PHP2Shell: CVE-2026-109618 and CVE-2026-109619
We'll fix the PHP2Shell vulnerability on your website
A serious flaw in PHP itself was made public on 21 October 2026. It lets an attacker take over the server behind a website with a single request, no password needed, and attempts to use it have already been seen. If your website runs on PHP, we'll check it, patch it or upgrade it for you.
Not sure if you're affected? Send us your web address and we'll tell you.
Why this one is serious
- The severity score both flaws were given
- 9.2 / 10
- All an attacker needs, with no login
- 1 request
- Every version since 2012 has the flaw
- PHP 5.4+
- First attack spotted, four days before the fix came out
- 17 Oct
The severity score both flaws were given
All an attacker needs, with no login
Every version since 2012 has the flaw
First attack spotted, four days before the fix came out
What happened
What is PHP2Shell?
PHP is the programming language behind most websites, including every WordPress, WooCommerce, Magento, Drupal, Joomla and Laravel site. On 21 October 2026 the people who look after PHP released urgent fixes for two flaws in PHP itself. Together they're known as PHP2Shell.
Both are rated 9.2 out of 10 for severity. An attacker can send one specially made request to your website and run their own code on the server, before your website's own code has even started. From there they could copy customer details, add spam or malware to your pages, or use your server to attack other people.
The fault is in PHP, not in your website, so it doesn't matter how well your site was built, and a security plugin won't stop it. The fix is to update PHP on the server, or to upgrade a site that's on a version too old to be fixed.
- Affects every version of PHP from 5.4 onwards
- WordPress, Magento, Drupal, Joomla and Laravel sites are all open to it
- Attacks started before the fix was published
Is your version safe?
Which PHP versions can be fixed
Your hosting control panel usually shows which version of PHP your website runs. If you can't find it, we'll check for you.
PHP 8.2, 8.3, 8.4 and 8.5
Fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. A site on one of these needs updating to the fixed release, and PHP restarting so the fix takes effect.
PHP 7.4, 8.0 and 8.1
These versions no longer get official updates from PHP, so there's no proper fix for them. The safe answer is to upgrade the website to PHP 8.4 or 8.5.
PHP 7.3 and older
Nothing has been released for these at all. The website needs upgrading before it's safe to keep online.
How we fix it
What happens when you get in touch
-
Tell us your web address
Ring us or use the form below. Let us know who hosts the site if you know. If you don't, that's fine, we can usually find out.
-
We check your PHP version
We find out which version of PHP your server runs and whether it already has the fix, then tell you what needs doing and what it costs before we touch anything.
-
We patch or upgrade
If your version can be patched, we update PHP and restart it so the fix takes effect. If it's too old, we upgrade your website to a supported version and fix anything the upgrade breaks.
-
We look for signs of a break-in
We check for files that shouldn't be there and odd activity in the server's logs, and explain what we found in plain English.
Older websites
Stuck on an old version of PHP? We'll upgrade it
Plenty of websites are still on PHP 7 or 8.0, years after those versions stopped getting security fixes. Usually it's because nobody wanted to risk breaking something. PHP2Shell changes that: staying where you are is now the bigger risk.
Laravel and PHP are what we build with every day. We upgrade WordPress, WooCommerce, Laravel and custom-built PHP websites, update the code, themes and plugins that need it, and test everything on a copy of your site before the live one changes.
- Tested on a copy before your live site changes
- WordPress, WooCommerce, Laravel and custom PHP
- If your host can't update PHP, we can move you to hosting we look after
Think your site has already been hacked?
Ring us straight away. We'll help you take it offline safely, find out what was changed and bring it back patched.
Questions
What people are asking about PHP2Shell
How do I know if my website uses PHP?
If your site runs on WordPress, WooCommerce, Magento, Drupal, Joomla or Laravel, it uses PHP. Lots of custom-built sites do too. If you're not sure, send us the address and we'll find out.
My website is hosted by someone else. Isn't this their job?
On shared hosting your host should update PHP for you, so it's worth asking them today. On a VPS, a cloud server or a dedicated server, updating PHP is usually down to you or your developer.
Either way, a host can only patch the versions that still get fixes. If your site needs PHP 8.1 or older to run, it will need upgrading.
Will a security plugin or a firewall protect me?
Not reliably. The attack happens before WordPress or any plugin has loaded, so a security plugin never sees it. Some firewalls, Cloudflare's among them, have added rules for the attacks known so far. That helps while you wait, but it isn't a fix.
Can I put my site into maintenance mode until it's fixed?
That doesn't help. PHP reads each request before your website checks whether it's in maintenance mode, so the site is still exposed. Security agencies advise taking a site offline completely if it can't be patched straight away.
How quickly can you fix it?
Most sites only need PHP updating and restarting, which we can often do the same day. A site on an old version of PHP needs an upgrade, which takes longer. We'll tell you how long once we've looked at it, and we can keep it protected in the meantime.
How much does it cost?
It depends on how your site is hosted and which version of PHP it runs. Ring us or send us your web address, and we'll give you a price before we start.
What are CVE-2026-109618 and CVE-2026-109619?
They're the official reference numbers for the two flaws. CVE-2026-109618 is in how PHP cleans up a request after running out of memory, and CVE-2026-109619 lets something from one request linger for the next one. Together they're known as PHP2Shell.
Get your site checked
Send us your web address
We'll find out which version of PHP it runs and tell you what needs doing. If your site is down or you think it's been hacked, ring us instead of waiting for an email.
- Phone
- 0191 687 2044
- info@tarkawebdesign.com
- Where to find us
-
International House
14 King Street
Leeds
West Yorkshire
LS1 2HL