PHP2Shell: the website flaw everyone is talking about

The short version

If you only read one thing: find out which version of PHP your website uses, and make sure it is 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer. Anything older than those is exposed. Anything on PHP 8.1 or earlier has no fix at all and must be upgraded.

What PHP is, and why this matters to you

You almost certainly do not think of your website as "running PHP", but it probably does. PHP is the engine underneath WordPress, WooCommerce, Joomla, Drupal, Magento and most custom-built business websites. When someone visits your site, PHP is the program on your server that builds the page they see, talks to your database, processes your contact form and handles your online shop.

Because PHP sits so deep in the machinery, a flaw in PHP itself is far more serious than a flaw in a single plugin. A plugin bug affects the sites using that plugin. A PHP bug affects everyone running that version of PHP — and because it lives below your website's own code, there is nothing your website can do to protect itself. Only updating PHP fixes it.

What actually goes wrong

The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619. In plain terms, both are "memory corruption" bugs. Think of your server's memory as a desk covered in paperwork. Normally PHP keeps every document in its right place. These flaws let an attacker send a specially crafted request that knocks the paperwork into disarray at exactly the wrong moment — and then trick PHP into reading the wrong piece of paper as if it were a legitimate instruction.

The outcome is what security people call remote code execution — the worst category of flaw there is. It means an attacker, from anywhere in the world, can run their own commands on your server. From there they can read your database (customer names, emails, orders), steal passwords and payment details, install malware that infects your visitors, quietly redirect your traffic, send spam from your domain, or simply wipe everything.

One of the two flaws is particularly dangerous because, on the most common server setup (Apache with PHP built in), it can be triggered before your website's own code even runs. That means it does not matter how well-written or well-secured your actual site is. The door is in the building, not in your flat.

Why this one is being taken so seriously

Serious PHP flaws do appear from time to time, but a few things make PHP2Shell unusual. The details leaked before the official fix was published, which gave attackers a head start. Public exploit code appeared online within a day. Security firms reported attack traffic almost immediately. And national cyber-security agencies in the UK, US, Australia, Canada, Singapore and the EU all issued alerts — that level of coordinated warning is rare.

The honest assessment from researchers is that these rank among the most severe flaws ever found in PHP. For a small business, the practical translation is simple: this is not a "get round to it" update. It is a "today" update.

Who is affected

• Every website running PHP 5.4 or newer that has not been updated to a patched release. That is almost every PHP site in existence.
• All the common ways of running PHP — PHP-FPM, Apache with mod_php, php-cgi, LiteSpeed and FrankenPHP. If your site is on typical shared hosting (cPanel, Plesk, Spaceship, SiteGround, GoDaddy and so on), it is in scope.
• Sites on PHP 8.1 and older are in the worst position. Those versions are end-of-life and will not receive a fix. The only remedy is to move to a supported version.

How to check your own site

VigilScan checks this automatically. If your server announces its PHP version, we compare it against the patched releases and tell you plainly whether you are safe. Many servers hide the version (which is good practice) — in that case we tell you so and show you how to check yourself.

To check on cPanel hosting (the most common setup for UK small businesses):

1. Log in to cPanel.
2. Open MultiPHP Manager (sometimes called "Select PHP Version").
3. Find your domain in the list. The PHP version is shown next to it.
4. Compare it to the patched list: 8.2.35, 8.3.36, 8.4.27 or 8.5.12. If yours is lower, you are exposed.

On WordPress, go to Tools → Site Health → Info → Server, and look for "PHP version".

How to fix it

There is only one real fix: update PHP to a patched version. On shared hosting you usually cannot do this yourself — your hosting company has to roll out the patched PHP packages. Most good hosts did this within hours of the release. If yours has not:

1. In cPanel → MultiPHP Manager, see whether a patched version (8.2.35+, 8.3.36+, 8.4.27+, 8.5.12+) is available to select. If it is, select it for every domain.
2. If no patched version is offered, raise a support ticket with your host immediately and ask when the PHP2Shell patches (CVE-2026-109618 / 109619) will be available.
3. If you are on PHP 8.1 or older, use the same screen to move to PHP 8.2 or newer. Test your site afterwards — the vast majority of sites move up without any issues.

Temporary measures exist for people who genuinely cannot patch right away — for example disabling session.upload_progress — but PHP's own team is clear that there are no complete mitigations and updating is the only safe choice. Treat anything else as a stopgap for hours, not a solution.

What to do if you think you were already hit

If your site was unpatched for a period while exploits were public, assume it may have been probed. Signs of compromise include unfamiliar files appearing on the server, new admin users you did not create, your site redirecting visitors elsewhere, hosting warnings about outbound spam, or your site being flagged by Google. If you see any of these, change every password (hosting, database, WordPress admin, email), restore from a backup taken before the exposure window if you can, and consider getting a professional to check the server.

Common questions