PHP2Shell: is your website affected?
Two critical flaws in PHP let attackers run their own code on a web server without logging in, and attacks are already happening. Most websites built on WordPress and other PHP systems are in scope. Check your site below in a few seconds.
Updated 22 October 2026
Check your website
We load your homepage once, the way a browser does, and read only what it shows publicly: the PHP version your server reports and typical signs of PHP systems such as WordPress. Nothing is attacked or tested, and we do not store the address.
PHP2Shell in plain language
Two critical flaws in PHP itself
CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10. They sit in PHP, not in a plugin, so the website software on top does not matter.
No login needed
An attacker can run their own code on the server over the internet. Researchers also showed that server memory can leak, which may expose passwords, tokens and API keys.
Already exploited
Details leaked on 20 October, PHP released fixes on 21 October, and security firms reported attacks the same day.
Only an update fixes it
PHP states that no configuration change fully protects you. Settings and firewalls reduce the risk, but only the fixed versions close the holes.
Affected and fixed PHP versions
| PHP version | Affected | Fixed in |
|---|---|---|
| 8.5 | older than 8.5.12 | 8.5.12 |
| 8.4 | older than 8.4.27 | 8.4.27 |
| 8.3 | older than 8.3.36 | 8.3.36 |
| 8.2 | older than 8.2.35 | 8.2.35 |
| 8.1 and older | all versions | no official update |
Linux distributions sometimes ship the fix under an older version number. If your host uses one, check their advisory. PHP 8.2 itself reaches end of life on 31 December 2026.
Five steps, in this order
- 1
Find every place PHP runs
Your website, but also shops, booking tools, customer portals, admin areas and old subdomains. Use the check above for each public address.
- 2
Update to the fixed version
Move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, matching your version, then restart every PHP process so the fix is actually running. If your host manages PHP, ask them for written confirmation.
- 3
Replace versions without updates
PHP 8.1 and older get no official fix. Upgrade to a supported version or use a vendor that backports the fix, and plan what replaces the system.
- 4
Limit access if you cannot update today
Take the system offline or restrict who can reach it until it is patched. Firewall rules help, but they are not a fix.
- 5
Change passwords and keys
Because server memory could leak, renew database passwords, API keys and admin logins on systems that were exposed, and check them for unexpected changes.
Fewer moving parts to patch, and updates that ship in minutes.
No PHP server for you to babysit.
We build websites and web apps on modern stacks such as Next.js, Webflow or Framer, hosted on managed platforms. There is no ageing server software for you to patch at midnight, and this website runs the same way.
No plugin collection.
Many PHP sites depend on dozens of plugins from different authors, each one a door to keep locked. We build what you need into the product itself, so there is less to trust and less to update.
Updates as code, reviewed by people.
Dependencies are updated, tested and deployed through version control, so a security fix goes live in minutes, not after a weekend of manual work. AI speeds up the build and experienced people review every change.
Yours, and looked after.
The code and the accounts stay yours. After launch we stay available for updates and improvements, so security does not depend on someone remembering a server.
From an exposed PHP site to a secure, modern one.
PHP2Shell, answered
WordPress runs on PHP, so it is affected if the PHP version on the server is older than the fixed release, whatever WordPress version you use. Updating WordPress or its plugins does not fix PHP2Shell. The PHP version on the server has to be updated.
Not sure where you stand? Tell us about your website or system.
We reply quickly with a clear view of what to do now and what a secure rebuild would involve.