On October 21, 2026, the PHP project released emergency fixes for two critical security flaws. Wiz Research, one of the teams that found them, calls them PHP2Shell. Both let an attacker run their own code on a web server without logging in, and exploit attempts were spotted even before the fixes came out.
Every WordPress, Drupal and Joomla site runs on PHP, along with a lot of client portals, online stores and older custom apps. If your business has any of those, it needs this update. Here's how to check and what to do.
What happened
The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10, which is critical. They were found by Wiz Research, Calif and OpenAI's Codex Security team, with AI models helping to find the bugs and test the exploits.
The problem is in how PHP itself handles web requests, not in WordPress or any plugin. That means a fully updated website can still be open to attack if the PHP underneath it is old. Wiz says it got its own code running on the standard WordPress, Drupal and Joomla setups, and even on a basic "Hello World" page.
An attacker can also read memory from the server. That memory can hold passwords, API keys and other secrets your site uses.
As of October 21, security firms had seen exploitation attempts but no confirmed break-ins. Rapid7 expects real attacks to follow, given how widely PHP is used.
Is your website affected?
Probably, if it runs on PHP and hasn't been updated since October 21. The flaws affect nearly every PHP version going back to PHP 5.4. They also affect every common way of running PHP on a web server, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Apache with mod_php is the highest risk.
These are the fixed versions:
| Your PHP version | Update to this version or later |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
| 8.1 or older | No official update. Upgrade, or get a backported fix from your Linux vendor or host. |
If your site is on a fully hosted builder like Wix, Squarespace or Shopify, you don't manage PHP. The platform runs those servers.
Step 1: Find your PHP version
On WordPress, go to Tools > Site Health > Info and open the Server section. Most hosting control panels also show the PHP version on the dashboard or a PHP settings page.
One catch: Linux distributions often patch PHP without changing the version number. If your number looks older than the table above, check your vendor's security notice or ask your host directly whether they've applied the October 21 PHP security release.
Step 2: Patch it
How you patch depends on where your site is hosted.
Managed WordPress hosting (Kinsta, WP Engine and similar). Your host updates PHP for you. Kinsta and WP Engine both put temporary protections in place on October 21 while they rolled out the fixed versions. Watch for an email or status page update confirming your site is done.
Shared hosting with cPanel. The host patches PHP for everyone on the server, but timing varies. cPanel has released updated PHP packages, so hosts can update now. If your account lets you pick a PHP version and you're on 8.1 or older, move to 8.3 or newer after testing. Then ask support to confirm the patch is in place.
A VPS or your own server. Nobody is going to do this for you, so do it today. Install your distribution's updated PHP packages, then restart PHP:
- Ubuntu or Debian: run
sudo apt updateandsudo apt upgrade. - Red Hat, AlmaLinux or Rocky Linux: run
sudo dnf upgrade 'php*'. - Windows: download the current build from windows.php.net and install it over your existing version, keeping your php.ini.
- Then restart PHP-FPM, or Apache if you use mod_php, or IIS on Windows. For example,
sudo systemctl restart php8.3-fpmwith your own version number.
Don't skip the restart. Running PHP processes keep using the old code until they restart. Some packages restart PHP for you, but check rather than assume.
If you install PHP from the volunteer-run Remi repository, the PHP team says it didn't have updates on release day. They recommend switching to your distribution's packages or building from source.
PHP 8.1 or older. The PHP project no longer updates these versions. The real fix is moving to a supported version, ideally 8.3 or newer, since 8.2 stops getting security fixes on December 31, 2026. Test on a staging copy first, because older plugins and custom code can break. Some Linux vendors and long-term support providers offer backported fixes in the meantime. If you can't do either soon, the UK's National Cyber Security Centre suggests taking systems that can't be fixed offline.
If you can't patch today
The PHP team published temporary settings that block the known attack paths. They're clear that these don't make a server safe and that only the update fully fixes it. For server admins, the main ones are:
- Set
session.upload_progress.enabled=0in php.ini or the PHP-FPM pool config, then restart every PHP worker. Setting it in your app's code or a .user.ini file is too late. - On PHP 8.5, also set
fatal_error_backtraces=0and restart. - Lower your upload and post size limits, and cap request sizes at the web server or proxy.
The full list is in the PHP security advisory on php.net. If you're on shared or managed hosting, don't change server settings yourself. Ask your host.
If your site is behind Cloudflare, it already has firewall rules for the known attack patterns, including on the free plan. That's a useful extra layer, not a replacement for the update.
After you patch
- Confirm the version. Check Site Health or your control panel again, or get confirmation in writing from your host.
- Change secrets if you were exposed. Because these flaws can leak server memory, consider changing admin passwords, database passwords and API keys on any server that sat unpatched and open to the internet.
- Look for warning signs. Wiz suggests watching for unusual form or upload requests followed by memory errors, repeated server errors (HTTP 500), oversized or malformed session cookies, and PHP workers restarting for no clear reason.
- Don't forget your other PHP systems. It isn't just your website. Intranets, ticketing systems, old client portals and some network devices run PHP too. Palo Alto Networks has said all versions of its PAN-OS firewall software and Panorama are affected, with fixes still on the way as of October 21.
WordPress.org says WordPress itself doesn't need an update for these issues. The fix is the PHP update. Still, keep WordPress, your theme and your plugins current, since outdated plugins remain one of the most common ways WordPress sites get broken into.
Not sure who handles your website?
That's more common than you'd think. A lot of small businesses had a site built years ago, and nobody is quite sure who has the hosting login or keeps PHP updated. If that sounds familiar, call us at 480-550-8108. We'll find out where your site runs, check the PHP version and get it patched.