Guides · · Agile Media Agency
PHP2Shell: is your site's server on a PHP that can't be patched?
Two serious PHP flaws were fixed on 21 October 2026, but only for PHP 8.2 and newer. Here is what that means for your site, in plain words.
On this page
What happened
On 21 October 2026 the PHP project fixed two serious flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed "PHP2Shell". Both let a stranger run code on a server without logging in. That is the worst kind of flaw, because nobody has to trick you into anything.
The US cyber agency CISA added both to its list of vulnerabilities known to be exploited on 26 October. Its alert says to patch right away, starting with systems that face the internet (CISA alert).
It is not a WordPress problem
The flaw sits in PHP, the language many websites run on. It is not in WordPress, a theme or a plugin. CISA says it affects PHP set up to answer web requests, whether through Apache, PHP-FPM or other common setups (CISA).
So updating WordPress, or deleting a plugin, does not close it. The fix is the PHP version on the server.
Which PHP versions have a fix
PHP released fixes in these versions:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
PHP 8.1 and older are not on that list. PHP's own supported versions page shows 8.2 as the oldest branch that still gets security fixes, and 8.2 is due to stop on 31 December 2026. Branches that are no longer supported do not get new fixes from the PHP project.
Some hosting companies and Linux distributions fix old PHP versions themselves. If your host says it has, ask which fix it applied and make sure the answer names both CVE numbers. We cannot see that from outside.
How many sites are on old PHP
The numbers are large:
- PHP runs about 69% of the websites whose server language is known. Of those, 25.9% use PHP 7 and 7.5% use PHP 5 (W3Techs, 8 November 2026).
- VirusTotal counted about 1.1 million servers that announce their PHP version. About 758,000 of them were on branches from 5.4 to 8.1, which no longer get security fixes (VirusTotal).
- VirusTotal says these figures describe what is exposed on the internet. They do not prove each server can be broken into.
Most servers hide their version, so a site on old PHP often looks fine from outside.
What our test can and cannot tell you
Our test reads only public information. Some servers send a header that names the PHP version. When we see it, we report what we detected. When the version is hidden, we do not guess: the result will say we could not tell, and you should ask your host.
A site may also be on a supported PHP version that has not had the October fix yet. The version number alone does not settle it. The exact release matters.
What to do
- Find out your PHP version. Your hosting control panel usually shows it, or your host can tell you.
- If you are on 8.2, 8.3, 8.4 or 8.5, check you have the October fix (8.2.35, 8.3.36, 8.4.27 or 8.5.12 or newer).
- If you are on 8.1 or older, move to a supported version. CISA's advice for systems on 8.1 or older is to take them offline until they are patched or upgraded (CISA). If you are on 8.2, note that its security support ends on 31 December 2026 (php.net). Old plugins and themes sometimes break on a newer PHP, so test first.
- If you cannot patch today, CISA's advice is to take the affected system offline until you can.
- Watch for anything unusual. CISA suggests looking for PHP processes that start shells or download tools; your host can help with that.
Moving a very old site to newer PHP is sometimes more work than it sounds, because the code was written for the old version.
How we can help
Test your site for free. We will show what we detected and what is likely to matter. If the site is stuck on old PHP, Agile Media Agency can rebuild it on a modern, fast platform with no PHP to patch. Tell us about your site.