In short: On October 21, 2026, the PHP team fixed two critical security vulnerabilities that have become known as php2shell. They let attackers run their own code on a web server without a password. Fixed releases exist only for PHP 8.2, 8.3, 8.4 and 8.5. Older versions get no official fix, and PHP 8.2 itself stops receiving security updates on January 1, 2027.
This article is for anyone who runs a website, an online store or a custom-built tool and is not a developer. You will learn what happened, whether you are affected and what to do now.
What happened?
PHP is the programming language behind a large share of all websites: WordPress, Shopware, many contact forms, customer portals and internal business tools. PHP runs on your hosting provider's server and builds the pages your visitors see.
Security researchers found two serious bugs in PHP itself (identifiers CVE-2026-109618 and CVE-2026-109619). Both are rated critical with a score of 9.2 out of 10. According to the researchers, the faulty code has been part of PHP since version 5.4, released in 2012.
The fixes were originally planned for a later date. Because details about the vulnerabilities leaked on October 20, the PHP team released the updates a day early. Security provider Cloudflare already reports first attack attempts.
What does this mean in plain terms?
Think of your web server as an office building. Normally only people with a key get in, meaning a password or a login. These two vulnerabilities are like a faulty door that opens with a certain trick, no key required.
An attacker sends a specially crafted request to your website. If the attack works, they can run their own commands on the server. That can mean:
- Customer data, orders or email addresses are stolen.
- Malware or ads for scam sites are injected into your website.
- Your server sends spam or attacks other systems, and your hosting provider shuts it down.
- Payment details are skimmed at checkout.
Important: it does not matter how well your own website is built. The bug is in PHP itself. In principle, every server that delivers web pages with PHP is affected.
Which PHP versions get an update?
The PHP team only maintains a few versions at a time. Only these receive the fix as an official update:
- PHP 8.5: fixed in 8.5.12, security updates until December 31, 2029
- PHP 8.4: fixed in 8.4.27, security updates until December 31, 2028
- PHP 8.3: fixed in 8.3.36, security updates until December 31, 2027
- PHP 8.2: fixed in 8.2.35, security updates only until December 31, 2026
- PHP 7.4 to 8.1: no official update, support already ended
- PHP 5.4 to 7.3: no fix, support already ended
For PHP 7.4 to 8.1, the PHP team only published source code patches for specialists who build PHP themselves. These are explicitly not official updates. Some Linux distributions or specialised vendors ship their own emergency packages based on them. You should not rely on that: ask your hosting provider whether they apply anything like this.
Why PHP 8.2 matters right now
PHP 8.2 still gets the current fix, but only until December 31, 2026. After that, PHP 8.2 reaches "end of life", or EOL. If another vulnerability is found next year, PHP 8.2 will not get a fix.
The current vulnerability shows what that looks like: anyone still on PHP 8.1 or older today is facing a critical flaw without an easy fix. Websites on PHP 8.2 will be in exactly that position from January 2027.
So the rule is: from 2027, PHP 8.3 is the minimum version that still receives security updates. PHP 8.4 or 8.5 is even better, because it gives you more time before the next switch.
Am I affected? How to find out
You do not need to be a developer for this. These steps will help:
- Check your hosting account: Most providers show the PHP version in the settings of your web space or domain, often under "PHP settings" or "PHP version".
- Ask your hosting provider: Write to support and ask directly: "Which PHP version runs on my plan, and is it patched against CVE-2026-109618 and CVE-2026-109619?"
- Ask your developer or agency: Whoever maintains your website can check the exact version in a few minutes.
If it says PHP 8.2, 8.3, 8.4 or 8.5, the key question is whether the new update has already been installed. On regular shared hosting, the provider usually takes care of that. On your own or rented servers, the operator is responsible.
If it says PHP 8.1 or older, your website is not officially protected against this vulnerability. Do not wait.
What you should do now
If your website runs on PHP 8.2 to 8.5:
- Make sure the update is installed (8.5.12, 8.4.27, 8.3.36 or 8.2.35).
- If you are on PHP 8.2, plan the move to PHP 8.3 or newer now, not in December.
If your website runs on PHP 8.1 or older:
- Have someone check whether your website can be moved to PHP 8.3 or newer.
- Do not simply switch the PHP version in your hosting panel. Older scripts often break on newer PHP versions: forms stop sending, pages go blank or the store shows error messages.
- Ask your hosting provider whether they use additional protection until the switch.
There are emergency workarounds using certain server settings. According to the PHP team, they do not close the vulnerability completely. Updating to a maintained version is the only complete fix.
Why moving to a new PHP version takes work
Every new PHP version cleans house: old functions are removed, some ways of writing code are no longer allowed, and errors that used to be silently ignored now stop the script. For visitors, that can look like this:
- A page stays completely blank.
- The contact form no longer sends.
- The cart or payment in the store stops working.
- An old plugin or theme throws errors.
This mainly affects scripts written many years ago and rarely updated since. Often only a few places in the code need changing. But someone has to find them, fix them and test them before the new version goes live.
I described how such a switch works for Shopware projects in the article PHP 8.3 and Shopware. For older applications that have grown over time, see my service Modernize Legacy PHP Software.
Checklist for website owners
- Find out your PHP version (hosting account, provider or developer).
- On PHP 8.2 to 8.5: check that the patched version is running.
- On PHP 8.2: plan the move to PHP 8.3 or newer by the end of 2026 at the latest.
- On PHP 8.1 or older: have the move to PHP 8.3 or newer checked soon.
- Never switch the PHP version without testing, ideally on a copy of the website first.
- Check again regularly: updates do not always happen automatically.
Frequently asked questions
Do I need to do anything myself if I have regular web hosting?
Usually the hosting provider installs the PHP update. But which PHP version your website uses is often something you choose yourself in your hosting account. If an old version is selected there, it does not get the update. When in doubt, ask your provider.
Is my WordPress or Shopware website affected?
If it runs on a server with PHP, yes. The vulnerability is in PHP itself, not in WordPress or Shopware. What matters is which PHP version your server uses and whether it already has the update.
Is it enough to simply switch the PHP version?
With current, well-maintained systems, it often works. With older scripts and plugins, errors are likely. So check on a test environment first, or have it checked.
What happens if I stay on PHP 8.2?
PHP 8.2 receives security updates until the end of 2026. From January 1, 2027, it does not. Any vulnerability found after that stays open.
Official sources
For more on writing secure PHP code, read my article Avoiding Security Vulnerabilities in PHP Code.