Update now
8.1 and older	No official release	Urgent: upgrade, or use a hosting provider's patched build

For PHP 8.1, 8.0 and 7.4, the PHP security team has published source patches, and some hosting platforms have released their own patched builds. Older versions than that have no fix at all.

How to Fix It

If you're on shared or managed hosting

Most large hosting companies update PHP for you, but don't assume. Check your host's status page or ask support to confirm that your account is on a fixed version. If your control panel lets you choose a PHP version, pick the newest supported one, then check your website still works.

If you have your own server (VPS or dedicated)

1. Update PHP to the fixed version for your branch using your system's package manager.
2. Restart PHP (PHP-FPM or your web server) so the new version is actually running.
3. Check the version from the server and from your website.
4. Prioritise anything reachable from the internet. If you can't update straight away, the NCSC advises taking the system offline until it's fixed. The PHP Foundation has published temporary mitigations, but they aren't a complete fix.

If your website is on PHP 8.1 or older

This is the most urgent case. Old WordPress themes and plugins sometimes don't work on newer PHP, which is often why a site was left behind. The safest route is to test the site on a supported PHP version, fix anything that breaks, and move it across. If that will take time, ask your host whether they offer a patched build of your current version as a stop-gap.

How to Tell If Your Site Has Already Been Attacked

• New administrator accounts you don't recognise
• Unfamiliar files on the server, especially recently modified .php files
• Spam pages, strange redirects or Google warnings about your site
• Your hosting company reporting high resource use or outgoing spam

If you see any of these, change all passwords, restore from a clean backup taken before the problem started, and get the site checked properly before putting it back online.

What About Node.js?

The same week, Node.js fixed its own serious flaw in the code that handles compressed data, nicknamed "Node2Shell". If your website or app is built with JavaScript on Node.js, read our guide to the Node.js Brotli vulnerability.

For Schools and Colleges

The DfE has asked schools to get written assurance from their IT provider, website provider and software suppliers that affected services have been assessed and patched. If you don't have an IT provider, or yours hasn't replied, we can check your website and online services and give you that confirmation.

Want Us to Check and Fix It?

We'll check whether your website and online services run PHP, confirm the version, apply the update or work with your host to get it done, and give you written confirmation for your records, insurer or governors. Get in touch and we'll reply within a few hours, or see our cybersecurity services.

Sources

• NCSC: Critical security issue affecting PHP
• Datadog Security Labs: PHP2Shell analysis and remediation
• AWS: PHP web runtimes security bulletin