PHP2Shell: How to Check and Fix the Critical PHP Bug on Your Website (DIY Guide)

On 21 October 2026 the PHP team released an emergency security update. It fixes two serious bugs that the press has named PHP2Shell. If your website runs on PHP (and WordPress, Joomla, Drupal, Magento and Laravel sites all do), this affects you. The good news: for most people the fix takes about 10 minutes. This guide shows you how to check, and how to fix it on the most popular hosts.

1. What happened

Two bugs were found deep inside PHP itself, not in WordPress or any plugin. They are tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 for severity. (Some early reports said 10.0, but the PHP Foundation says that score was wrong.)

Date	What happened
Aug 2026	Researchers at Calif, and later Wiz and OpenAI, independently find the bugs using AI tools and quietly tell the PHP team.
17 Oct	Amazon says it saw an attack attempt on its test servers, four days before the public announcement.
20 Oct	The bug numbers leak and PHP announces that a security release is coming.
21 Oct	PHP publishes the fix (released a day earlier than first planned). Attacks start within minutes, according to Cloudflare and Amazon.
22–23 Oct	Hosting companies roll out patches. Some are done, some are still working.

Which PHP versions are safe?

Your PHP branch	Safe from this version
8.5	8.5.12 or newer
8.4	8.4.27 or newer
8.3	8.3.36 or newer
8.2	8.2.35 or newer
7.4 – 8.1	No official release. Only small fixes (“backports”) from the PHP security team, and some hosts and Linux vendors add them. Plan to upgrade.
7.3 and older	Ended its life. No fix from the PHP project. Upgrade.

The earliest affected code goes back to PHP 5.4, which is why so many old servers are exposed.

2. How AI helped find a 14-year-old bug

Here is what the news reports say. (I link all of them at the bottom.)

• The bug is old. OpenAI co-founder Greg Brockman said it has been in PHP for 14 years. A smaller version of the problem was spotted in 2024 but was not seen as important back then (Fortune).
• Humans suspected something, but could not prove it. A reporter quoted by CBS News said people knew “something weird was going on” but nobody could write a working attack. An AI can do that slow, boring, detailed work much faster than a person.
• Several teams found it separately. The security firm Calif found the first problem on 1 August using OpenAI’s GPT-5.6 Sol model. Wiz, a Google-owned security company, found it on 19 August using several AI models. OpenAI found extra pieces and then led a group with the PHP Foundation, Wiz, Calif, Cloudflare and others to prepare the fix (Fortune).
• People still steered the work. Calif warns that no AI finds every bug from a simple question. Knowing where to look still mattered.

What this means for you: the same AI tools that helped the defenders can help attackers too. OpenAI itself warned about this. Old, forgotten bugs can now be found and turned into attacks much faster, so patching quickly matters more than it used to.

3. How it affects websites

Both bugs are “use-after-free” bugs. Simply put: PHP hands some memory back, but something still points at it, and a later visitor’s request can end up using that memory. Researchers say the trigger is a file-upload style request (multipart/form-data). PHP reads that before your website code runs, so the attacker does not need a password.

What an attacker could do

• Read secrets from memory (one bug can leak memory, similar to the famous Heartbleed bug): passwords, login sessions, API keys.
• Run their own code on your server (remote code execution). From there they can steal customer data, change your pages, install malware, or take the site offline.

Who is affected?

• Any site that runs PHP and has not been patched. PHP says every way of serving web requests is at risk: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Apache with mod_php is the highest risk.
• Updating WordPress, or your plugins, does not fix this. The problem is in PHP on the server. WordPress.org has said no WordPress update is needed.
• Scanners estimate over a million servers are exposed. One estimate says 22.6 million instances (Palo Alto Networks, via Fortune).

4. Step 1: Check your PHP version

Pick the method that matches how you use your site. It takes two minutes.

Method A: WordPress dashboard (easiest)

1. Log in to /wp-admin.
2. Go to Tools → Site Health.
3. Click the Info tab.
4. Open the Server section. Look for the line PHP version.

Method B: Your hosting control panel

Almost every host shows the PHP version for each site in its panel. Section 5 tells you where, for each host.

Method C: From the command line (if you manage a server)

Connect with SSH and run:

php -v

One catch: the command line can use a different PHP than your website. If your server has several PHP versions, also check which one your site uses (for example, the php8.2-fpm service, or the version chosen in your panel).

How to read the result

• Your version is equal to or higher than the fixed one for your branch (for example 8.3.36 or 8.3.40)? Good.
• Lower (for example 8.3.30)? Update now.
• 8.1 or older? Update to a newer branch. These do not get official fixes.

5. Step 2: Fix it on your host

Find your hosting company below. The status notes are from public host statements and trackers on 21–22 October 2026. They change fast, so treat them as a guide and confirm with your host.

Which version should I choose? Pick the newest PHP version that your website supports. PHP 8.3 or 8.4 is a good target. Do not pick a version lower than your current one. If your site is on PHP 8.1 or older, this is also the time to upgrade: older themes and plugins can break, so take a full backup first, switch, then click through your key pages and forms.

Menu names in control panels change from time to time. If a name below does not match what you see, search the panel for “PHP” and use your host’s help pages.

6. Step 3: Restart and confirm

On shared and managed hosting, changing the PHP version in the panel does this for you.

On your own server, PHP that is already running keeps using the old code until you restart it:

# If you use PHP-FPM (check the exact name with: systemctl list-units | grep fpm)
sudo systemctl restart php8.2-fpm

# If you use Apache with mod_php, do a FULL restart (a 'reload' is not enough)
sudo systemctl restart apache2

# Nginx usually just needs PHP-FPM restarted, but this is safe too
sudo systemctl restart nginx

Then check again with Step 1 (WordPress Site Health or php -v) and reload your website to make sure everything still works.

7. If you cannot update right now

Updating is the only complete fix. If you truly cannot do it today:

1. Ask your host. Many hosts are protecting customers at the server level while they patch. Ask for written confirmation.
2. Turn on Cloudflare (free plan is fine) in front of your site to get its extra firewall rules.
3. Switch off the upload-progress feature. PHP lists session.upload_progress.enabled = 0 as a temporary measure for one of the two bugs. WordPress does not use it. On many hosts you can create a file called .user.ini in your website’s main folder with this single line (it can take about 5 minutes to apply):

session.upload_progress.enabled = 0

This only blocks one attack path. It does not make you safe. PHP also lists a memory-limit change for the other bug, but it can let a runaway script use all your server’s memory, so only do that if your host or server admin advises it.

8. Step 4: Check if you were hit

Attacks started before the fix was public (Amazon saw one on 17 October), so after you patch, spend ten minutes checking. This is a basic check, not a full investigation.

1. Look for new admin users. In WordPress go to Users and check every Administrator. Delete any you do not recognise.
2. Look for recently changed files. On a server with SSH, this lists PHP files changed since 17 October (change the folder to your site’s path):

find /var/www -name '*.php' -newermt '2026-10-17' -not -path '*/cache/*' 2>/dev/null | head -50

Updates you ran yourself will show up too. You are looking for strange file names or PHP files inside your uploads folder, which should hold images and documents, not code.

1. Check scheduled jobs. Run crontab -l and look at WordPress’s scheduled tasks (a plugin such as WP Crontrol shows them). Remove anything you do not recognise.
2. Run a malware scan. A free security plugin such as Wordfence or Sucuri can scan your files.
3. Change your secrets if you were exposed for any length of time, because one of the bugs can leak memory: WordPress admin passwords, database password, the keys and salts in wp-config.php, email (SMTP) passwords, and any API keys.
4. Restore a clean backup from before 17 October if you find anything suspicious, and then patch before putting the site back online.

If you find a web shell or anything you do not understand, stop and get help. See the form at the bottom.

9. Quick questions

Do I need to update WordPress or my plugins?

Not for this bug. The problem is in PHP. Keep WordPress updated anyway, but it will not fix PHP2Shell.

I am on shared hosting. Do I have to do anything?

Check the version in your panel, then update PHP there or ask your host to confirm in writing that they patched it.

Is my computer or phone in danger if I visit PHP sites?

Not directly. The risk is to the website and the data stored on it. Be careful with strange emails and messages, as always.

Will this happen again?

Probably, as AI makes finding old bugs faster. The best habits: use a supported PHP version, turn on automatic updates where your host offers them, keep regular backups, and know where to change your PHP version.

I wrote this as a plain-English guide from public sources on 23 October 2026. It is general information, not a guarantee. Back up before you change anything, and check your host’s own notices.

Need urgent help?

If you are stuck, think you were hacked, or cannot update, send me a short message. Tell me your hosting company and your website address, and I will get back to you as soon as I can.

LinkedIn: /in/aarohikothariGitHub: aarohi1012

Sources

• Fortune: AI helped discover the PHP vulnerability
• CBS News: What to know about the PHP bug
• Tenable: PHP2Shell FAQ (versions, mitigations, timeline)
• Codeable: What WordPress site owners need to do
• Towards AI: How AI found the bug
• Sansec: PHP2Shell research
• ActiveSet: Host patch status tracker
• The Repository: Hosts race to protect customers
• Jason Burns: How to patch on your host
• Debian Security Tracker: php8.2