PHP2Shell: which websites the PHP vulnerability affects and what to do now
On 21 October 2026 the PHP project released emergency updates for two critical security holes. Under the name PHP2Shell they have made headlines since: German cities such as Mainz took their websites offline as a precaution, and Germany's Federal Office for Information Security (BSI) rated them level 3 of 4 (orange). t3n (German), BSI security advisory (German)
If you run a business website, you want to know two things: is my website affected, and what do I have to do? This article answers both in plain language, with first-hand sources: the PHP project and the BSI.
What is PHP2Shell?
PHP is the programming language that a very large number of websites run on the server. On every page request PHP assembles the page, reads the database and processes forms. WordPress, Drupal, TYPO3, Joomla and Magento are written in PHP, and so are Nextcloud and many shops and booking systems. BSI security advisory (German)
PHP2Shell is the collective name for two flaws in PHP itself, not in WordPress or a plugin. Both let an attacker run their own code on the server without logging in. With that they can change the website, read customer data or use the server for further attacks. The name is a nod to Log4Shell, a similarly widespread hole from 2021. The technical details are in the advisories for CVE-2026-109618 and CVE-2026-109619.
| Item | Detail |
|---|---|
| Identifiers | CVE-2026-109618 and CVE-2026-109619 |
| Severity | 9.2 out of 10 (CVSS 4.0), both holes |
| What an attack requires | no login, no action by visitors |
| Made public | 20 October 2026, details leaked before the planned date |
| First attack attempt seen | 17 October 2026, four days before the updates (Amazon) |
| Updates released | 21 October 2026, 14:00 UTC |
| BSI rating | level 3 of 4 (orange): action must be taken without delay |
According to the BSI, the security firms Wiz and Calif and OpenAI were involved in finding the holes. The BSI also points out that attackers can now use AI tools to analyse updates within a short time and build attacks from them. BSI security advisory (German)
Is PHP2Shell already being exploited?
Attempts, yes. Amazon saw a first attack attempt in its network of decoy servers on 17 October 2026, four days before the updates, and on 21 October, still before the release, several sample exploits and further attempts. In version 1.2 of its advisory the BSI reports no confirmed successful attacks in regulated industries or the German federal administration, but reads the reports as evidence of automated attack attempts, and says the number of vulnerable systems is still very high. That is why every day counts with this hole. Amazon Threat Intelligence, BSI security advisory (German)
Which websites are affected by the PHP vulnerability?
Every website whose server runs PHP is affected, however PHP is set up there. The PHP project sees the highest risk on servers running Apache with mod_php: there the attack succeeded before the website itself had run a single line of code. PHP security advisory
Whether your website is protected depends only on the PHP version on the server:
| PHP version | Fixed from | What you do |
|---|---|---|
| 8.5 | 8.5.12 | check the version, otherwise ask your host |
| 8.4 | 8.4.27 | check the version, otherwise ask your host |
| 8.3 | 8.3.36 | check the version, otherwise ask your host |
| 8.2 | 8.2.35 | check the version and plan a switch: 8.2 gets no security updates after 31 Dec 2026 |
| 8.1, 8.0, 7.4 | no regular new release | switch to PHP 8.3 or 8.4 |
| 7.3 and older | no fix | switch to PHP 8.3 or 8.4 |
For PHP 7.4, 8.0 and 8.1 the PHP project has only published fixes in the source code, and some Linux distributions build their own updates. For a website on shared hosting that helps little: there, switching to a current version is the route that reliably works.
Websites whose server does not run PHP are not affected. With website builders and hosted shop systems the provider runs the servers and installs updates itself, so there is usually nothing for you to do.
The BSI also reminds readers that PHP is built into devices with a web interface, such as firewalls, routers and other network devices. For those, the manufacturer's firmware updates are what counts. BSI security advisory (German)
How to check the PHP version of your WordPress site
- Look in WordPress.In the dashboard under Tools, Site Health, tab “Info”, section “Server” you find the PHP version with its full number, for example 8.3.36.
- Look in your hosting panel.On shared hosting you choose the PHP version yourself, usually in the settings of your hosting package. At IONOS it is under Menu, Hosting, tile “PHP”, “Manage”, and in IONOS WordPress hosting under the advanced settings, “PHP version”. IONOS help (German)
- Ask your host or agency.Without access of your own, send this question: “Which PHP version does our website run, and is the update against PHP2Shell (CVE-2026-109618 and CVE-2026-109619) installed?” Ask for the version number in writing.
The version number alone is not always enough
On servers of your own, PHP usually comes from the package manager of the Linux distribution. Debian, Ubuntu or Red Hat then sometimes build the fix into an older version number. In that case the BSI recommends comparing the installed version with the distribution's security advisory. If in doubt, your host confirms the status. BSI security advisory (German)
How to update the PHP version in WordPress
If your website runs PHP 8.1 or older, switching to a newer version is the only reliable protection. On shared hosting the switch itself takes a few minutes, the check afterwards takes longer: IONOS explicitly warns that changing the version can affect how a website works. IONOS help (German)
- Make a backup.Back up files and database, in your hosting panel or with a backup plugin.
- Update plugins and theme.Current versions usually run on PHP 8.3 without problems. Outdated plugins are the most common cause of errors after the switch.
- Switch the PHP version.Choose PHP 8.3 or 8.4 in your hosting panel. With older plugins, PHP 8.3 is the more cautious choice.
- Test the website.Open the home page, a few subpages, the contact form and the page editor. If an error shows up, get help instead of going back to the old version for good: the old version stays open to attack.
From our own work: on 25 October 2026 we switched a WordPress website built with Elementor at IONOS from PHP 8.0 to 8.3. The switch was one click in the hosting panel, after which the server reported PHP 8.3.36, and the home page kept running without errors.
If you cannot switch right away
The BSI advises taking a vulnerable system off the internet until it is updated, because all known workarounds and firewall rules protect only partly. For a website that means: take it offline or serve a static maintenance page without PHP. A maintenance-mode plugin does not help, because it runs on PHP itself. BSI security advisory (German)
What to do if your website was exposed
If your site ran a vulnerable version from 17 October 2026 onwards, do not just update, also check. Amazon explicitly advises searching from that date, not from the release of the updates. The BSI recommends making sure that no compromise has taken place. According to the BSI there are no indicators specific to PHP2Shell, so the general signs of a hacked web server apply. Amazon Threat Intelligence, BSI security advisory (German)
- If you have a concrete suspicion, secure logs and files first and clean up afterwards, otherwise the traces needed to investigate are gone.
- Change passwords: WordPress administrators, your hosting panel, SFTP and database access. Also renew the security keys (salts) in wp-config.php and the API keys of payment or email services, because an attacker could read the configuration.
- Check under “Users” whether unknown administrator accounts were created.
- Have the website scanned with a security plugin such as Wordfence or Sucuri.
- Watch for new or changed PHP files dated 17 October 2026 or later, especially in the upload folder wp-content/uploads.
- Ask your host whether the access logs show anything unusual.
- If you find concrete traces, restore a backup from before 17 October 2026, update PHP straight away and set all passwords and keys anew.
- If personal data is affected, such as customer accounts or form submissions, the data protection authority usually has to be notified within 72 hours (Article 33 GDPR).
What your host does and what you have to do
| Type of hosting | Who installs the PHP update | Your task |
|---|---|---|
| Shared hosting, e.g. IONOS or Strato | the host, for the versions it offers | choose a current PHP version and check it |
| Managed WordPress | the provider | ask the provider for the status |
| Own server or VPS | you or your service provider | update packages, restart the PHP services, check the version the web server uses: php -v only shows the command line |
| Docker container | you or your service provider | rebuild and redeploy the images |
| Website builder or hosted shop | the provider | usually nothing |
Important on shared hosting: the host updates the versions it regularly supports. If your hosting panel is still set to PHP 8.0 or 8.1, your site may stay unprotected until you switch yourself. That is exactly what we found on one client's website. IONOS, for example, reports that it has installed the update on all platforms it runs itself, and it offers paid Extended Support for old versions. Whether an old version received the PHP2Shell fix that way, only your host can tell you. Switching to PHP 8.3 or 8.4 saves you the question. IONOS newsroom (German), IONOS Extended Support (German)
The third PHP issue, CVE-2026-115560
On 23 October 2026 the PHP project pointed to a further vulnerability. It only occurs with an unusual combination of settings and program code and is therefore closed in the next regular update, without an emergency release. Until then, the PHP project recommends setting session.upload_progress.enabled to 0. That is a job for your host or server administrator; on shared hosting you can ask for it. PHP notice of 23 Oct 2026
The BSI has rated reports that the PHP2Shell fixes are incomplete and can be bypassed as refuted. Updating to one of the versions above protects against the two PHP2Shell holes; the third is only closed by the next regular update. BSI security advisory (German)
Does the PHP vulnerability affect ordinary users?
Hardly directly. PHP2Shell affects servers, not smartphones, computers or banking apps. Visiting a website does not require you to install anything. It can reach users indirectly if an attacker reads a shop's customer data. If you run a router or network storage device with a web interface at home, install the manufacturer's firmware updates. If you run your own Nextcloud, update PHP on your own server.
Why websites without a PHP server are not affected
A website does not have to use PHP. We build new client websites with Next.js: the pages are generated in advance and delivered via Vercel, and no PHP runs on the server. A hole like PHP2Shell has nothing to attack there, and for these clients there was nothing to do because of PHP2Shell.
Such sites still need care: Next.js and its building blocks get security updates too, and in October 2026 we updated Next.js on our own website because of several security advisories. The difference lies in how much is exposed to the internet. A content management system with plugins, database and login on the same server offers more surface to attack than pages generated in advance. How we build websites is described under web design. In the free Website Check we also check whether your server reveals a PHP version and whether it is patched.
Frequently asked questions
What should I do about the PHP vulnerability PHP2Shell?
Check the PHP version of your website. If it shows 8.5.12, 8.4.27, 8.3.36, 8.2.35 or a newer version of the same branch, the hole is closed. On PHP 8.1 or older, switch to 8.3 or 8.4 in your hosting panel. Then change passwords and keys and check the website from 17 October 2026 onwards for unknown administrators and files.
What sites are affected by the PHP vulnerability?
All websites whose server runs PHP and does not yet use a fixed version. That includes many sites built with WordPress, TYPO3, Joomla, Drupal and Magento. Websites without PHP on the server are not affected.
Does a WordPress update fix PHP2Shell?
No. The hole is in PHP, not in WordPress or a plugin. The PHP version on the server has to be updated. A plugin that promises protection against PHP2Shell does not replace the PHP update.
How do I check the PHP version in the WordPress dashboard?
Under Tools, Site Health, tab “Info”, section “Server”. Alternatively in your hosting panel, in the settings of your hosting package.
Is the PHP vulnerability patched yet?
For the two PHP2Shell holes, yes, since 21 October 2026 with PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. A website is only protected once one of these versions runs on its server. A third, much rarer hole (CVE-2026-115560) is closed with the next regular update.
Are Wix, Squarespace and Shopify sites affected?
With website builders and hosted shops the provider runs the servers and installs security updates itself. As a customer you usually have nothing to install; the provider's status page tells you more.
Does the PHP vulnerability affect regular people?
Usually not directly. The hole affects servers, not smartphones or computers. If you run a router or network storage device, install the manufacturer's firmware updates; if you run your own Nextcloud, update PHP on your own server.
Note
This article reflects the situation on 25 October 2026. The situation keeps changing; the security advisories of the PHP project and the BSI are authoritative.