As of October 26, 2026. Every host I checked for my clients has installed the fix by now. On October 26 the first successful attack was confirmed; Germany’s federal cyber security agency BSI knows of no exploitation at scale so far. What counts are the notices from the PHP project, the authorities and your host.
What PHP is
PHP is the programming language that WordPress, Shopware, Joomla, Drupal, TYPO3, Magento and many other systems are written in. It runs on your host’s server. On every page view, PHP takes the visitor’s request, starts your system and returns the finished page.
Updates to WordPress or Shopware concern the second layer. PHP2Shell sits in the third.
- 01Your contentpages, products, images, customer data
- 02Your systemWordPress, Shopware, Joomla with plugins and theme
- 03PHPthe programming language your system runs on. This is where PHP2Shell sits.
- 04Web server and operating systemApache, nginx, Linux
What the flaw allows
Both bugs are in the way PHP manages memory while it processes a request.
is the CVSS 4.0 score of both vulnerabilities, CVE-2026-109618 and CVE-2026-109619.
PHP project, Oct 21, 2026can be enough to run someone else’s code before the application even starts.
PHP project, Oct 21, 2026A single request
One crafted request in the format that forms with file uploads use is enough. The website does not need to have such a form.
Someone else’s code on the server
Whoever can run code on the server can change the website, read customer data, plant malware or send spam.
Data from other requests
On top of that, data can leak from memory, such as passwords or session data of other visitors.
Source: Sansec, Oct 21, 2026
Who is affected
The flaw is not in a plugin that some use and others do not, it is in the foundation. According to the PHP project, every PHP installation that answers web requests is at risk, whether PHP-FPM, Apache with mod_php, CGI, FrankenPHP or LiteSpeed. The default settings are vulnerable.
- 01
Websites on shared hosting
That is, most hosting plans, where several customers share one server.
- 02
Your own servers and VPS
Here you or your administrator maintain PHP yourselves.
- 03
Online stores
With customer accounts, orders and payments, the most is at stake here.
- 04
Other PHP applications
Such as Nextcloud, webmail or phpMyAdmin on the same server.
The size of the website makes no difference. Attacks like these are automated and scan the internet for vulnerable servers.
Why security plugins and maintenance mode do not help
A request passes through the server in a fixed order. PHP2Shell strikes while the request is being read in, before your system even sees it.
The path of a request
- 1The web server accepts the request
- 2PHP reads the request in: this is where PHP2Shell strikes
- 3WordPress or Shopware starts
- 4Plugins, login and maintenance mode take effect
Does not help
- Security plugins and firewall features in WordPress or Shopware
- The WordPress or Shopware maintenance mode, because it runs in PHP itself
- Updates to WordPress, Shopware, plugins or themes
Helps
- A fixed PHP version, installed by your host
- As a stopgap: a maintenance page the web server delivers without any PHP
- As a stopgap: a firewall in front, such as Cloudflare’s, against the known attack patterns
Status on October 26, 2026
All times in Central European Summer Time. The situation is still developing.
- August 2026
Security researchers at Calif and Wiz Research report the vulnerabilities to the PHP project in confidence.
Sansec - October 17
Amazon sees a first attack attempt, four days before the fix.
Amazon - October 20
Details become public early. The PHP project announces a security release for the next day.
PHP project - October 21, 9:43 a.m.
Cloudflare sees attacks, before the fix is out. An attack tool is publicly available.
Sansec · Cloudflare - October 21, 4 p.m.
The PHP project releases PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Ubuntu and Debian ship their own fixed packages.
PHP project · Ubuntu USN-8948-1 · Debian - October 21
Germany’s federal cyber security agency BSI warns at level 3 of 4 (orange) and advises temporarily disconnecting servers from the internet if the fix cannot be installed right away. CERT-EU, the security team of the EU institutions, likewise advises isolating affected applications until the update. According to the BSI, some operators in Germany have taken websites offline as a precaution.
BSI · CERT-EU - October 22
- October 23
The PHP project reports another flaw (CVE-2026-115560) that also affects the fixed versions but can only be exploited under rare conditions. Until the next regular PHP release it recommends session.upload_progress.enabled = 0.
PHP project - October 26
Security researchers confirm the first successful attack: on one of their test servers with unfixed PHP 8.4.26, attackers ran their own code.
BleepingComputer
Why this time your host has to act
PHP belongs to the server, not to your website. On shared hosting and managed servers, the host installs and updates PHP. In the control panel you usually only choose the main version, such as PHP 8.3. On your own server or VPS, you or your administrator are responsible.
- Installing the fixed PHP version
- Restarting the PHP processes so the fix takes effect
- Providing a fix for older versions or recommending the switch
- Checking whether your website is already protected
- Asking your host if that is unclear
- Switching an outdated PHP version
- Deciding whether the website goes offline until the fix
These versions no longer get regular updates from the PHP project. It has published source code fixes for experts who build PHP themselves, and some Linux distributions ship their own. On a hosting plan, the safe way is to switch to PHP 8.3 or 8.4 now. According to the PHP project, PHP 8.2 gets security updates until December 31, 2026.
What you can do now
I sum up the steps in the right order, with a template for the inquiry to your host, in the guide PHP2Shell: what to do now.
If you are not sure whether your website is affected, send me a message. I will check the current state and tell you what to do. I test a switch of the PHP version on the Doppelgänger first, an exact copy of your website.
- 1Find out the PHP version
- 2Compare it with the fixed versions
- 3Ask your host
- 4Without a fix, protect the website in the meantime
- 5Look for signs of a break-in
Sources: PHP project, security advisory of Oct 21, 2026 · BSI, IT security notice 2026-297981-1032, version 1.2 of Oct 22, 2026 (in German) · CERT-EU, Security Advisory 2026-018 · Sansec, PHP2Shell, updated Oct 22, 2026 · Amazon Threat Intelligence, Oct 21, 2026 · PHP project, notice on CVE-2026-115560 of Oct 23, 2026 · BleepingComputer, Oct 26, 2026 · Cloudflare, Oct 21, 2026 · Ubuntu, USN-8948-1
Today, the time between a vulnerability being published and the first attack is often just hours. A quarterly update can no longer keep up.
Quick answers.
Is my website affected by PHP2Shell?
If it runs on WordPress, Shopware, Joomla, Drupal, TYPO3 or another PHP system, very likely yes, as long as PHP on the server is not on a fixed version. What counts is not the version of your system but the PHP version on the server. How to find it is in the guide PHP2Shell: what to do now.
Does a security plugin or maintenance mode protect me?
No. The flaw is in the part of PHP that accepts a request. That happens before WordPress, Shopware and their plugins start. PHP keeps running in maintenance mode too. Only a fixed PHP version protects, and as a stopgap a maintenance page delivered entirely without PHP.
Is it enough to update WordPress or Shopware?
No. Updates to WordPress, Shopware, plugins or themes do not change PHP itself. PHP on the server has to be updated, on hosting plans by the host.
Who has to install the update?
On shared hosting and managed servers, the host. In the control panel you usually only choose the main version, such as PHP 8.3; the host installs the exact release. On your own server or VPS, you or your administrator are responsible.
What about PHP 8.1 and older?
These versions no longer get regular updates from the PHP project. It has published source code fixes for experts who build PHP themselves, and some Linux distributions ship their own fixes. On a hosting plan, the safe way is to switch to PHP 8.3 or 8.4 now.
Where does the name PHP2Shell come from?
A shell is direct access to a server's command line. The name describes what the flaw makes possible: getting access to the server from an ordinary request to a PHP website. According to the BSI it deliberately echoes Log4Shell, a similarly far-reaching vulnerability from 2021.