What is PHP2Shell and who does it affect?
PHP2Shell is the name given to two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both score 9.2 out of 10 on the CVSS 4.0 scale and allow remote code execution, meaning an attacker can run their own instructions on your server (php.net).
They affect almost any PHP installation that serves web pages: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. According to the official advisory, the risk is highest with mod_php. The PHP project states there is no complete mitigation and that updating is the only safe option (php.net).
Cloudflare reported seeing attack traffic against these flaws and said it deployed firewall rules for every plan, including the free one, about nine hours before the flaws were made public (Cloudflare). That firewall helps, but it does not replace the update.
Which PHP versions are supported today?
| Version | Active support until | Security fixes until | Status as of October 2026 |
|---|---|---|---|
| 8.5 | Dec 31, 2027 | Dec 31, 2029 | Active |
| 8.4 | Dec 31, 2026 | Dec 31, 2028 | Active |
| 8.3 | Dec 31, 2025 | Dec 31, 2027 | Security fixes only |
| 8.2 | Dec 31, 2024 | Dec 31, 2026 | Security fixes only, ending in December |
| 8.1 or older | Ended | Ended | No fixes from the PHP project |
Source: php.net, supported versions. Each version gets two years of active support and two more years of security fixes.
The community has published minimal patches for 7.4, 8.0 and 8.1, and some vendors offer extended support. These are stopgaps, not a reason to stay on those versions.
How many websites run an old version?
More than you might think. In January 2026, WordPress published the PHP versions its installations were using: 22.2% were still on PHP 7.4 and 27.3% on PHP 8.2 (WordPress). Adding up 8.1 and older, almost half of WordPress sites at the time ran versions that no longer received fixes. WordPress recommends PHP 8.3 and, since version 7.0, requires at least PHP 7.4.
Across the web, W3Techs estimates that PHP powers 69.2% of sites whose server-side language can be identified, and that 34.3% of those still use PHP 7 or PHP 5 (W3Techs).
How do I find out which PHP version my site uses?
- In WordPress, go to Tools > Site Health > Info > Server. The PHP version is listed there.
- In cPanel, look for Select PHP Version or MultiPHP Manager.
- If you don’t have access, ask your hosting provider: “Which exact PHP version does my site run, and does it include the October 21, 2026 patch?”
Check the full number. For example, 8.3.36 is patched and 8.3.30 is not.
What should I do if my version is outdated?
- Make a full backup (files and database) and store it off the server.
- Test the new version on a copy of the site before changing it on the live site. Big jumps, such as 7.4 to 8.3, can break old plugins or themes.
- Update WordPress, the theme and the plugins before changing PHP, since the newest versions are usually the compatible ones.
- Switch the PHP version and check the key pages: home, forms, cart and dashboard.
- If something breaks, switch back from the same panel and fix the plugin or theme that caused the error.
If your site is on 8.2 and works well, update it to 8.2.35 now and plan the move to 8.3 or 8.4 before the end of the year.
What else can leave my site exposed?
The PHP version is only part of the problem. On WordPress sites, most of the vulnerabilities published each year are in plugins and themes, not in the core. These are the risks the OWASP Top 10 (2025) lists as the most common in web applications (OWASP):
- Plugins, themes and libraries with known flaws (software supply chain failures). An abandoned plugin may never get a patch.
- Weak passwords and accounts without two-factor authentication (authentication failures).
- Forms that accept any file, which can be used to upload code to the server.
- SQL injection and XSS, when the code doesn’t validate what visitors type.
- Insecure configuration, such as showing errors on screen or file permissions that are too open.
Checklist for your website
- Patched PHP version (8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later) and a plan to leave 8.2 before Dec 31, 2026.
- Automatic off-server backups, with a tested restore.
- Plugins and themes up to date. Delete unused ones and any that haven’t been updated in over a year.
- Never install “nulled” plugins or themes (pirated paid versions).
- Two-factor authentication (2FA) for admins, unique passwords and old accounts removed.
- A web application firewall in front of the site, such as Cloudflare’s or your host’s.
- PHP errors hidden in production, PHP execution blocked in the uploads folder and the WordPress file editor disabled.
- Someone responsible for applying critical patches within 24 hours.
In short
- PHP2Shell is two critical flaws that let attackers run code on the server without logging in.
- The patched versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- PHP 8.2 stops getting fixes on December 31, 2026, and 8.1 or older no longer get them.
- Back up, test on a copy of the site, then update.
- Plugins, passwords and forms matter as much as the PHP version.
Frequently asked questions
Is my website at risk if I use WordPress?
If the server runs a PHP version without the October 2026 patch, yes, like any other PHP site. WordPress itself is not the flaw, but it runs on PHP.
Does my host update PHP automatically?
It depends on the provider. Many apply patches within the same version (from 8.3.30 to 8.3.36), but won't change the major version (from 7.4 to 8.3) unless you ask, because that can break the site.
Is a security plugin enough?
It helps detect and block attacks, but it doesn't fix a PHP flaw on the server. You still need the update.
Does updating PHP make my site faster?
Newer versions are generally more efficient, though the difference depends on the site. The main reason to update is security.
What happens if I don't move off PHP 8.2 before 2027?
The site will keep working, but it will stop getting fixes. Any flaw found after that will stay open.
Answers from the AiDo Creative teamIT support
Help desk, PC builds and Microsoft 365, as a Microsoft Partner and OEM system builder.
View the service
