PHP2Shell Explained: What It Means for Your Website

It is tempting to think a flaw in a programming language is a problem for software developers, not for the people who own websites. If your website runs on WordPress, or your college runs Moodle, PHP2Shell is your problem too. The good news is that the fix is usually quick, and most of it sits with your hosting provider.

This article explains what PHP2Shell is in plain English, how to tell whether your website is affected, and the questions to put to whoever hosts it.

What PHP is, and why it matters to you

PHP is the programming language that very many websites are built with. WordPress is written in PHP. So is Moodle, the learning platform many colleges use, and many other content management systems and online shops.

You never see PHP. It runs on the server, quietly turning your pages, posts and courses into what visitors see. Because it sits underneath everything, a flaw in PHP affects every site built on an unpatched version, however carefully the site itself was made.

What PHP2Shell is

On 21 October 2026, the people who maintain PHP announced two serious flaws, now tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 for severity (Help Net Security).

In simple terms: an attacker can send a specially shaped request to a website. Because of the flaw, PHP mishandles it in a way that can, in the worst case, let the attacker run their own commands on the server. No password is needed. The weakness is in PHP itself, not in the website built on top of it.

Attempts to use the flaw were reported from 17 October, four days before it was publicly announced (Tenable). So this is not a theoretical risk.

Is your website affected?

Ask one question: is my website built on PHP?

• WordPress, Moodle, Joomla, Drupal, and most sites on shared "cPanel" hosting: these usually run PHP.
• Sites built with other technologies (for example Python, or a static site with no server code): no. PHP2Shell does not apply to them.

If your site is on PHP, what matters is the PHP version your server runs. PHP released fixed versions on 21 October 2026:

If your site runs on PHP…	The fixed version is…
8.5	8.5.12 or later
8.4	8.4.27 or later
8.3	8.3.36 or later
8.2	8.2.35 or later
8.1 or older	No official fix. Plan a move to a supported version.

What to ask your hosting provider

You do not need to understand the technical detail to protect yourself. Send your hosting provider three short questions, in writing:

1. Which PHP version does my website run on today? It should be one of the fixed versions above.
2. When was it updated? On or after 21 October 2026 is what you want to hear.
3. Have you checked for signs that anyone used the flaw before you patched? Attempts started on 17 October, so a server patched later should be checked, not just updated.

If the answers are vague, or the site is on PHP 8.1 or older, take that seriously. An old PHP version often means old plugins and themes too, and a site that has not been looked after for a while is exactly what automated attacks look for.

What we did for the websites and platforms we host

We host a number of WordPress websites and Moodle learning platforms for clients. When PHP2Shell was announced, we:

• updated PHP on our server to the fixed version (8.3.36) and removed the older versions;
• switched off the server functions the published attack relies on to take control;
• put a web application firewall in front of every site, which checks each request and refuses the kind of request PHP2Shell relies on, as well as other common attacks;
• routed the sites on Cloudflare-managed domains through Cloudflare, so traffic is filtered before it reaches our server;
• set up nightly backups of every site to an encrypted, off-site copy.

We then tested the protection ourselves: attack-shaped requests were refused, and normal use was unaffected.

None of that is unusual. It is what a hosting provider should do in the week a flaw like this is announced, and it is what you are entitled to ask yours about.

The broader lesson

PHP2Shell will be fixed and forgotten within months, and another flaw will replace it. The sites that come through these weeks safely are not the ones with the most expensive tools. They are the ones where someone keeps the software underneath up to date, watches for announcements like this one, and has a recent backup to fall back on if something does go wrong.

If you are not sure who does that for your website, or you would like help finding out which PHP version your site runs, get in touch. We will give you a straight answer.