PHP2Shell: What the critical PHP flaws mean for your website

On 21 October 2026, PHP released emergency updates for two critical vulnerabilities known as PHP2Shell. They can allow an attacker to run code on an affected server without an administrator login. Both carry a severity score of 9.2 out of 10. [1][2]

If your business uses WordPress or another PHP application, ask your hosting provider to confirm that the PHP software serving your website has received the fix. Updating WordPress and its plugins alone does not establish that the server is patched.

A simple way to understand it

Think of your website as a shop.

The pages are the shopfront. WordPress manages the shelves and displays. PHP is the team behind the counter that processes requests.

Now imagine that a stranger can send a carefully crafted order that confuses that team into following the stranger's instructions. The stranger may reach areas normally reserved for staff, without the manager's key.

That is the risk behind remote code execution. An attacker may be able to make the server run their instructions. The possible consequences include stolen data, changed content, and disrupted services. [3]

Changing your WordPress password does not repair this flaw. The underlying PHP software needs attention.

What happened?

PHP2Shell covers two flaws: CVE-2026-109618 and CVE-2026-109619. They involve errors in how PHP handles memory and internal state while processing web requests. [1]

This places the problem below the website's theme, content, and plugins. A site does not need an obviously broken page to require an update.

One distinction matters: PHP2Shell and the recent certificate authority key compromise are separate incidents. Cloudflare reported compromised keys associated with eight eMudhra intermediate certificates. That incident concerns trust in digital certificates. It did not cause the PHP flaws, and a PHP update does not resolve certificate exposure. [4]

How many websites could be affected?

The scale is large, but the numbers need context.

These figures do not mean that 70% of the internet has been hacked. A technology's usage share is different from a confirmed breach count. The exposure estimate is also a snapshot, not a count of unique businesses or compromised websites.

For WordPress owners, the practical question is whether the hosting environment runs a PHP build with the security fixes. A host may already have applied them. Get confirmation rather than assume either outcome.

The warning is already being tested by attackers

In a 22 October update, Cloudflare CEO Matthew Prince reported that attempted PHP2Shell exploitation on its network rose from thousands before the public announcement to hundreds of thousands within two hours, then millions. These are reported attack attempts, not confirmed successful breaches. [13]

What governments and major firms have announced

The response has extended well beyond the PHP community:

• United States: CISA issued an immediate patching alert. The FBI Cyber Division warned that the flaws could enable remote code execution and compromise sensitive data and networks. [7][8]
• NSA: Its 21 October advisory calls for organizations to identify PHP-dependent services and prioritize vendor patches. If an immediate update is not feasible, it recommends taking the system offline until fully mitigated. [3]
• Japan: The National Cybersecurity Office urged operators to check whether their public websites use PHP and prepare to apply the patches promptly. [9]
• European Union: CERT-EU confirmed the fixes and warned that public technical details and circulating proof-of-concept code increase the risk of exploitation. [2]
• Cloudflare: It announced automatic PHP2Shell WAF protections across free and paid plans with WAF deployed. It still tells customers to patch PHP. [10]
• OpenAI and Wiz: OpenAI described a coordinated response involving PHP maintainers, Calif, Wiz, Cloudflare, and other partners. It also released a PHP version checker to help operators identify potentially vulnerable installations. [11]

The FBI's advice to website operators

The FBI calls for immediate updates, an inventory of PHP systems, and monitoring for suspicious server activity. If compromise is suspected, isolate affected systems and preserve logs. Its alert also recommends taking systems offline when an immediate update is not feasible. [8]

Japan's warning reached the Prime Minister's office

The screenshot below shows a translated excerpt of Prime Minister Sanae Takaichi's warning about the two critical PHP vulnerabilities. Refer to the original Japanese post and the National Cybersecurity Office's notice for official guidance. [9][14]

The consistent advice is to identify affected systems and apply the update promptly.

How to check your website

1. Ask your hosting provider for confirmation

Send this to your host or technical partner:

Please confirm whether the PHP runtime serving our website has been patched for CVE-2026-109618 and CVE-2026-109619. Please include the active PHP version or vendor package build, patch status, and confirmation that the updated runtime is running.

Ask them to cover subdomains, staging sites, and other PHP applications on the account too.

2. Use OpenAI's checker as an initial check

Your developer can use the OpenAI PHP2Shell checker.

It checks version information exposed by a website or local PHP installation. It does not exploit the site or prove that a security fix is installed. Hidden version headers can produce an UNKNOWN result. Vendor backports can also require separate verification. [12]

An unknown result needs investigation. A reassuring version result still needs confirmation against the actual hosting environment.

How to fix it

Update the PHP runtime

Official PHP update and fix instructions →

PHP released these fixed versions on 21 October 2026: [1]

Install the applicable fixed release or a later supported release containing the fixes. If your provider supplies a backported patch, request its advisory and package build details.

For older PHP installations, work with your provider on a supported upgrade or a verified vendor fix. Do not assume an older branch will receive an official PHP release.

Verify the update and test the website

Have your technical team back up the site, apply the fix, and restart or redeploy the relevant PHP services as required. Confirm the runtime that actually serves web requests. A command-line PHP version can differ from the website's runtime.

Then test the functions your business depends on: forms, logins, payments, bookings, and key integrations.

Keep firewall protections in place

A WAF can add protection while you complete the update. It does not replace patching. Cloudflare explicitly recommends updating PHP even with its WAF protections enabled. [10]

If you cannot patch promptly, assess temporary isolation with your provider. The NSA recommends taking affected systems offline when an immediate update is not feasible. [3]

Check for signs of compromise

Patching closes a vulnerability. It does not remove an attacker who may already have gained access.

Ask your technical team to review logs, unexpected file changes, unfamiliar administrator accounts, and suspicious activity. If they find signs of compromise, preserve evidence and begin incident response.

Need help checking or updating your website?

You should not have to interpret server advisories to know whether your business website needs action.

Contact Flowdojo for a PHP2Shell website review. Share your website URL and hosting provider. We can help confirm the PHP environment, coordinate the required update, and test your website's key functions after the change.

Already work with us? Send your Flowdojo contact a message with “PHP security check.” We will help you establish the next step.

Check it yourself or book a call

• Check your PHP version with OpenAI's checker →
• Read the official PHP update and fix →
• Book a call with Flowdojo →

Bring your website URL and hosting details. We will help you confirm the next steps.

Sources

1. PHP security advisory and release announcements
2. CERT-EU: Critical Vulnerabilities in PHP
3. NSA: Critical Patches Recommended for PHP Vulnerabilities
4. Cloudflare: eMudhra certificate compromise
5. W3Techs: PHP usage statistics
6. Palo Alto Networks Unit 42: PHP vulnerability threat brief
7. CISA: Critical Vulnerabilities in PHP Require Immediate Patching
8. FBI Cyber Division advisory
9. Japan National Cybersecurity Office notice
10. Cloudflare: PHP2Shell WAF protections
11. OpenAI: Coordinated disclosure of critical vulnerabilities
12. OpenAI PHP2Shell checker and limitations
13. Matthew Prince: PHP2Shell attack attempt statistics
14. Japanese Prime Minister Sanae Takaichi's PHP warning