PHP2Shell Vulnerability Oct 21, 2026: How to Secure Your Website
October 21, 2026
Updated: October 21, 2026 | IT GOAT Security Advisory
Two critical PHP security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have prompted emergency security updates for web servers worldwide.
Collectively known as PHP2Shell, these vulnerabilities can allow unauthenticated attackers to execute malicious code or expose sensitive server memory under certain conditions. The reported severity reaches 9.2 on the CVSS v4.0 scale.
If your business operates a website, client portal, WordPress installation, or PHP-based application, your hosting environment may require an immediate security update.
The good news: patched PHP versions are available, and most organizations can remediate the issue without redesigning or rebuilding their websites.
This guide explains how to identify affected systems, apply the necessary updates, and verify that your environment is protected.
PHP is a programming language that powers many websites and business applications, including WordPress, Drupal, Joomla, Magento, and custom web applications.
PHP2Shell refers to two vulnerabilities in PHP’s underlying memory management.
Depending on the environment and exploitation method, attackers may be able to:
Execute commands on vulnerable web servers without authentication.
Access sensitive application or server memory.
Expose passwords, session information, or authentication tokens.
Compromise website files and potentially access other systems.
Important: Having the latest WordPress version, updated plugins, or a web application firewall does not automatically resolve this issue. The underlying PHP installation must be patched.
Compare your installed PHP version against the first patched release for its version family.
| PHP version | First patched release | Required action |
|---|---|---|
| PHP 8.5 | 8.5.12 | Update if older |
| PHP 8.4 | 8.4.27 | Update if older |
| PHP 8.3 | 8.3.36 | Update if older |
| PHP 8.2 | 8.2.35 | Update if older |
| PHP 8.1 or earlier | Legacy versions | Upgrade or obtain a verified vendor-supported security patch |
If your PHP version is older than the listed patched release, you should arrange an update immediately unless your vendor confirms that the relevant fixes have been backported.
Not sure whether your website uses PHP? Contact your hosting provider or website administrator. They can identify the runtime used to process requests.
The most reliable way to assess your exposure is to identify the PHP version and security patch level actually running your website.
Common with KnownHost, HostGator, Bluehost, and many business hosting providers.
Log in to your cPanel account.
Navigate to Software → MultiPHP Manager.
Find your website’s domain.
Record the PHP version assigned to it.
Compare that version family with the patched-version table above.
Ask your hosting administrator to confirm the exact PHP patch release.
Example: A domain listed as ea-php83 uses EasyApache PHP 8.3, but this label alone does not confirm whether it is running PHP 8.3.35 or the patched 8.3.36.
WHM administrators can check for updated EasyApache packages through Software → EasyApache 4.
Log in to your WordPress administrative dashboard.
Navigate to Tools → Site Health.
Select Info.
Expand the Server section.
Locate the PHP version.
If the version is older than the corresponding patched release, arrange an update with your hosting provider or server administrator.
Updating WordPress core, themes, and plugins is still recommended, but it does not replace the PHP security update.
If you manage a Linux server, connect through SSH and identify the installed PHP runtime.
To check the default command-line PHP version:
php -vFor servers using cPanel EasyApache PHP 8.3:
/opt/cpanel/ea-php83/root/usr/bin/php -vFor EasyApache PHP 8.2:
/opt/cpanel/ea-php82/root/usr/bin/php -vThese commands identify command-line PHP installations. Your website may use a different PHP runtime, particularly if multiple versions, PHP-FPM pools, or containers are installed.
Verify the PHP runtime handling actual web requests before declaring the website patched.
CloudLinux environments may use EasyApache PHP, CloudLinux PHP Selector, or both.
Open cPanel.
Check MultiPHP Manager.
Check Select PHP Version, if available.
Identify which PHP runtime serves each domain.
Compare the exact runtime patch level against the patched-version table.
Request provider confirmation for any CloudLinux backported security fixes.
If you are on shared or reseller hosting without root privileges, your hosting provider will typically need to update the server-wide PHP packages.
For websites running on AWS, Microsoft Azure, Google Cloud, Docker, Kubernetes, or a custom application stack:
Identify every PHP runtime, including application servers, containers, and background workers.
Check the exact PHP package version or container image.
Review security updates from your operating-system, container-image, or managed-service vendor.
Deploy a fixed runtime or a vendor-confirmed patched build.
Restart or redeploy affected application workers.
Verify that production is actually serving requests from the patched runtime.
Important: Updating PHP on a virtual machine does not automatically update PHP running inside a Docker container.
The recommended remediation is to update each affected PHP runtime to a fixed release.
If you administer your server:
Verify that recent, recoverable backups are available.
Log in to WHM.
Navigate to Software → EasyApache 4.
Review the installed PHP versions and available package updates.
Keep required PHP versions and extensions enabled.
Review proposed package changes before provisioning.
Install the vendor’s security update.
Confirm the exact PHP version and PHP-FPM package version after completion.
Test the affected websites.
On supported RHEL-family servers using DNF and cPanel EasyApache, an administrator may check available packages with:
dnf check-update 'ea-php83*'Or for PHP 8.2:
dnf check-update 'ea-php82*'Where necessary, administrators can perform a targeted update:
dnf upgrade 'ea-php82*' 'ea-php83*'Do not execute an update without reviewing backups, the proposed package transaction, dependencies, and possible service interruptions. Commands may differ by operating system and hosting configuration.
If you do not have root access, contact your hosting provider and request:
Confirmation of all affected PHP versions.
Installation of the fixed PHP releases or verified vendor backports.
Confirmation that PHP-FPM and other web-serving PHP handlers are updated.
Verification that the patch covers every website in your hosting account.
Notification of any expected service interruption.
Do not attempt to bypass hosting restrictions or install a separate unmanaged PHP build.
Contact your managed WordPress provider and ask whether the server-side PHP runtime has received the PHP2Shell security updates.
If your hosting dashboard allows PHP version changes, select a patched, compatible PHP release only after confirming that the provider offers the required security fix.
Test plugins, forms, ecommerce functionality, and website integrations after any version change.
For custom deployments, update PHP through the supported operating-system packages, managed runtime, or official container image.
Rebuild and redeploy affected containers. Do not rely on restarting an old container image.
Check staging, production, autoscaling instances, application workers, and any separately maintained images.
For managed cloud services, follow the cloud provider’s published remediation instructions rather than modifying the underlying infrastructure in unsupported ways.
If a patched version is not yet available, contact your hosting provider or IT security team immediately.
Temporary measures may reduce exposure, but there is no complete substitute for applying the PHP security update.
Depending on your environment, your administrator may consider:
Disabling PHP session upload-progress tracking where it is not required.
Reducing attacker-controlled request sizes and memory pressure.
Disabling the display of detailed PHP errors on public websites.
Reviewing applicable WAF protections and access restrictions.
Temporarily limiting exposure to particularly sensitive applications.
One possible PHP configuration measure is:
session.upload_progress.enabled = OffThis setting may reduce exposure through certain attack paths but does not fully remediate both vulnerabilities. Apply it at the appropriate server configuration level, confirm it is effective for web requests, and test application compatibility.
Do not assume Cloudflare, a WordPress security plugin, or disabled PHP-FPM functionality makes an outdated PHP installation safe.
For high-risk systems that cannot be patched, your security team should evaluate whether temporary access restrictions or taking the affected service offline is appropriate.
After installing the security patch, verify the application still works as expected.
| Issue | What to check |
|---|---|
| Website displays a 500 error | PHP error logs, extensions, application compatibility |
| WordPress displays a critical error | Plugin/theme compatibility and PHP logs |
| Forms stop submitting | PHP configuration, upload settings, security rules |
| Database connectivity fails | PHP MySQL extensions and database configuration |
| Website still shows an old PHP version | Active PHP handler, PHP-FPM pool, container image, stale workers |
| Some sites work while others fail | Per-domain PHP assignment and site-specific dependencies |
| Update is unavailable | Hosting repositories, vendor patch status, support escalation |
Avoid immediately rolling back to a vulnerable PHP version. If an application breaks, investigate compatibility and consult the hosting administrator before selecting a remediation approach.
A successful package installation is an important step, but remediation should also be verified.
Use this checklist:
If your site was exposed before patching, review relevant logs for suspicious requests, unexplained PHP crashes, unusual server errors, or other indicators of compromise.
Patching closes the known vulnerability, but it does not automatically remove an existing compromise or prove that no information was accessed previously.
If suspicious activity is identified, preserve relevant logs and evidence and engage your security incident response team.
Not every business has a dedicated web developer or server administrator. And when websites are spread across multiple hosting providers, cloud systems, or reseller accounts, confirming patch coverage can become complicated.
IT GOAT can help businesses coordinate PHP2Shell vulnerability assessments, identify exposed hosting environments, and plan secure remediation.
Our team can assist with:
Identifying affected PHP runtimes and applications.
Reviewing hosting and server configurations.
Coordinating required PHP security patches.
Validating website functionality after updates.
Reviewing available evidence of suspicious activity.
Developing an ongoing patch management strategy.
Don’t wait until a vulnerable website becomes a business interruption.
Contact IT GOAT to discuss your PHP2Shell security concerns and next steps.
This article is general security guidance as of October 21, 2026. Hosting platforms, vendor backports, and supported procedures vary. Confirm current vendor guidance and perform changes through authorized administrators.
No. It affects PHP itself. WordPress, Drupal, Joomla, and custom PHP applications can all be exposed if they use an affected PHP runtime.
Cloudflare or another web application firewall may provide additional protection against known attack patterns. However, it is not a complete replacement for updating PHP.
Not necessarily. Multiple websites using the same server-wide PHP installation may receive the fix through one package update.
However, every separate PHP version, container, custom runtime, or hosting environment must be checked.
Not specifically to resolve PHP2Shell. Updating to a patched release within your supported PHP version family can address these vulnerabilities.
However, older PHP versions will eventually reach end of support and should be included in your longer-term upgrade plan.
Not from the PHP version alone. An investigation may require reviewing web requests, PHP errors, worker crashes, application files, authentication events, and other security telemetry.
See the power of IT GOAT.
The world’s most advanced cybersecurity platform catered specifically to your business’ needs.
Keep up to date with our digest of trends & articles.
By subscribing, I agree to the use of my personal data in accordance with IT GOAT Privacy Policy. IT GOAT will not sell, trade, lease, or rent your personal data to third parties.
Mitigate All Types of Cyber Threats
Experience the full capabilities of our advanced cybersecurity platform through a scheduled demonstration. Discover how it can effectively protect your organization from cyber threats.
IT GOAT: Threat Intel & Cyber Analysis
We are experts in the field of cybersecurity, specializing in the identification and mitigation of advanced persistent threats, malware, and exploit development across all platforms.
Protect Your Business & Operations
Exceptional performance in the latest evaluations, achieving 100% prevention rate and providing comprehensive analytic coverage, unmatched visibility, and near-instant detection of threats.
