Is my website affected by PHP2Shell?

Last updated: 25 October 2026.

What happened

On 21 October 2026 the PHP project published two security advisories for flaws in PHP itself, named PHP2Shell: CVE-2026-109618 and CVE-2026-109619. PHP released fixed versions on 21-22 October 2026. Both flaws are rated Critical (CVSS 9.2). In simple terms, someone who is not logged in could, on an unpatched server, make it run their own commands.

PHP is the programming language behind many websites, including WordPress, Joomla, Drupal, Magento and most hand-built sites and shops. Because the flaw is in PHP, not in your plugins or theme, updating your site's own software does not fix it. The PHP version on the server has to be updated.

The US cybersecurity agency CISA published an alert telling organisations to patch immediately. At the time of its alert, CISA said it had not seen successful attacks in the wild. Some security companies have since reported attack attempts, so reports differ. The safe reading is the same either way: update.

Which versions are fixed

PHP 8.1 and older no longer receive regular fixes from the PHP project. Some hosting companies and Linux distributions provide their own fixes for older lines, and CISA advises taking systems that cannot be updated offline. If your site runs 8.1 or older, ask your host what they have done, or move to a supported version.

What our check can and cannot tell you

We look at your site from the outside, the way any visitor does. We look for signs of which PHP version you run, and compare that with the fixed versions above. We do not test the flaw, and we never send anything designed to trigger it.

That leaves three honest answers:

Potentially affected

We could see a PHP version, and it is older than the fixed version for its line. We say potentially, not vulnerable, because many hosting companies and Linux distributions fix security problems without changing the version number. Your server might show an old number and still be fixed.

What to do: ask your host or developer: "Our site shows PHP 0.1.20. Has the PHP2Shell fix (CVE-2026-109618 and CVE-2026-109619) been applied, and which PHP version are we really running?" Ask for the answer in writing.

Cannot tell

Your site runs PHP, or looks like it, but does not say which version. Hiding the version is good practice, but it means we cannot confirm whether you are fixed, and we will not guess. This is not a pass.

What to do: ask your host or developer: "Is our site affected by PHP2Shell? Which PHP version do we run?" On shared hosting, your control panel often has a PHP version setting you can read yourself.

No sign of this problem

We saw a PHP version that includes the fix, or no sign that your site runs PHP at all. This is "no sign from the outside", not a guarantee. Your site could have other PHP components, such as a separate admin address or a subdomain, that we did not see.

What to do: nothing urgent. Keep PHP updated.

We do not use a fourth state called "Affected" for PHP2Shell. A version number alone cannot prove your server is vulnerable, so we will not claim it.

What to do now

1. Find out your PHP version. Ask your host or developer, or look in your hosting control panel. WordPress shows it under Tools, Site Health, Info, Server.
2. Update to a fixed version (8.2.35, 8.3.36, 8.4.27 or 8.5.12 or newer in the same line, or a newer line). On managed hosting this is often a setting you can change, or a request to support. Make a backup first, and check that your site still works afterwards.
3. Restart the services that run PHP if you manage the server yourself, since an update may not take effect until then.
4. Use a firewall as an extra layer, not a substitute. Cloudflare says its firewall rules protect sites on its network by default, and that patching PHP is still necessary. CISA also lists a firewall only as interim protection until you patch.
5. Run this check again after the update. A fixed version should change your result.

Common questions

My host says they have patched it, but your check still says Potentially affected. That can be correct. Hosts often apply the fix without changing the version number. Ask them to confirm in writing which fix is in place. We cannot see inside your server, which is why we do not say you are vulnerable.

I use WordPress. Do I need to update a plugin? No. Updating WordPress or plugins does not fix this. The PHP version on your server does.

I am on Shopify, Wix, Squarespace or another hosted builder. These services run the platform for you, so you cannot change PHP and it is up to them. If our check finds no PHP, it will say there is no sign of this problem.

Does this check break anything or try the flaw? No. It reads only what your site already shows to every visitor, from a published address, and it asks for a few well-known files. See how it works and our scanner.

Do I need to give you my email? No. If you want, we will email you when the next big vulnerability might affect your site. That is free, and you confirm by email first.

Official sources

• CISA: Critical Vulnerabilities in PHP Require Immediate Patching
• PHP security advisory for CVE-2026-109618: GHSA-w8hw-w9fx-j79w
• PHP security advisory for CVE-2026-109619: GHSA-6wmf-4rv5-p3rp
• php.net: PHP 8 ChangeLog and downloads
• Cloudflare: protections against php2shell

Scanylo is not affiliated with the PHP project, CISA or Cloudflare. This page is a plain-language summary, not a replacement for the advisories. This is a passive, external check and not a penetration test.