PHP2Shell is the name used for two critical bugs in the PHP engine itself, CVE-2026-109618 and CVE-2026-109619, disclosed on 21 October 2026. Any site that runs PHP can be affected, including WordPress, WooCommerce and Magento stores. Updating the application does not fix it. The PHP build behind your domain has to change, and the workers have to restart.
What matters right now
- Fixed releases exist for four branches. The PHP project lists 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as the fixes, both CVEs rated CVSS v4 9.2 in the php-src advisory.
- PHP 8.1 and older are end of life. php.net published minimal source backports, and some vendors ship their own fixed packages, per the PHP security notices.
- Attempts are reported; no source names a hacked site. Amazon saw attempts in its MadPot honeypots from 17 October, and Cloudflare says it saw attack traffic. Both are vendor claims.
- Not in CISA's catalog at our 24 October 2026 check. Re-check the Known Exploited Vulnerabilities catalog before relying on that.
- A WAF is a stopgap. Cloudflare's own post says to patch even with its rules on.
Where to start
- If you have ten minutes and one site, start with the 10-minute plain plan.
- If you want the full picture first, read the overview of affected versions or the two CVEs explained.
- If you need to know which PHP version is the fix for your branch, use the fixed versions table.
- If you run Ubuntu or Debian and the version number looks old, read the backport version trap.
- If you run PHP 8.1 or older, see what end-of-life owners do now.
- If you already updated PHP, check that PHP-FPM was restarted and follow the patch and verify steps.
- If you deploy containers, rebuild with the Docker image checklist.
- If several servers or clients are involved, inventory every PHP runtime first.
- If you rely on Cloudflare, see what a WAF does and does not cover, and for attack reports read attempts versus compromise.
- If you run WordPress, update PHP, not just WordPress. If your host manages PHP, the shared hosting questions to ask cover what proof to request.
The free scan on Red by run.cloud reads the stack your site serves and matches versions to public records. It can say a version is affected. It cannot see a vendor backport or whether workers restarted, so your host or server has to confirm the rest.