PHP2Shell: what the critical PHP flaw means for your website

Short answer: on 21 October 2026 PHP released fixes for two critical flaws in its core, known as “PHP2Shell”. Attackers can use them to run their own code on a web server, without a password. Almost every WordPress, Joomla, TYPO3 or Drupal site runs on PHP. If you have one, make sure your host has installed PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a distribution package with the fix.

The University of Vienna took websites, webmail, Moodle and u:cloud offline as a precaution on the same day. It reported no attacks on its own systems. Several news sites in Lower Austria were also unreachable for a while.

What happened

PHP announced the update on the evening of 20 October and published it on 21 October at around 15:35 Austrian time. The two flaws have the IDs CVE-2026-109618 and CVE-2026-109619, and PHP rates both at 9.2 out of 10 (CVSS 4.0).

• CVE-2026-109618: when PHP runs out of memory, it can leave internal request data half finished.
• CVE-2026-109619: data from one request is not fully cleared and can be picked up by the next one.

According to CERT-EU, an attacker can combine this to run code remotely without logging in. PHP describes an attack that works before the website application even starts. That is why updating WordPress or a plugin does not help.

Who is affected

Every PHP installation that answers web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP rates Apache with mod_php as the highest risk.

Linux distributions often build fixes into older packages. A server can therefore show an old version number and still be safe, or the other way round. Only your host or server admin can tell you for sure.

Not affected are sites without PHP, for example static sites or sites built on Next.js. Our own and our client websites run on Next.js and are hosted without PHP.

Are there already attacks?

Reports differ. CERT.at says exploit code has appeared online but has not been confirmed to work. Patchstack reports active exploitation from several hosting partners, and Cloudflare’s CTO speaks of first attacks. The Dutch NCSC and the PHP Foundation had seen no active misuse by the evening of 21 October. With a flaw this severe, it is sensible to assume attacks will follow.

What you should do now

1. Check your PHP version. In WordPress: Tools → Site Health → Info → Server. Or in your hosting control panel.
2. Clarify who is responsible. With standard hosting, your host updates PHP. With your own server, whoever manages it does.
3. Get it in writing. Ask your host to confirm that CVE-2026-109618 and CVE-2026-109619 are closed.
4. Plan the move off PHP 8.1 or older. Make a backup first and check the most important pages afterwards. PHP 8.2 itself only gets security updates until 31 December 2026.
5. If no update is possible right away: Cloudflare has emergency firewall rules, also on the free plan. They only cover traffic that runs through Cloudflare and do not replace the update.

What this says about your website in the long run

The flaw itself is closed with one update. The more important question is who notices next time. A WordPress site depends on PHP, a database, a theme and often 20 to 30 plugins, and each layer needs updates. According to Patchstack, 11,334 new vulnerabilities were reported in the WordPress ecosystem in 2025, 91 % of them in plugins.

A Next.js site has no PHP, no public admin login and no database a visitor can reach. That does not make it immune: dependencies also need updating. But there are far fewer layers that can break. When a rebuild pays off, and when WordPress is still the better choice, is covered in our guide WordPress to Next.js. How the move works without losing rankings is on our page on PHP migration.

Written byChristoph SpeiserProject lead & sales

Meet the team →