Turn Your Ideas Into Digital Growth
Discover how Atlas SoftWeb transforms your website, marketing, and technology into a powerful growth engine that drives real business results.
On 21 October 2026, the PHP project rushed out emergency security updates for two critical flaws, now known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Within hours, governments across Europe took their own websites offline, security agencies on four continents issued urgent alerts, and Cloudflare reported attack attempts climbing from thousands to millions.
PHP powers roughly three out of every four websites whose server technology is known, including WordPress, WooCommerce, Magento, Drupal, Joomla and Laravel. If your website runs on PHP, this affects you. This guide explains, in plain English, what the issue is, who is affected, what global authorities are saying, and exactly how to fix it.
What: Two flaws in PHP’s request handling that can allow unauthenticated remote code execution — an attacker can run their own code on your server without logging in.
Severity: 9.2 Critical (CVSS v4.0, PHP security team); NVD lists 9.8 Critical (CVSS v3.1).
Affected: Essentially every PHP version from 5.4 onwards that serves web requests.
Fixed in: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (or a patched package from your Linux distribution or host).
Status: Exploit attempts reported in the wild; public exploit code is circulating.
Action: Patch PHP, restart PHP services, and check your site for signs of compromise.
PHP2Shell is the name given to two separate memory-safety bugs in the core of PHP — the engine itself, not any plugin or theme. Because the flaws sit in the way PHP parses incoming web requests, they can be triggered before your application code even runs. That means the security features of WordPress, Laravel, Symfony or any custom application cannot block them.
When PHP runs out of memory while it is still building the data for an incoming request, its clean-up routine can later treat half-built data as if it were valid. A carefully crafted request can abuse this to corrupt memory and take control of the PHP process.
Leftover state from one request can point to memory that has already been released. A later request handled by the same PHP worker can then use that “freed” memory. Besides code execution, the PHP team also confirmed this flaw can leak memory contents — which may include sensitive data such as session information or credentials.
| Date (2026) | What happened |
| 17 October | Amazon Threat Intelligence records an exploit attempt on its MadPot honeypot network — four days before public disclosure. |
| 20–21 October | A working proof-of-concept is leaked through an anonymous Hacker News post, forcing PHP maintainers to abandon their planned schedule. |
| 21 October | PHP releases emergency fixes: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Cloudflare deploys WAF rules at 03:02 UTC for all plans, including free. |
| 21–22 October | Government and public-sector websites in the Netherlands, France, Germany, Belgium, Finland and elsewhere are taken offline as a precaution. National cyber agencies issue alerts. |
| 22 October onwards | Hosting providers roll out patches; attack attempts reported by Cloudflare, watchTowr, Amazon and others continue to grow. |
In short: anyone running a website or web application on PHP. That includes small business websites, ecommerce stores, membership sites, intranets, CRMs and internal tools.
| PHP branch | Status | What you should do |
| 8.5.x | Fixed in 8.5.12 | Update to 8.5.12 or later and restart PHP |
| 8.4.x | Fixed in 8.4.27 | Update to 8.4.27 or later and restart PHP |
| 8.3.x | Fixed in 8.3.36 | Update to 8.3.36 or later and restart PHP |
| 8.2.x | Fixed in 8.2.35 | Update to 8.2.35 or later and restart PHP |
| 7.4 – 8.1 | No official release; source backports only | Upgrade to PHP 8.2+ or use a vendor/distribution patched build |
| 5.4 – 7.3 | End-of-life; no fix | Upgrade urgently, or take the site offline until upgraded |
PHP says every installation that serves web requests is at risk, including PHP-FPM, Apache mod_php, php-cgi, LiteSpeed and FrankenPHP. Apache mod_php is considered the highest risk, because an unauthenticated request can trigger the exploit before any application code runs.
Researchers confirmed pre-authentication remote code execution against specific versions of popular PHP applications, including WordPress, Drupal, Joomla and Magento. Ecommerce platforms such as WooCommerce, Magento and Shopware are considered especially high-risk because they process customer and payment data. Shopify, Wix and Squarespace stores are managed by those platforms and are not directly exposed in the same way.
| Hosting type | Who patches? | Your action |
| Managed WordPress (Kinsta, WP Engine, Pantheon, Pressable, etc.) | Your host | Confirm with your host that the 21 October fix is applied |
| Shared / cPanel hosting (GoDaddy, Hostinger, Namecheap, etc.) | Your host | Check your host’s status page; open a ticket if unclear; switch to PHP 8.2+ in your control panel if you are on an older version |
| VPS, cloud or dedicated server | You (or your developer) | Update PHP packages and restart PHP-FPM/Apache immediately |
| Docker / containers | You | Rebuild images from patched base images and redeploy |
The response to PHP2Shell has been one of the broadest coordinated security alerts in years. While sources differ on how widely the flaws have been successfully exploited, every authority agrees on one thing: patch immediately.
The PHP security advisory calls the update “the only complete fix” and identifies mod_php as the highest-risk setup. The PHP Foundation says it demonstrated remote code execution on mod_php with default settings.
In an unusual move, several governments and large organisations chose to take their own websites offline rather than risk exposure while they patched. Reported shutdowns, mostly on 21–22 October 2026, include:
Most of these organisations described their shutdowns as precautionary, and several reported no confirmed breach. The lesson for businesses is clear: if national governments judged the risk serious enough to go offline, an unpatched business website should not wait.
| Platform | Key actions |
| WordPress / WooCommerce | Confirm PHP 8.2+ patched build with host; disable session upload progress; scan for unknown admins and modified files; rotate WooCommerce payment API keys |
| Magento / Adobe Commerce | Patch PHP-FPM and restart; check for skimmers and web shells in pub/ and app/ folders; review admin users; rotate integration tokens |
| Laravel / custom PHP | Update server PHP and rebuild containers; restart queues and workers; rotate .env secrets; review logs for suspicious POST requests |
| Drupal / Joomla | Patch PHP; review recent file changes and new user accounts; ensure core and extensions are also up to date |
Do I need to update WordPress to fix PHP2Shell?
No. PHP2Shell is a flaw in PHP itself, not in WordPress. The fix is a PHP update on your server. However, keeping WordPress, plugins and themes updated remains good practice.
Is my Shopify store affected?
Shopify is a fully hosted platform, so you do not manage PHP and are not directly exposed in the same way. Any separate PHP-based sites or apps you run are still at risk.
My host says I am protected. Is that enough?
If your host confirms the 21 October patch is applied and PHP has been restarted, you are protected from these flaws. It is still wise to check your site for any signs of compromise from before the patch.
Is a firewall like Cloudflare enough on its own?
No. WAF rules are a valuable stopgap, but attackers can sometimes reach your server directly. Patching PHP is the only complete fix.
I am on PHP 7.4. What should I do?
PHP 7.4 to 8.1 receive no official release. Upgrade to PHP 8.2 or later as soon as possible, testing your site for compatibility. If you cannot, consider taking the site offline until it is upgraded.
Need help? Atlas SoftWeb can secure your website today
Not sure which PHP version your website runs, whether your host has patched it, or whether your site was targeted before the fix? Atlas SoftWeb can take care of it for you.
Since 2011, Atlas SoftWeb has built and maintained WordPress, WooCommerce, Magento, Laravel and custom PHP websites for businesses in more than 50 countries. Our 50+ member team includes web developers, server specialists and QA engineers who handle security updates like PHP2Shell every day.
Free vulnerability check — we confirm your PHP version, server setup and patch status.
Emergency patching — PHP update and service restart on VPS, cloud and dedicated servers, or coordination with your host on shared hosting.
PHP 8.2+ upgrade — safe upgrades from end-of-life PHP with full theme, plugin and custom code compatibility testing on staging.
Compromise check and clean-up — log review, malware and web-shell scanning, admin user audit and credential rotation.
Firewall setup — Cloudflare WAF configuration and hardening of php.ini and server settings.
Ongoing protection — website maintenance plans with monthly updates, monitoring, backups and security reporting.
Don’t wait for your website to become the next headline. Contact our team today for a free PHP2Shell check.
Atlas SoftWeb is a Google Partner agency, an official Shopify Partner and rated 4.9 on Clutch.
Discover how Atlas SoftWeb transforms your website, marketing, and technology into a powerful growth engine that drives real business results.
