PHP2Shell: Two Critical PHP Vulnerabilities, and What Site Owners Should Check Today

Contents

1. What happened
2. Why it touches so many businesses
3. Are attacks already happening
4. AI found it, and now it is a race
5. What to check today
6. The longer-term lesson
7. FAQ

Updated: 22.10.2026, 15:30 Israel time. We will keep updating this post as the story develops.

On 21 October the PHP team released a fix for two severe vulnerabilities, CVE-2026-109618 and CVE-2026-109619, together nicknamed PHP2Shell. Both let an attacker run code on the server without logging in to the site. If your website runs on PHP, and it most likely does, now is the time to check its version.

What happened

PHP is the programming language behind most websites, including every WordPress site. On 21.10 fixed versions came out: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both vulnerabilities are rated 9.2 out of 10. A score of 10 has been circulating online in the last few days, but the foundation behind PHP has said that figure is wrong.

The issue affects any PHP setup that serves web pages, in every common configuration. Researchers showed it can be exploited on WordPress, Drupal, Joomla and Magento sites.

Why it touches so many businesses

According to W3Techs, 69.3% of websites whose server-side language is known run PHP, and 39.6% of all websites are built on WordPress. Almost every small business in Israel that built a website in the last decade is inside those numbers, even if it never heard the word PHP.

Are attacks already happening

As of midday on 22.10: there are attack attempts, and no confirmed report of large-scale break-ins yet. Amazon saw a first attempt on 17.10, four days before disclosure. Cloudflare added protective rules on every plan, the free one included, and calls them a stopgap itself. The US cyber agency CISA advises updating immediately, and taking systems that cannot be updated offline.

AI found it, and now it is a race

Two teams found the vulnerability independently, and each used AI tools to scan the code. That is the new part of the story: the same tools that help researchers find holes first are available to attackers too. What used to take an attacker weeks takes days now. So the gap between a fix being published and the first attempt to exploit it keeps shrinking, and waiting for "the end of the month" to update is waiting too long.

What to check today

1. Find out which PHP version runs your site. In WordPress: Tools, Site Health, Info, Server. Most hosts also show it in the control panel.
2. If it is 8.2 to 8.5, make sure your host has updated to the fixed release (8.5.12, 8.4.27, 8.3.36 or 8.2.35). One question by email or chat is enough.
3. If it is 8.1 or older, there is no official fix for it. The site needs an upgrade to a supported version, after checking that its plugins and theme work with it.
4. Do not download "fixes" or "test code" from unofficial links. Some of them exist precisely to break into sites whose owners are in a hurry.
5. Protection from Cloudflare or your host helps, but it does not replace the update.

If an outside vendor built your site, send them one question today: "Which PHP version does the site run, and has it been updated?". It takes a minute.

The longer-term lesson

Every site that runs on a PHP server is software someone has to keep updating, not just once. An abandoned site with no clear owner is the real risk, more than any single vulnerability. When you choose how to build a new website, ask not only what it costs but who updates it and what happens on a day like 21.10. We wrote more about this in our post on a website that sells, not just shows. Our own site, for example, does not run on PHP at all, so this vulnerability does not affect it.

Not sure where your site stands? The business check-up takes two minutes, or simply write to us.

FAQ

My site is on Wix or Shopify. Does this affect me?

Not directly. On managed platforms like these, the platform runs the servers and installs the updates. The vulnerability affects sites that run PHP on their own server or on shared hosting, like most WordPress sites.

How do I know if my site was already broken into?

Things to check: admin users you did not create, files changed recently for no reason, strange redirects from your site to other sites. If something looks wrong, contact your host or a security professional.

My host says it is taking care of it. Is that enough?

If it has updated PHP to a fixed version, yes. Ask it to confirm in writing which version runs now. If your site is on PHP 8.1 or older, the site itself also needs an upgrade.

Sources (checked on 22.10.2026): PHP team announcement, 21.10.2026; CISA alert, 21.10.2026; Tenable; Wiz Research; Amazon Threat Intelligence; Cloudflare; W3Techs.