Guide · PHP2Shell

Am I affected by PHP2Shell?

Short answer: If your site runs PHP older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (on those branches), or any PHP 8.1 or older, you are affected unless your host has backported the fix. PHP2Shell is two flaws (CVE-2026-109618 and CVE-2026-109619) that let anyone run code on the server without signing in. They have been exploited since 17 October 2026, including against WordPress, Drupal and Joomla sites. Update PHP now; there is no configuration setting that fully protects you.

Run the free quick check → See the steps
Updated 25 October 2026

Which versions are fixed

Which versions are fixed
PHP branchFixed inWhat to do
8.58.5.12Update to 8.5.12 or later
8.48.4.27Update to 8.4.27 or later
8.38.3.36Update to 8.3.36 or later
8.28.2.35Update to 8.2.35 or later
8.1 and olderNo official releaseMove to a supported branch, or use a vendor or distribution that backports the fix

What to do, step by step

PHP published the fixes on 21 October 2026, a day earlier than planned because details had leaked. Each flaw is rated 9.2 out of 10 (CVSS 4.0).

  1. Find your PHP version

    On the server, run php -v (and check the version your web server actually uses, which can differ). On shared hosting, look in the control panel or ask support. Some sites show it in the X-Powered-By header.

  2. Update

    Install the fixed release for your branch, or the patched package from your Linux distribution. Distributions often fix the flaw without changing the version number, so on Debian, Ubuntu or Red Hat check the package changelog for the two CVE numbers rather than the number alone. Restart PHP-FPM or your web server afterwards.

  3. If you can't update today

    Ask your host for the patch or move the site behind a host that has it. Some advisories mention setting pm.max_requests = 1 in PHP-FPM as a stopgap that narrows one of the two flaws; it costs performance and is not a fix.

  4. Check whether you were already hit

    Look for admin users you didn't create, new .php files in upload folders, changed .htaccess files, unknown cron jobs, and outbound traffic you can't explain. If you find anything, restore from a backup taken before 17 October, then change every password and key the server held.

  5. Stop announcing your version

    Set expose_php = Off in php.ini. Hiding the version is not a fix, but it stops you appearing on attackers' lists of easy targets.

What vibeship checks for you

You can do all of the above by hand. If you'd rather start with a list of what's wrong, the vibeship quick check runs from outside, the way a stranger sees your site. The quick check is free and needs no account. It shows your grade and how many problems sit in each area; what each problem is and how to fix it is in the full report.

Checked automatically

  • Reads your PHP version where your server shows it, and compares it with the fixed releases
  • Detects PHP even when the version is hidden (cookies, .php addresses, WordPress, Drupal or Joomla) and asks you to confirm the version
  • Passive only: one or two ordinary requests, no exploit attempt
  • This one result is shown in full in the free check, fix included: we don't sell the news that your server is being broken into

Deeper, and what we don't check

  • A hidden version is reported as "confirm with your host", never as safe
  • A distribution's patched build can look old from outside; the card says so
  • We can't tell from outside whether a site was already compromised
Run the free quick check → See a demo report

Questions people ask

Does PHP2Shell affect WordPress?

Yes. The flaws are in PHP itself, so every WordPress, Drupal or Joomla site on an affected PHP version is exposed, whatever plugins it runs. Updating WordPress does not fix it; updating PHP does.

My host says I'm on PHP 8.3. Am I safe?

Only if it is 8.3.36 or later, or a distribution build with the fix backported. Ask for the exact version and whether CVE-2026-109618 and CVE-2026-109619 are fixed.

Is there a configuration workaround?

Not a complete one. The advisories say updating is the only full fix.

My site is static or built with Next.js. Does this matter?

Not for the site itself. Check anything else you run on PHP: a blog, a shop, an admin tool or an old subdomain.

Best effort, not a guarantee: Our scans are best effort: they can miss a weakness or flag one that isn't there. This is advice, not a guarantee, and it doesn't replace a security firm. Your site's safety stays your responsibility. Read the terms.

Sources

Sources checked on 25 October 2026.

Related guides