What is PHP2Shell? What it means for your business website
PHP2Shell is a critical PHP flaw from October 2026. Why updating WordPress isn't enough, whether your host already patched it, and what to check today.
By Jeensuk Yang
PHPFree · Web security · Risk series 01
?Who this is for
- You run your business website on WordPress
- Your web host sent you an "urgent maintenance" or "security notice" email this week
- You're thinking, "I already updated WordPress, so we're fine"
!What you'll learn
- What PHP2Shell is, and where the hole actually is
- What happened between October 20 and 22
- Whether your site is affected, and what to check today
Hi, I'm Jeensuk Yang, CEO of ATATAKAI Digital.
Did your web host email you about "urgent maintenance" around October 21? And did you think, "WordPress and our plugins are up to date, so this has nothing to do with us"? This time, that very thought is the biggest trap.
You don't need to be technical to follow this. I'll walk you through what broke, where it broke, and the three things worth checking today. For most small business sites, the answer will turn out to be calm, not scary.
Where is the hole? In PHP, not in WordPress
The hole is in PHP, the program on your web server that WordPress runs on. Updating WordPress or your plugins does not fix it.1
Think of your website as a house. The paint and furniture are your theme and plugins. The walls and rooms are WordPress itself. And the foundation that holds the whole house up is a program called PHP.
WordPress sits on top of PHP. You can repaint every room upstairs, and the crack in the foundation will still be there.
Cloudflare, a network and security company, says the same thing: the flaw is in the PHP runtime itself, so updating your site's code or plugins alone does not fix it.1
Jeensuk's take"Plugins updated, done!" doesn't solve this one. The place to check is the server, where the PHP foundation lives.
What happened between October 20 and 22?
The PHP team warned on October 20 that an emergency fix was coming and released it on October 21. On the same day, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) told organizations to update immediately.2·3·4
There are two flaws (CVE-2026-109618 and CVE-2026-109619), known together as "PHP2Shell." Researchers from Calif, OpenAI and Wiz found them with the help of AI.5·6
| Date (2026) | What happened |
|---|---|
| Oct 20 | The PHP team posts "Upcoming Critical PHP Security Release," warning that an emergency fix is coming.2 |
| Oct 21 | PHP releases the fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.3 CISA publishes an alert telling organizations to update immediately.4 |
| Oct 21–22 | Web hosts patch their servers. Hostinger, for example, finishes rolling out the fixed PHP versions on October 22 at 06:44 UTC.9 |
| Oct 23 | CISA revises its alert.4 The PHP team publishes a separate notice about a narrower, related issue.3 |
Jeensuk's takeFrom the warning to the fix to hosts patching their servers took about two days. That speed tells you how serious the people who run the internet thought this was.
Why is PHP2Shell such a big deal?
For three reasons: no login is needed, a huge number of servers run PHP, and attackers started trying before the fix was out.
1. Someone outside can run programs on your server, without logging in
An attacker doesn't need your password. A specially crafted request is enough to run a program on the server. Wiz, one of the research teams, showed the attack working against test setups of the latest WordPress, Drupal and Joomla, and warned that passwords and API keys sitting in the server's memory could leak.5
2. The number of servers involved is enormous
PHP has powered websites around the world for decades. Palo Alto Networks estimated that more than 22.6 million internet-facing PHP environments could be affected.8
3. Attack attempts started before the fix
Cloudflare said it put protective rules in place for all its customers before the fix was public, and that it saw attack traffic.1 At the same time, CISA said it "has not observed successful exploitation of these vulnerabilities in the wild as of the time of publication."4
Several companies saw attack attempts. As of CISA's alert, no successful attack had been confirmed.
"We're too small to be a target"?
In a 2025 survey of 1,000 executives at organizations with under $100 million in revenue, 64% said they believe their organization is too small to be an attractive target.10 But Verizon's 2026 Data Breach Investigations Report found that 31% of breaches now start with software vulnerabilities, the top way attackers get in.11 In plain terms, what gets a site broken into is usually an unpatched gap, whatever the size of the business behind it.
Jeensuk's takePlenty of headlines are written to scare you. Keep "attempts" and "damage" apart. That's how you decide calmly what to do next.
Is your website at risk?
If your site is on ordinary shared or managed hosting, your host has most likely patched PHP for you already. Here is what some hosts announced.
| Host / service | What they announced |
|---|---|
| Hostinger | Every hosting plan except VPS is protected, and customers need to do nothing. VPS owners who manage PHP themselves must update and restart it.9 |
| Kinsta | Patched PHP 7.4 through 8.5 on its platform. No customer action needed.12 |
| Reclaim Hosting | Managed hosting: "no action is required at this time." Customers running their own PHP containers must redeploy by October 27.13 |
| Cloudflare | Free and paid WAF (web application firewall) customers were protected by default. This buys time but does not replace the PHP fix.1·4 |
In other words, if your company site runs on regular shared hosting, the crack in the foundation has very likely been filled by your host already. The story changes if any of these apply to you:
- Your company or your web designer runs the server yourselves, for example on a VPS or your own server
- Someone may have already broken in before the patch
- You're affected by the narrower, related issue the PHP team announced on October 23
Jeensuk's takeMost shared-hosting sites are probably already taken care of. You only need to check whether one of those three cases fits you. The next articles in this series cover each one.
What should you do today?
Pick one of three quick checks. Each takes five minutes or one question.
Look for your web host's security notice or status page and confirm the PHP fix is done. This is the most reliable check.
In your WordPress dashboard, go to Tools → Site Health → Info → Server.14 Some hosts apply the fix without changing the version number, so read it together with the notice.
If someone else built your site, ask them: "Are we on shared hosting or a VPS? And who updates PHP on our server?"
The choice is yours. My suggestion is to start with C.
Jeensuk's takeThe hardest part of a problem like this is rarely the hole itself. It's the moment when nobody knows who is supposed to fix it. Settle that first.
Frequently asked questions about PHP2Shell
If I update WordPress and my plugins, am I protected?
No. The hole is in PHP, underneath WordPress. PHP on the server has to be updated to a fixed version (8.5.12, 8.4.27, 8.3.36 or 8.2.35).
I'm on shared hosting. Do I need to do anything?
Usually not. On shared hosting, your host has most likely patched PHP already. Still, confirm it in your host's notice, and check separately that no one got in before the patch.
Where can I see which PHP version my site uses?
In your WordPress dashboard under Tools → Site Health → Info → Server. Some hosts fix PHP without changing the version number, so check it against your host's notice.
How can I tell if my site was attacked?
Not from the outside alone. CISA advises watching for signs such as PHP processes launching shells or downloading tools, which your host or developer can check. Part 4 of this series walks through the steps.
SOURCES
- Cloudflare Blog, "Cloudflare deploys protections against php2shell vulnerability" (Oct 21, 2026) blog.cloudflare.com
- The PHP Group, "Upcoming Critical PHP Security Release" (Oct 20, 2026) php.net
- The PHP Group, "Security advisory: Critical remote code execution vulnerabilities, update now" (Oct 21, 2026; follow-up notice Oct 23) php.net
- CISA, "Critical Vulnerabilities in PHP Require Immediate Patching" (Oct 21, 2026; revised Oct 23) cisa.gov
- Wiz Research, "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet" (Oct 21, 2026) wiz.io
- BleepingComputer, "PHP ships emergency patches for critical PHP2Shell flaws" (Oct 21, 2026) bleepingcomputer.com
- Rapid7, Emergent Threat Response: CVE-2026-109618 and CVE-2026-109619 (Oct 21, 2026) rapid7.com
- TechTarget, "PHP2Shell: 22M exposed servers at risk as emergency patches released" (Oct 21, 2026) techtarget.com
- Hostinger, "Hostinger deploys protections against php2shell PHP vulnerabilities" (Oct 21, 2026) hostinger.com
- Security Boulevard, "Survey Surfaces Myriad Small Business Security Challenges" (Coalition / Wakefield Research survey, Jul 7, 2025) securityboulevard.com
- Verizon, "2026 Data Breach Investigations Report" verizon.com
- Kinsta, "PHP2Shell: How Kinsta protected WordPress sites" (Oct 23, 2026) kinsta.com
- Reclaim Hosting, "Reclaim Cloud and PHP2Shell" (Oct 22, 2026) reclaimhosting.com
- WordPress.org, "Site Health screen" (updated Jul 12, 2026) wordpress.org
Five articles on what PHP2Shell means for small business websites. More English editions are on the way.
- What is PHP2Shell? (this article)
- Patched, but still not safe? Three cases (coming soon)
- Why sites on a VPS or your own server are still at risk (coming soon)
- What if someone got in before the patch? Three signs (coming soon)
- PHP 8.2 support ends Dec 31: what to decide now (coming soon)
More articles on the ATATAKAI Digital blog.
Find out in 30 seconds whether your site is affected.
Enter your site address and we'll tell you right away whether it runs on PHP and where your host stands. If you're not affected, we'll say so plainly: "No need to move right now."
Run the free 30-second checkWant to talk it through after you see the result? Contact ATATAKAI Digital
Updated Oct 25, 2026