PHP2Shell: check if your PHP is affected, then fix it

What do you need to know about PHP2Shell?

Start here: what PHP2Shell is, who has warned about it and what is and isn’t confirmed.

What is PHP2Shell, and how serious is it?

PHP2Shell is the name Wiz Research gave to two memory-safety flaws in the PHP runtime: CVE-2026-109618 (“RCE via OOM corruption”) and CVE-2026-109619 (“RCE via stale global state”). The PHP project rates both as critical (CVSS 4.0 score 9.2) because a request from the internet can lead to remote code execution: an attacker could run commands as your web server, change site files and read database passwords.

The flaws are in PHP, not in WordPress, Drupal or another app, so they reach any website whose PHP serves web requests on an unfixed version. The PHP2Shell vulnerability page explains both bugs, who is affected and what is still unknown.

Which governments have issued PHP2Shell warnings?

National cybersecurity agencies in more than a dozen countries and regions, including the US (NSA, FBI), the UK (NCSC), the EU (CERT-EU), Japan, Germany, France and Singapore, have issued PHP2Shell warnings. Most urge organisations to find where they run PHP and update it immediately, and several advise taking a website offline or isolating it if it cannot be patched. See the full list of national PHP2Shell advisories, with a link to each agency’s own warning.

I just use the internet and don’t run a website. Do I need to do anything?

No action is needed on your phone or computer because of PHP2Shell. The fix has to be installed on web servers by the people who run websites. Some products, such as network storage or other devices with a web admin page, embed PHP, as several national agencies point out; keep their firmware updates switched on and install updates when the manufacturer releases them. Change a password only if a service you use tells you to, and be wary of emails or text messages that use PHP2Shell as a reason to “update” something or log in: scammers follow big security news.

Is PHP2Shell being exploited right now?

Attack attempts have been reported, but successful compromise has not been confirmed. Cloudflare said it observed attack traffic and attackers mutating payloads before the fix was released. None of the sources we checked as of 22 Oct 2026 confirms that a site was actually taken over through PHP2Shell; that is not the same as saying no one is exploiting it. A widely shared claim that sites would be taken over within 15 minutes of the patch isn’t supported by the sources we checked: Sansec wrote that it expects mass exploitation, without a timeframe. Either way, update now.

Why are so many websites offline because of PHP2Shell?

Mostly as a precaution. Agencies in the US, UK, EU and Japan told organisations to take PHP systems offline if they couldn’t patch at once, and government sites in Germany, France, the Netherlands, Finland and the Czech Republic, the Port of Rotterdam and some Wikimedia systems went offline, Reuters reported. Offline doesn’t mean hacked. See who took sites offline.

Are recent data breaches caused by PHP2Shell?

We have found no public evidence linking specific recent data breaches to PHP2Shell. Some hosting providers temporarily suspended services or features as a precaution, for example Lolipop and Sakura Internet in Japan; a precautionary shutdown is not the same as a breach. Treat posts that blame a particular leak on PHP2Shell as unverified unless the affected company says so.

Is PHP2Shell the same as wp2shell?

No. wp2shell is the name of a separate critical vulnerability in WordPress core, fixed by updating WordPress. PHP2Shell is in PHP itself and is fixed by updating PHP. If you run WordPress, make sure both WordPress and PHP are up to date.

Is my website affected by PHP2Shell?

Find the PHP your website actually runs, then compare it with the fixed releases.

Is my WordPress site affected by PHP2Shell?

Probably, until you’ve checked. WordPress runs on PHP, so a WordPress site is affected when the PHP serving it is older than the fixed release for its branch. Updating WordPress, themes or plugins does not fix PHP2Shell; only a PHP update does. In WordPress, open Tools → Site Health → Info → Server to see the PHP version. Our WordPress PHP version guide walks through it.

For the full WordPress self-check, see PHP2Shell and WordPress.

How do I check which PHP version my website uses?

Look in one of these places:

• WordPress: Tools → Site Health → Info → Server.
• Hosting control panel: the PHP settings for your domain.
• Server or container: php -v on that host or inside that container. It shows the command-line PHP, which can differ from the PHP serving your site, so confirm which PHP-FPM pool or Apache module serves the website.

Enter what you find in the PHP version checker. The check PHP version guide covers every method.

Can you check my website online for PHP2Shell?

Partly. The PHP2Shell checker can read the PHP version your site advertises in its HTTP headers, using the logic of OpenAI’s php2shell-checker. It sends one ordinary request and nothing else. Many sites hide that header, and a header can be wrong or miss a vendor backport, so a missing or old-looking version isn’t the final word. The surest check is the version in your control panel or Site Health, entered into the same checker.

Has my site already been hacked?

A version check can’t tell you. Update PHP first, then look for changes you didn’t make: unknown admin users, PHP files in upload folders, recently modified files and scheduled tasks you didn’t create. If you find something, keep evidence, change passwords and restore from a clean backup. Use the check if your website is hacked guide.

How do I fix PHP2Shell?

Update PHP to a fixed release or your vendor’s patched package, then restart PHP.

Which PHP versions fix PHP2Shell?

These are the first fixed releases of each supported branch; anything newer in the same branch also contains the fix. Linux distributions often backport the fix into their own packages without changing PHP’s version number, so a lower number from Ubuntu or Debian can still be patched. The PHP2Shell patch guide covers how to update and how to confirm it worked.

I’m on shared hosting. Will my host fix PHP2Shell automatically?

On shared or managed hosting, PHP is installed by your host, so the host has to provide the fixed version. Some hosts update automatically; others let you choose a PHP version per site, and the fix only applies once you pick a patched one. Check the version your site reports, then ask support. The patch guide includes a ready-made message for your host.

What about PHP 7.4, 8.0 or 8.1?

These branches no longer get PHP releases, so there is no new official 7.4, 8.0 or 8.1 release with the fix. Because of the severity, PHP published minimal source patches for 7.4, 8.0 and 8.1 for people who build PHP themselves, and some Linux distributions and long-term-support vendors ship backported packages; Ubuntu 22.04’s php8.1 package, for example, is fixed. Branches older than 7.4 have no official patch at all. The lasting fix is moving to a supported branch. See PHP end of life and PHP2Shell.

How do I explain PHP2Shell to my boss, clients or host?

Keep it to facts: which sites run PHP, which version each runs, who will update it and by when. For managers: “PHP, which our sites run on, has two critical vulnerabilities; fixes are available; we will update and confirm every site by [date].” The patch guide has a copy-ready request for hosting providers.

What if I can’t update PHP yet?

Stopgaps reduce exposure to specific attack paths. None of them is a fix.

Does Cloudflare or another WAF protect me from PHP2Shell?

Partly, and only for traffic that passes through it. Cloudflare deployed WAF rules for all plans with WAF enabled, including Free, about nine hours before disclosure, and reported attackers changing their payloads to get around them. A WAF filters known attack patterns; it doesn’t change the PHP on your server, and requests that reach your server directly bypass it. A WAF is an extra layer, not a fix: update PHP even if you use Cloudflare. See PHP2Shell and Cloudflare for what to check, and PHP2Shell WAF rules for AWS WAF, Fastly and Imperva.

Is turning off session.upload_progress enough?

No. PHP says setting session.upload_progress.enabled=0 blocks some confirmed attack paths for CVE-2026-109619, not every variant, and does nothing for CVE-2026-109618. It also only works when set before request parsing and followed by a restart of every PHP worker. In PHP’s own words, only an update is a complete solution. The PHP2Shell workaround page lists every official stopgap for both flaws and its limits.

PHP’s security announcement is explicit: “only an update is a complete solution.” — PHP security announcement

Where do these facts come from?

From PHP’s security announcement, the two GitHub security advisories, Linux vendor notices, national cybersecurity agencies and the original research. We checked them on 22 Oct 2026. We never run exploits.

• The PHP Group: security advisory and fixed releases
• GitHub advisory: RCE via OOM corruption
• GitHub advisory: RCE via stale global state
• Wiz Research: original PHP2Shell research
• Cloudflare: WAF protection for PHP2Shell
• Sansec: PHP2Shell research and timeline
• Canonical: Ubuntu security notice for PHP
• Debian: security announcement for php8.4
• Lolipop: precautionary suspension notice (X)
• Nikkei: Sakura Internet suspends some features
• Rapid7: wp2shell, a separate WordPress core vulnerability