PHP2Shell is the nickname for two critical flaws in PHP, CVE-2026-109618 and CVE-2026-109619, patched on October 21, 2026. Both let an attacker who isn’t logged in run code on a web server running an unpatched version of PHP. The only complete fix is updating PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or newer).
If MGG manages your website, you don’t need to do anything. Every client site we manage is hosted on WP Engine, which has patched every PHP version on its platform: PHP 7.4.33.17, 8.2.35, 8.4.27 and 8.5.12.
What Is PHP2Shell?
PHP is the programming language behind WordPress and most business websites. Both flaws sit in how PHP manages memory and handles errors, code that nearly every page request touches.
The first, CVE-2026-109618, can corrupt memory when a request hits PHP’s memory limit at the wrong moment. The second, CVE-2026-109619, can let one request reuse memory left over from an earlier request on the same server process. PHP rates both 9.2 out of 10 on the CVSS v4 scale, which is critical.
Is PHP2Shell Being Exploited?
Yes, attempts are under way. Amazon Threat Intelligence saw a first attempt on October 17, four days before the public disclosure, and now describes PHP2Shell as broadly exploited. Cloudflare and watchTowr also reported attacks on October 21.
PHP’s security team said it hadn’t found a working exploit when it released the fix, but exploit code is now circulating. Treat any unpatched server as at risk.
Which Websites Are Affected?
Any website that uses PHP to build its pages: WordPress, WooCommerce, Magento, Drupal and most custom PHP sites. Your plugins and theme don’t matter, because the flaws are in PHP itself, not in WordPress. For the same reason, a WordPress update won’t fix it. The fix happens on the server, where your host runs PHP.
- PHP 8.2 to 8.5: safe once updated to 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer.
- PHP 7.4 to 8.1: no official PHP release. The PHP security team published source patches, so ask your host whether they applied them, or upgrade.
- PHP 5.4 to 7.3: no fix at all. Upgrade to a supported version.
How to Check Your PHP Version in WordPress
- In your WordPress dashboard, go to Tools → Site Health → Info.
- Open Server and find PHP version.
- Compare it with the safe versions above.
Some hosts patch PHP through their own builds or Linux packages, so the number can look different. WP Engine’s patched 7.4 build, for example, is 7.4.33.17. If you’re unsure, ask your host whether the PHP2Shell patches are applied.
What PHP2Shell Means for MGG Clients
Every client website MGG manages is hosted on WP Engine, a managed WordPress host. WP Engine has patched every PHP version on its platform and told customers that no action is needed. Its patched builds are PHP 7.4.33.17, 8.2.35, 8.4.27 and 8.5.12.
While the patches rolled out, WP Engine also put protective rules in place at its CDN layer, through Cloudflare and Fastly, to block known attack patterns.
Our client sites run a mix of PHP 7.4, 8.2 and 8.5, so every one of them is on a patched build. We also checked with WP Engine support, who confirmed that all PHP versions on their servers are patched.
You don’t need to do anything. If you have questions about your site, reply to our email or contact us.
Our Advice If Your Site Still Runs PHP 7.4
PHP 7.4 reached end of life in November 2022, so the PHP project no longer releases fixes for it. WP Engine patched it this time, but you can’t count on that for every future flaw. If your site still runs PHP 7.4, plan an upgrade to PHP 8.2 or newer. We can test your theme and plugins first and handle the switch.
If Your Website Is Hosted Elsewhere
Ask your host three questions:
- Is our PHP on 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer, or are the PHP2Shell patches applied?
- If we’re on PHP 8.1 or older, when will you upgrade us?
- Have you seen attack attempts against our site?
Until a server is patched, hosts can apply temporary settings and firewall rules. Cloudflare, for example, added rules for known attack patterns. PHP is clear that these only reduce the risk, and updating is the only complete fix.
FAQ
Do I need to update WordPress or my plugins?
Not for PHP2Shell: the fix is a PHP update on the server. Keep WordPress, themes and plugins updated anyway, because they get their own security fixes.
Will the update break my website?
A patch release within the same version (for example 8.2.34 to 8.2.35) fixes bugs and security issues without changing features, so sites keep working. Moving from an old version such as 7.4 to 8.2 or newer is a bigger step, and plugins and themes should be tested first.
How do I know if my site was attacked?
Look for warning signs: admin users you didn’t create, files you don’t recognise, sudden redirects, or a warning from your host. If your site ran an unpatched PHP version during the attack window, ask your host to check its server logs.
Want a host and a team that handle this kind of update for you? Read our guide to secure hosting for small businesses, or contact us.
Sources
- PHP.net: Upcoming critical PHP security release (notice, October 20, 2026)
- The PHP Foundation: Today’s PHP security release (October 21, 2026)
- Tenable: PHP2Shell frequently asked questions
- Rapid7: CVE-2026-109618 and CVE-2026-109619
- Qualys: How to find, mitigate and patch PHP2Shell
- The Hacker News: PHP issues emergency patches
