PHP2Shell: What It Is and How We Protected Your Website

Last week, the team behind PHP disclosed a serious security problem nicknamed PHP2Shell. If you’ve seen the headlines, you may be wondering whether your website was at risk. Here’s what happened in plain English, why it was a big deal, and what we did about it.

First, what is PHP?

Websites are built in layers. The part you see, your pages, photos, forms and store, is managed by WordPress and its plugins. Underneath all of that is PHP, the programming language that actually runs WordPress every time someone visits your site. If your website were a car, WordPress would be the dashboard and controls, and PHP would be the engine.

PHP isn’t only behind WordPress. It runs roughly 70% of the websites on the internet, including Drupal, Joomla, Magento and countless custom-built sites. That’s why a flaw in PHP itself gets so much attention.

What is PHP2Shell?

PHP2Shell is the nickname for two related flaws in PHP, officially tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10, which puts them in the “critical” category.

In simple terms, an attacker could send a website one specially built file upload. While PHP was still reading that upload, before the website’s own code had even started, a mix-up in how PHP managed its memory could be used to make it spill data it was holding, such as passwords and security keys. In the worst case, it could let the attacker run their own commands on the server. Getting that kind of control is called “getting a shell,” which is where the name comes from.

A few things made this one especially serious:

• No login needed. An attacker didn’t need an account, a password or any foothold. They only needed to reach the website over the internet, like any visitor.
• A well-kept website couldn’t protect itself. Because the flaw is in PHP, beneath WordPress, even a site with every plugin up to date was exposed until its host updated PHP. WordPress didn’t need an update, and no plugin could fix it.
• Nearly every version was affected. The flaws reach back to PHP 5.4. Fixes were released only for PHP 8.2 and newer, so websites still running older versions have no official fix at all.
• The details leaked early. Information about the flaws leaked online on October 20, before the fix was ready, and PHP moved its release up a day in response. Amazon’s security team later reported that attackers had started trying the flaws four days before the patches came out.

What happened next

PHP released the fixed versions (8.5.12, 8.4.27, 8.3.36 and 8.2.35) on Wednesday, October 21, at 6:00 AM Alaska time. Over the following days, researchers confirmed successful attacks against decoy servers set up to catch them. On October 26, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added PHP2Shell to its list of vulnerabilities known to be used in real attacks and gave federal agencies until October 29 to patch.

How we protected your website

Keeping the software underneath your website up to date is exactly what our managed hosting is for. Here’s what that looked like for PHP2Shell:

• Patched 27 minutes after release. Our servers install security updates automatically every morning. On October 21 they installed the fixed PHP at 6:26 AM and restarted PHP for every website we host by 6:27 AM. That restart matters: an update doesn’t protect a website until PHP is restarted to load it.
• Every site already ran a current version. All the websites we host run PHP 8.5, the newest stable release. None were on the older versions that will never get a fix.
• We checked for signs of trouble. We scanned for malicious files and looked through our servers for the warning signs researchers have described. We found nothing to suggest any website we host was affected.
• We keep watching. Researchers are still studying PHP2Shell, and we follow the advisories from PHP and the security community closely. If anything new needs attention, we’ll take care of it and post it on our status page, status.hokedesigns.com.

Do you need to do anything?

If we host your website, no. The fix is in place, and there’s nothing to install or change on your end.

If you have a website hosted somewhere else, it’s worth asking that host two questions:

1. Which version of PHP is my site running? In WordPress you can check this yourself under Tools → Site Health → Info → Server.
2. When was it updated for PHP2Shell? Ask for the date the fix for CVE-2026-109618 and CVE-2026-109619 was installed.

If the answer is PHP 8.1 or older, there’s no official fix for that version, and the site should be moved to a supported version as soon as possible. If a site went unpatched for a while, security researchers also recommend changing the passwords and keys stored on that server. We’re glad to help with either.

Questions?

If you have questions about PHP2Shell, or you’ve seen news about another vulnerability and want to know whether it affects you, email our team at [email protected] or visit our support site at support.hokedesigns.com, where we post notices about known issues. You can also check status.hokedesigns.com any time to see the live status of our services.

Sources

• PHP: Security advisory, critical remote code execution vulnerabilities
• Varonis Threat Labs: PHP2Shell, One Upload, Full Server
• BleepingComputer: CISA confirms PHP2Shell vulnerabilities now exploited in attacks
• The Hacker News: CISA confirms active exploitation of PHP2Shell