PHP2Shell Patch: What Trade Shops Should Ask Their Web Host

By Reid Casey · Last checked: Oct. 22, 2026, 7:01 AM ET, against PHP.net, CISA and the CVE records

We reviewed PHP.net's security advisory on Oct. 21, 2026, along with CISA's alert and the official CVE records.

Short answer: On Oct. 21, 2026, PHP.net released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical flaws that "can allow unauthenticated remote code execution." If your electrical, plumbing or HVAC company's website runs on WordPress, it runs on PHP. This week, ask your web host which PHP version your site uses and whether it's been updated.

Key takeaways

• PHP.net says to update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and "All PHP users are strongly encouraged to update immediately" (PHP.net).
• Reports differ on attacks: CISA's Oct. 21, 2026 alert says it "has not observed exploitation" (CISA). Later that day, AWS wrote that PHP2Shell is "broadly exploited in the wild," based on attempts against its own sensors (AWS). AWS also said it can't yet tell whether any of those attempts worked on real sites ("it's unclear if any of these attempts would have succeeded in real-world systems"). That's a reason to patch now, not to wait.

What is PHP2Shell?

PHP2Shell is the name the researchers and CISA use for two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, that can let an attacker run code on a website's server without logging in. PHP.net says PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix them, and it urges all PHP users to update immediately (PHP.net).

The name is used on the researchers' disclosure site, which credits Wiz, OpenAI and Calif, and in CISA's alert. PHP.net doesn't use it. PHP.net calls the flaws "RCE via OOM corruption" (CVE-2026-109618) and "RCE via stale global state" (CVE-2026-109619) (PHP.net). PHP rates both CVSS v4.0 9.2, Critical (NVD).

PHP.net says the risk covers "all PHP installations serving web requests," naming PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed, and is highest for mod_php (PHP.net). In plain terms, someone on the internet could make your web server run their commands, with the web server's own permissions, according to the PHP project's GitHub advisory.

Is my WordPress site affected?

PHP.net says the flaws affect "all PHP installations serving web requests," and WordPress runs on PHP (PHP.net). WordPress.org says "No WordPress update is required or planned for these issues," because the fix is a PHP update on the server (WordPress.org). Its post adds that your web host "may already be working to update PHP," but you "should still check for updates from your web host." That statement is about WordPress itself and doesn't speak to plugins.

Older PHP is the harder case. PHP.net says "PHP 8.1 and older no longer receive updates from the PHP project," and points those sites to vendors that offer backported fixes, or to an upgrade (PHP.net).

CISA tells organizations still on "PHP 8.1 or earlier unsupported versions" to take PHP systems offline until they're patched or updated (CISA). If your site is on 8.1 or older, don't assume it's safe.

What does it mean for an electrician, plumber or HVAC shop?

Your website is where a homeowner with a tripped breaker or a water heater that quit books the call or fills out a quote form. Our read: if the site goes down or gets tampered with, those calls and forms stop coming in.

Most shop owners don't manage the server themselves. Your host or web person updates PHP, and PHP.net says Linux distributions and long-term support vendors "received the patches in advance" (PHP.net). Your job is to ask, and to get a clear answer.

Reports on attacks differ. CISA's Oct. 21, 2026 alert says it "has not observed exploitation of these vulnerabilities as of the time of publication" (CISA).

That evening, AWS wrote that its honeypot sensors saw an attempt dating to Oct. 17 and that "PHP2Shell is now being broadly exploited in the wild" (AWS). AWS also said it can't yet tell whether any of those attempts worked on real sites ("it's unclear if any of these attempts would have succeeded in real-world systems"). That's a reason to patch now, not to wait, and PHP.net says to update immediately.

Your host may suggest taking the site offline while it updates. CISA recommends that for organizations that can't update right away (CISA). If that happens, Google's John Mueller wrote on Bluesky: "use HTTP 503 instead of letting responses time out / 404 / 500" (Bluesky).

Reid's take

Here's my test for any shop owner: can you say, in one sentence, who updates your website's server? Not "the web guy." A name, and how you reach them.

If you can't, that's this week's job. WordPress.org says the fix is a PHP update on the server, not a WordPress update. So somebody has to do it, and you need to know who. Start with whoever bills you for hosting or your domain. Ask which PHP version you're on, and get the answer in writing.

What should you do this week?

1. Ask your host or web person which PHP version your site runs, and whether it's 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor build that includes the fix (PHP.net).
2. Check it yourself if you have WordPress admin access. WordPress.org says the version is under Tools > Site Health > Info > Server (WordPress.org).
3. If you don't know who manages your site (our advice): look for whoever bills you for hosting or your domain name, and contact them. Your hosting control panel often shows the PHP version too.
4. If your site is on PHP 8.1 or older, ask your host for a supported version and set a date. PHP.net says those versions get no updates from the PHP project (PHP.net).
5. If the site has to go offline while it's fixed, ask for an HTTP 503 page, as Google's John Mueller advised (Bluesky).

A message you can send your web host today (our template; copy and paste it):

Hi, PHP.net just released a critical security update for PHP. Can you tell me:

1. Which PHP version is my website running right now?

2. Is it on PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor version that includes the fix for CVE-2026-109618 and CVE-2026-109619?

3. If we're on PHP 8.1 or older, what's the plan and date to move to a supported version?

4. If you need to take the site down to update it, can it show a 503 "back soon" page?

5. Can you confirm in writing when it's done?

The versions and CVE numbers come from the PHP.net advisory, and the 503 point from Google's John Mueller.

What a good answer sounds like (our guidance): a specific version number, the date it was updated, and a plan for anything on 8.1 or older.

What we don't know yet

• Whether any attack attempt has worked. AWS says it's "broadly exploited in the wild" but can't yet tell whether any attempt worked ("unclear if any of these attempts would have succeeded") (AWS), and CISA hadn't observed exploitation as of its Oct. 21 alert (CISA).
• Which hosts have finished updating. Ask yours directly.
• Whether your vendor covers PHP 8.1 or older. That depends on the vendor (PHP.net).

See where your jobs are walking → · the 2-minute diagnostic

Related on TechStackRx

• How it works
• Central CRM hub
• Automated nurturing that packs calendars

Caveats and methodology

• We reviewed PHP.net, CISA, the CVE and NVD records, the PHP project's GitHub advisories and WordPress.org on Oct. 21, 2026. We haven't tested any website, and nothing here guarantees a site is safe.
• The host message and the "if you don't know" steps are our advice.
• We sell, too. TechStackRx sells lead follow-up automation, 24/7 voice agents and CRM setup for home-service businesses.

Frequently asked questions

What is PHP2Shell?

PHP2Shell is the name the researchers and CISA use for two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, that can let an attacker run code on a website's server without logging in. PHP.net says PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix them, and it urges all PHP users to update immediately.

Is my WordPress site affected?

PHP.net says the flaws affect "all PHP installations serving web requests," and WordPress runs on PHP. WordPress.org says "No WordPress update is required or planned for these issues," because the fix is a PHP update on the server. That statement is about WordPress itself and doesn't speak to plugins.

Which PHP versions fix it?

PHP.net says to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or use a vendor build that includes the fix. PHP.net also says "PHP 8.1 and older no longer receive updates from the PHP project." If your site is on 8.1 or older, don't assume it's safe.

How do I check which PHP version my website runs?

If you have WordPress admin access, WordPress.org says the version is under Tools > Site Health > Info > Server. If you don't, ask your host or web person.

What should I ask my web host or web person?

Ask which PHP version your site runs right now, and whether it's 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor build that includes the fix. If it's on 8.1 or older, ask for the plan and a date to move to a supported version. Then ask them to confirm in writing when it's done.

What if I don't know who manages my website?

Our advice: look for whoever bills you for hosting or your domain name, and contact them. Your hosting control panel often shows the PHP version too.

Should I take my website offline?

CISA says organizations that can't update right away, or that still run PHP 8.1 or earlier, "should take PHP-based systems offline until they can be patched or updated." If your site has to go offline, Google's John Mueller wrote on Bluesky: "use HTTP 503 instead of letting responses time out / 404 / 500."

Are hackers already using it?

Reports on attacks differ. CISA's Oct. 21, 2026 alert says it "has not observed exploitation of these vulnerabilities as of the time of publication". Later that day, AWS wrote that PHP2Shell is "broadly exploited in the wild," based on attempts against its own sensors. AWS also said it can't yet tell whether any of those attempts worked on real sites ("it's unclear if any of these attempts would have succeeded in real-world systems"). That's a reason to patch now, not to wait.

Sources

1. PHP.net, "Security advisory: Critical remote code execution vulnerabilities, update now", Oct 21, 2026. Accessed Oct 21, 2026.
2. CISA, "Critical Vulnerabilities in PHP Require Immediate Patching", Oct 21, 2026. Accessed Oct 21, 2026.
3. CVE Program, CVE-2026-109618 and CVE-2026-109619. Accessed Oct 21, 2026.
4. NIST NVD, CVE-2026-109618. Accessed Oct 21, 2026.
5. PHP project (GitHub), GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp. Accessed Oct 21, 2026.
6. WordPress.org, "Critical PHP Security Release", Oct 21, 2026. Accessed Oct 21, 2026.
7. PHP2Shell researchers, php2shell.com. Accessed Oct 21, 2026.
8. John Mueller, Bluesky post, Oct 21, 2026. Accessed Oct 21, 2026.
9. Amazon Threat Intelligence (CJ Moses), AWS Security Blog, "Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot", Oct 21, 2026. Accessed Oct 21, 2026.