On 21 October 2026, critical security updates were released for PHP, the server-side language powering millions of websites. The vulnerabilities could allow attackers to execute code on a server without logging in.
Websites built with PHP may be affected, including WordPress, WooCommerce, Joomla, Drupal and custom PHP applications.
If your website's PHP installation has not been patched, contact your hosting provider to confirm that the necessary security fixes have been applied.
What is PHP2Shell?
PHP2Shell is the nickname for two critical PHP vulnerabilities:
- CVE-2026-109618
- CVE-2026-109619
Both vulnerabilities have a severity score of 9.2 out of 10. According to the PHP developers, they may allow an attacker to execute malicious code on a vulnerable server without having an account.
In practice, successful exploitation could give an attacker access to a web server, allow them to modify website files or expose sensitive information, including online store customer and order data.
This does not mean that every PHP website has been hacked. A breach is possible only if the vulnerability remains unpatched and an attacker successfully exploits it.
The PHP project released the relevant security updates on 21 October 2026.
Source: PHP's official release announcements.
Is my website at risk?
If your website uses PHP and the relevant security fixes have not been installed, it may be vulnerable.
Potentially affected websites include:
- WordPress websites
- WooCommerce online stores
- Joomla and Drupal websites
- Custom-built PHP applications
The fixes are included in these PHP releases:
- PHP 8.5: 8.5.12
- PHP 8.4: 8.4.27
- PHP 8.3: 8.3.36
- PHP 8.2: 8.2.35
Important: a lower version number does not necessarily mean the installation is unprotected. Some hosting companies backport security patches to older PHP releases without changing the displayed version number.
PHP 8.1 and earlier versions no longer receive regular upstream security updates. Security support for PHP 8.2 ends on 31 December 2026.
If you are using an outdated PHP release, plan a migration to a supported version.
How can I check my website's PHP version?
WordPress users can find the PHP version in the dashboard:
- Log in to your WordPress admin area.
- Open Tools → Site Health → Info.
- Expand the Server section.
- Find the PHP version entry.
You can also check the PHP version in your web hosting control panel.
Remember that a version number alone is not definitive proof of security. Your hosting provider can confirm whether the PHP2Shell vulnerabilities have been patched.
What should you do now?
1. Contact your hosting provider
Ask whether the server's PHP installation has been patched against CVE-2026-109618 and CVE-2026-109619.
Also ask whether PHP was restarted after the update so the fixes are actually active.
2. Check your website software
If your site runs WordPress, check for updates to WordPress itself, your theme and installed plugins.
A PHP security update fixes the underlying server software, but outdated WordPress plugins may have unrelated vulnerabilities of their own.
Regular website maintenance helps keep software up to date, maintain backups and reduce website security risks.
3. Back up your website
Before switching PHP versions or applying major updates, back up both your website files and database.
Older themes and plugins may not work correctly with a newer PHP release.
4. Do not delay security patches
According to the PHP developers, temporary mitigations do not fully eliminate these vulnerabilities. Installing the applicable security fixes remains the recommended solution.
How can you tell whether your website has already been attacked?
Exploitation of PHP2Shell may not be immediately visible to website visitors.
Possible warning signs include:
- Unexpected website errors or downtime
- Unusual server requests or repeated errors in server logs
- Unknown changes to website files
- Security warnings in Google Search Console
- Visitors being redirected to unfamiliar websites
The absence of these signs does not prove that your website is safe.
If you suspect a breach, contact your hosting provider or a security specialist. You can also report a cybersecurity incident to Estonia's CERT-EE at raport.cert.ee.
What do Estonia's authorities and hosting providers say?
On 21 October 2026, the Estonian Information System Authority (RIA) warned about the two critical PHP vulnerabilities and recommended applying security updates as soon as possible, prioritising systems exposed to the internet.
Source: RIA's security advisory (in Estonian).
Estonian hosting provider Zone reported that it introduced protective measures and also patched older PHP versions from 5.6 through 8.1.
Customers using Zone's fully managed hosting do not need to install these fixes themselves. However, customers managing their own VPS or dedicated servers must update the server software themselves.
Source: Zone's PHP security update notice (in Estonian).
Is updating PHP enough?
For the PHP2Shell vulnerabilities themselves, correctly installing and activating the PHP security patch addresses the underlying flaw.
However, that does not automatically make the entire website secure.
The security of WordPress, WooCommerce and other content management systems also depends on keeping the platform, plugins, themes, server configuration and backups up to date.
If attackers compromised your website before the PHP update, applying the patch will not remove any malicious files they left behind. The website must be investigated and cleaned separately.
Need help with website security or updating PHP?
If you do not know which PHP version your website uses or whether the necessary fixes have been installed, consider having your site checked by a specialist.
Kodulehed.eu provides website and WooCommerce maintenance, software updates, PHP upgrades and security assistance for WordPress websites.
We can also maintain and improve websites originally created by another agency or developer.
Explore our service: Website maintenance and security – Kodulehed.eu.
For a personalised assessment and quote, contact Kodulehed.eu.
Do not wait for a security incident. Timely maintenance and updates help prevent costly problems and keep your website reliable.
Need help with your website or online store?
Describe your situation briefly and we will prepare a clear quote.
Request a quote