Tutorials · PHP vulnerability 2026-10-21

Does your website run on PHP? Update it now.

A large share of websites (WordPress, PrestaShop, Joomla, Drupal, Laravel…) run on PHP. The two flaws let an attacker take control of the server remotely, without a password.

Alert – 21 October 2026. PHP has released emergency fixes for two critical vulnerabilities nicknamed PHP2Shell. An attack attempt was seen on 17 October, before the public announcement.

Is your website built with WordPress, WooCommerce, PrestaShop, Joomla or Drupal? Then it runs on PHP, and you are affected. On regular web hosting (Hostinger, IONOS, Bluehost, SiteGround, OVHcloud…), the host usually installs the fix: your job is to check that it has been done.

Where to start

I'm a developer or sysadmin → Diagnosis, updating on your system, pitfalls to avoid, temporary mitigations and checks. I'm not technical → What to do in your situation, with ready-to-send messages for your host and a text to paste into ChatGPT, Claude, Mistral or Gemini if you'd like to be guided.

In short

Vulnerabilities	CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell")
Severity	Critical – 9.2 / 10 (CVSS v4.0)
Impact	An attacker can take control of the server without a password, whatever the application (remote code execution)
Vulnerable versions	Every version older than the fixed versions below, including old branches (5.x, 7.x, 8.0, 8.1)
Fixed versions	8.2.35 · 8.3.36 · 8.4.27 · 8.5.12 (or later)
PHP 8.1 and older	No longer maintained by PHP. If your Linux distribution still ships it (Ubuntu 22.04, RHEL 8 and 9…), it publishes its own fix. Otherwise: source-only patches for 7.4, 8.0 and 8.1, paid extended support, or moving to 8.2 at least.
Fix	Updating is the only complete protection. Workaround settings only protect partly.

Why it's serious, in plain words

Think of your website as a shop. With these flaws, the burglar doesn't need to break the window: they already have the keys to the back room. They can steal your customers' data, install malware, send spam from your server or wipe your website.

They need neither a password nor a mistake on your part: it is enough that your server runs an unpatched version of PHP. Some websites even went into maintenance mode while they updated.

Watch out for fake tools. Fake "vulnerability checker" programs are already circulating on GitHub and contain malicious code. Never run a script you don't understand or whose origin you don't know. This guide will never ask you to download a detection tool. It only uses standard commands, explained one by one, and your host's own tools.

Official sources

Information last updated: 22 October 2026. The situation is changing: always check the official sources above. This is an independent prevention initiative, not affiliated with the PHP project. The guides come with no warranty: back up before you change anything.