What is PHP2Shell?
PHP2Shell is the name used for two critical flaws in PHP itself: CVE-2026-109618 and CVE-2026-109619. Under exploitable conditions, an attacker can run code on an affected server without first logging in.
One issue concerns corruption during out-of-memory handling. The other concerns stale internal state left between requests. Both are problems in the runtime underneath an application. They are not limited to a particular WordPress plugin.
Sources: PHP’s OOM-corruption advisory and stale-state advisory.
Wiz demonstrated exploitation against representative WordPress, Drupal and Joomla deployments. Cloudflare also reported traffic targeting these flaws. That makes this an urgent update, but it does not establish that every exposed business website has been breached.
Sources: Wiz Research and Cloudflare’s response.
Where did it start?
The verified origin is a software flaw in PHP’s request handling. Discovery history and the identity of an attacker are different questions. The sources below do not establish a single criminal group or country behind all attempts.
- A PHP developer found early signs of the out-of-memory issue while following up on an external audit. A practical remote-code-execution path had not yet been established.
- Calif and OpenAI reported the root cause on August 11. Wiz supplied further attack vectors later that month. Demonstrated impact made the fix a top priority.
- Information leaked ahead of coordinated disclosure. The PHP project brought forward its announcement and accelerated the release.
- The project released fixes across its four supported branches. Researchers and providers published their findings and response guidance.
Timeline: the PHP Foundation’s first-hand account. Dates describe discovery and disclosure, not the start of every attack.
Which sites need attention?
Ask about any web-serving PHP installation, including PHP-FPM, Apache mod_php, CGI and LiteSpeed. A custom-designed site can still use PHP for its forms or backend. Older applications and forgotten subdomains belong in the inventory too.
These are the first fixed upstream releases for the October 21 incident. A distribution may issue a security backport without adopting the same visible version number, so obtain its package-level confirmation.
| Your PHP branch | First fixed upstream release |
|---|---|
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |
Source: CERT-EU advisory and the two PHP advisories. PHP 8.1 and older do not receive these upstream supported-branch releases; discuss a supported upgrade or verified vendor backport.
Compare your PHP version
In WordPress, look under Tools → Site Health → Info → Server. Otherwise, ask your host for the runtime actually serving web requests. WordPress’s instructions ↗
Runs only in your browser. No website scan, email request or network lookup. It compares the October 21 baselines above; it cannot verify a server, vendor patch or compromise.
Six steps to take now.
You do not need to investigate PHP memory internals. You need a clear owner for the update, evidence it is running, and a recovery plan if anything is wrong.
0 of 6 actions marked reviewed. This is your checklist, not a security score.
A security plugin, HTTPS or a firewall does not replace this runtime fix. Keep those controls, but get explicit patch confirmation. If your site may already be compromised, involve your host or a qualified incident-response provider; a rebuild is not a substitute for containment and investigation.
Send your host a better question.
Fewer exposed parts.
A more deliberate build.
A static-first website serves pages built ahead of the visit. When that public page path has no PHP interpreter, these PHP runtime bugs have no PHP process to exploit in that path. That is a specific architectural benefit, not a promise that every custom website is safer.
Rendering model: Astro documentation. The security interpretation follows OWASP’s entry-point and attack-surface principles.
What can be removed
A PHP-driven public page layer, an unnecessary public CMS login, and plugins you no longer need. Only count a component as removed when the deployed architecture actually removes it.
What still needs care
Forms, APIs, booking and payment integrations, hosting, dependencies, third-party scripts and account access. Moving the front end does not automatically secure these services.
Custom code can have vulnerabilities too. A smaller system still needs careful development, updates, protected deployment credentials, monitoring and recoverable backups. Browser-side protections matter even on static sites.
If your business site mainly explains your services and generates inquiries, a PHP-free custom build may fit. If you depend on a complex CMS workflow, membership system or store, map those needs before choosing a replacement. Patching a maintained PHP site can be the right immediate decision.
Digital Reach can scope a custom website rebuild around your pages, forms and integrations. If no PHP anywhere in the delivered stack is a requirement, make it part of the written scope—not an assumption based on how the front end looks. Review our website work and bring your current platform and must-keep features to the first call.
A practical owner kit.
No email gate. Take the checklist to your host or use the graphic to explain the next step to your team.
The two-page owner checklist
Patch baselines, six actions, space for your host’s answers, and questions to ask before a rebuild. Dated October 22, 2026.
The saveable action graphic
Confirm → patch → verify. A high-resolution PNG for your team, with the dated fixed-version baselines.
For broader site planning, use Start Here. For ordinary website usability issues, read the website mistakes checklist. Neither is a malware or vulnerability scan.
Clear answers.
No scare tactics.
Does PHP2Shell mean my site has been hacked?
No. A vulnerable runtime is an exposure, not proof of compromise. Your host needs to verify patching and review evidence if there are signs of an intrusion.
Will a WordPress or security-plugin update fix it?
The defect is in PHP itself. Keep WordPress and plugins updated, but ask your host to verify the PHP runtime fix as well.
Does Cloudflare mean I can skip the PHP update?
No. Cloudflare reported deploying protections, but the PHP project says an update is needed for a complete fix. Confirm your particular protection and patch the underlying service.
Is a custom-coded website impossible to hack?
No. Custom code still needs secure development, updates, access controls and monitoring. A properly scoped PHP-free architecture removes these PHP runtime paths; it does not remove every way a website can be attacked.
Technical answers follow the PHP release guidance, Cloudflare’s provider report and OWASP’s risk model.
Primary sources.
Checked October 22, 2026. Security information changes quickly; use these sources for later patches and guidance. Vendor observations are identified as vendor reports.
- PHP: October 2026 security release ↗Official release guidance and fixed versions.
- PHP advisory: CVE-2026-109618 ↗Out-of-memory corruption; affected and patched branches.
- PHP advisory: CVE-2026-109619 ↗Stale global state; affected and patched branches.
- PHP Foundation: discovery and disclosure history ↗Primary account of the 2024 warning signs and 2026 response.
- CERT-EU: Security Advisory 2026-018 ↗Urgent patching, vendor backports and temporary isolation advice.
- Wiz Research: PHP2Shell ↗Research demonstrations and the underlying PHP engine flaws.
- Cloudflare: PHP2Shell protections ↗Vendor-reported attack traffic and WAF response.
- WordPress: Site Health screen ↗Where owners can find their running PHP information.
- WordPress: security hardening ↗Updates, access, backups and monitoring.
- OWASP: attack surface analysis ↗Inventory and reduce exposed entry points.
- OWASP: Content Security Policy ↗Browser and third-party script risks also apply to static sites.
- Astro: rendering modes ↗Static pages versus pages rendered for each request.