Security alert · October 21, 2026
PHP2Shell: a critical flaw in PHP is being exploited right now
On October 21, 2026, PHP shipped emergency fixes for two critical bugs known together as PHP2Shell. One crafted web request, with no login, can let an attacker run their own code on the server behind a website, and every PHP version since PHP 5 is affected. If your site runs on PHP (WordPress, Drupal and Joomla all do), check it today.
What happened
A bug in PHP itself
Two flaws, CVE-2026-109618 and CVE-2026-109619, sit in PHP, the language the server runs, not in any one plugin or theme. Each is rated 9.2 out of 10 for severity (CVSS v4).
No password needed
An attacker needs no account on your site. One crafted request to the server can be enough to run their code on it.
Attacks have already started
Researchers report that working attacks were shown before the fixes were released, and that the flaws were being exploited in the wild the day the fixes shipped.
Fixed releases are out
The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no official release; some hosts and Linux distributions backport the fix without changing the version number.
Updating WordPress does not fix it
Updating WordPress, your plugins or your theme does not touch PHP. The server's PHP has to be upgraded, which is usually your host's job. Turning off session.upload_progress is a partial stopgap only.
Patched is not the same as clean
A site attacked before the fix went on can still hold a backdoor. Upgrading closes the hole; it does not remove anything already inside.
Source: BleepingComputer: PHP ships emergency patches for critical PHP2Shell flaws
Check it yourself
Find your PHP version in 30 seconds
- 1
Log in to WordPress
Open your site's admin area, usually your web address followed by /wp-admin.
- 2
Open Site Health
Go to Tools, then Site Health, then the Info tab.
- 3
Read the PHP version
Open the Server section and find "PHP version". Match it to its branch: 8.5 needs 8.5.12 or later, 8.4 needs 8.4.27 or later, 8.3 needs 8.3.36 or later, and 8.2 needs 8.2.35 or later. If yours is below the fixed release for its branch, or is 8.1 or older, ask your host today whether they have applied the fix.
Not on WordPress? Your host or your developer can tell you which PHP version your server runs.
Why it matters for a small business
Your website is often the first thing a new customer sees. A taken-over server can send your visitors to scam pages, send spam in your name, read what people type into your forms, or get your site flagged as unsafe in search results. Cleaning that up costs far more, in money and in trust, than the upgrade would have.
With MySiteHandled.com, server updates like this are our job, not yours
Every plan includes hosting and upkeep by a real person. When a security fix like this ships, applying it is on our list, not yours: no host tickets, no version numbers, no weekend spent reading advisories. One flat monthly fee, your domain is yours from day one, and you can cancel anytime.
Not sure where you stand? We'll check it for free
Send us your website address. A real person looks at what can be seen from outside, tells you what we found and what to do next, and replies within one business day. No obligation, and nothing is run against your site.