PHP2Shell Explained: What Happened and What It Means for Your Website

27.10.2026 DigitUX

Last week, the team behind PHP released emergency security updates for two critical flaws that left a large share of the world’s websites exposed to attack. The issue quickly picked up a nickname, PHP2Shell, and security agencies in Canada, Singapore and beyond issued alerts urging website owners to act straight away.

If your website runs on WordPress, you were almost certainly affected. The good news is that a fix is available, and it’s straightforward to apply. This article explains what happened, why it mattered, how it was fixed, and what every business owner should take from it.

First, What Is PHP?

PHP is the programming language that powers most of the web behind the scenes. It runs on the server where your website is hosted, and its job is to build each page before it’s sent to a visitor’s browser.

Think of your website as a restaurant. Your theme and content are the menu and the dining room. WordPress is the kitchen layout and the recipes. PHP is the chef: every time a visitor orders a page, PHP does the cooking.

Around 70% of all websites use PHP, including every WordPress site. That’s why a problem in PHP itself is a much bigger deal than a problem in a single plugin or theme.

What Happened

Security researchers discovered two serious flaws in PHP’s core engine, now tracked as CVE-2026-109618 and CVE-2026-109619. Normally, flaws like this are kept quiet until a fix is ready, so attackers can’t take advantage of the gap. This time, the details leaked early.

Here’s how the week unfolded (all times international, UTC):

DateWhat happened
Tuesday 20 OctoberA post on a popular tech forum revealed that two critical PHP flaws were about to be disclosed. The PHP team responded that evening with an advance warning and brought the release forward by a day.
Wednesday 21 October, morningCloudflare, one of the world’s largest web security networks, reported early attack attempts and rolled out emergency firewall rules to all its customers, including free plans.
Wednesday 21 October, ~13:35The PHP team released fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Following daysProof-of-concept attack code circulated publicly, and security firms reported attacks in the wild.

For Australian businesses, the patch landed late on Wednesday night.

Why It Was So Serious

Both flaws allow what’s called remote code execution. In simple terms, an attacker anywhere in the world could send a specially crafted request to your website and make your server run their own instructions. From there, they could install malware, steal customer data, redirect visitors to scam sites or use your server to attack others.

Three things made PHP2Shell particularly dangerous:

  • No login needed. A working attack needed just one request from a stranger. No password, no admin account, no user interaction.
  • It struck before your website code even ran. The flaws sit in PHP’s memory handling, not in your theme or plugins. A perfectly built, fully updated WordPress site was still exposed.
  • It reached back years. Researchers believe the flaws affect PHP versions going all the way back to PHP 5, released in the mid-2000s.

To stretch the restaurant analogy: it wasn’t a dodgy recipe or a faulty oven. It was a weakness in how the chef worked, so every kitchen using that chef was at risk, no matter how well it was run.

The PHP team rated both flaws 9.2 out of 10 for severity. And because attack code began circulating publicly, any site left unpatched became an easier target with each passing day.

The Fix That Was Applied

The fix is to update PHP on the web server to one of the patched versions:

PHP version you’re onUpdate to
PHP 8.58.5.12 or later
PHP 8.48.4.27 or later
PHP 8.38.3.36 or later
PHP 8.28.2.35 or later
PHP 8.1 or olderMove to a supported version (8.3 or newer recommended)

The PHP team was clear that updating is the only complete fix. Temporary workarounds, such as changing server settings or relying on a firewall, reduce the risk but don’t make a site safe. Even Cloudflare’s chief technology officer described its emergency firewall rules as a stopgap.

One point catches many business owners out: updating WordPress doesn’t update PHP. WordPress, your theme and your plugins sit on top of PHP. PHP itself lives on the server and is managed by your hosting provider or whoever looks after your server. Clicking “Update” in your WordPress dashboard, on its own, did nothing to fix PHP2Shell.

In practice, the fix looked like this:

  1. Confirm which PHP version each website was running.
  2. Update the server to the patched release for that version, or move older sites up to a supported version.
  3. Check each site loaded and worked correctly after the update.
  4. Review server logs for signs of suspicious activity in the window before the patch.

Reputable hosting providers patched quickly, some even before the public announcement, because server software vendors received the fixes ahead of time. Sites on older, unsupported PHP versions faced a harder road, because no official update was released for them at all.

What’s Next

The immediate emergency has passed for patched sites, but PHP2Shell isn’t over. Attackers are now running automated scans across the internet, looking for any server still on a vulnerable version. One security firm estimated that more than half of the internet-facing PHP servers it tracked were running versions without an official fix.

If you own a website, here’s what we recommend over the coming weeks:

  • Confirm your PHP version. Ask your host or web provider which version your site runs and whether it’s been patched. You want a written answer with a date.
  • Plan your move off PHP 8.2. Even fully patched, PHP 8.2 stops receiving security fixes on 31 December 2026. That’s about two months away.
  • Move off PHP 8.1 and older now. These versions received no official PHP2Shell release and won’t receive future fixes either.
  • Watch for signs of compromise. Unexpected admin users, unfamiliar files, sudden redirects, spam pages in Google or a slow, unstable site can all point to a break-in.
  • Expect more scrutiny. Big incidents tend to draw researchers to look harder at the same code. Further PHP updates in the coming months wouldn’t be surprising, so a reliable update process matters more than ever.

From PHP 7 to Today: Which Versions Are Still Safe?

Every PHP version has a set lifespan. Under the current policy, each one receives two years of full support (bug fixes and security fixes), then two years of security fixes only. After that it reaches end of life: no more updates of any kind, even when a serious flaw like PHP2Shell is found.

Here’s where every version from PHP 7 onwards stands as of late October 2026:

VersionReleasedSecurity support endsStatus todayPHP2Shell fix?
PHP 7.0 – 7.32015 – 2018Between 2019 and 2021End of lifeNo
PHP 7.4Nov 201928 Nov 2022End of lifeOne-off source patch only
PHP 8.0Nov 202026 Nov 2023End of lifeOne-off source patch only
PHP 8.1Nov 202131 Dec 2025End of lifeOne-off source patch only
PHP 8.2Dec 202231 Dec 2026Security fixes only, final two monthsYes, 8.2.35
PHP 8.3Nov 202331 Dec 2027Security fixes onlyYes, 8.3.36
PHP 8.4Nov 202431 Dec 2028Fully supportedYes, 8.4.27
PHP 8.5Nov 202531 Dec 2029Fully supportedYes, 8.5.12
PHP 8.6Due 19 Nov 202631 Dec 2030Release candidate, not for live sites yetFixed in RC4

Plenty of older business websites still run on PHP 7, and it shows the risk clearly. The last PHP 7 release, 7.4, stopped receiving security fixes in November 2022. Sites still on PHP 7 have now missed nearly four years of security fixes, and PHP2Shell is simply the most serious example so far. Given the severity, the PHP security team made an exception and shared basic source-code patches for PHP 7.4 to 8.1. Don’t read that as a return to support: it was an emergency, one-off measure. These versions remain end of life and stay exposed to every future flaw, full stop.

For most WordPress sites today, PHP 8.3 or 8.4 is the sensible target. Both are patched against PHP2Shell, widely supported by major plugins and themes, and will receive security fixes until at least the end of 2027.

Why Keeping Your Software Updated Matters

PHP2Shell is a dramatic example, but the lesson applies every week of the year. Your website isn’t a one-off purchase. It’s a stack of software, from PHP on the server to WordPress, your theme and every plugin, and each layer receives regular security updates.

When an update is skipped, the risk doesn’t stay still. Once a fix is published, attackers can study it to work out exactly what was broken, then scan the internet for sites that haven’t caught up. The longer a site goes without updates, the easier a target it becomes.

Old software also creates a slow-building problem. Plugin and theme developers test their updates against supported PHP versions and quietly drop older ones. A site stuck on PHP 7 or 8.1 eventually can’t accept plugin updates either, so the security gap widens across the whole site.

The cost of falling behind usually lands all at once: a hacked site, lost enquiries, a Google warning on your listing, a costly clean-up, and in the worst case, a data breach you may be legally required to report.

That’s why we recommend treating website upkeep like servicing a car, not waiting for something to break:

  • Regular WordPress, theme and plugin updates, with daily backups so any update can be rolled back.
  • Security monitoring to catch problems early.
  • A host that keeps PHP current, patches promptly and tells you when an upgrade is due.

Our Website Maintenance plans handle the WordPress side for you, on a month-to-month basis, including for sites we didn’t build. For the server side, our WordPress Hosting runs on modern PHP and is kept up to date for you.

The Bottom Line

PHP2Shell was one of the most serious web security events in years, because it reached into the engine behind most of the internet rather than a single plugin or theme. The fix was simple: update PHP. The businesses most at risk were those who didn’t know which version they were running, or who assumed updating WordPress was enough.

PHP2Shell won’t be the last flaw of its kind, and PHP is only one layer of your website. WordPress is the most widely used content management system in the world, which makes WordPress itself, along with its themes and plugins, a constant target for attackers too. The sites that came through last week calmly were the ones with someone already keeping every layer up to date.

If you’re not sure where your website stands, we’re happy to check your PHP version and update status for you. Contact the DigitUX team and we’ll let you know whether your site is patched and what, if anything, needs to happen next.

Sources

Leave a Reply