A serious PHP bug is letting attackers in. Is your site safe?
PHP2Shell is the name for two PHP bugs, CVE-2026-109618 and CVE-2026-109619. If your website runs on PHP, a stranger may be able to take it over without a password. Here’s how to check, and how we can fix it for you.
One flat rate before we start. You own every line of code.
Updated October 26, 2026
The short version
- 9.2 out of 10 on the severity scale
- No password needed to break in
- Attacks seen since October 17
- Fix released October 21
You heard about it. Now what?
Maybe your web host sent a warning. Maybe it was in the news. Either way, you’re not behind. The fix only came out on October 21, and teams everywhere are sorting it out right now.
The person who built your site is gone
It still works, but nobody on your team knows how it’s put together, or what an update might break.
You don’t know your PHP version
That’s normal. Most owners never need to. But this time the version decides if you’re safe.
Your site is old
Older versions of PHP don’t get this fix at all. Moving to a newer one can break old code.
You have a business to run
You don’t have time to read security alerts. You just want to know it’s handled.
First, here’s why this one matters. What PHP2Shell is
Why you shouldn’t wait on this one.
PHP is the language behind about 7 in 10 websites, including WordPress, Drupal, Joomla and Magento. PHP2Shell is a pair of bugs in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619. They let an attacker run their own code on your server, from anywhere, without logging in.
What an attacker can do
- Run any code they like on your web server
- Read files on it, like passwords for your database
- Change your site, or quietly add their own pages
- Use your server to go after other systems
The PHP team rates both bugs 9.2 out of 10 for severity. When the fix came out, banks, retailers, hospitals and some government agencies took servers offline to patch.
How fast it’s moved
- October 17Amazon sees the first attack attempts, four days before any fix exists.
- October 21The PHP team releases the fix. Security agencies in the US, Canada and Europe tell everyone to patch now.
- October 23The PHP team warns about a third, related bug that has no fix yet.
- October 24A researcher confirms a working break-in on a test server running PHP 8.4.26.
So, is your site at risk? Find out
It comes down to your PHP version.
Not sure which version your site runs? That’s normal, and you don’t need to find out on your own. Send us a note and we’ll look for you.
| Your PHP version | Where things stand |
|---|---|
| 8.2, 8.3, 8.4 or 8.5 | The PHP team has a fix. Safe from 8.2.35, 8.3.36, 8.4.27 and 8.5.12 |
| 7.4, 8.0 or 8.1 | No fix from the PHP team. Some hosts and Linux vendors offer their own |
| 5.4 to 7.3 | No fix. These versions are no longer supported, and US officials say to take these sites offline |
Source: PHP security team, via the Canadian Centre for Cyber Security and Tenable. Links below.
Already updated? There may be more to it.
- A third bug has no fix yet. The PHP team warned about it on October 23.
- PHP can hide in more than one place. Some products, appliances and containers bring their own copy.
- Attacks started before the fix. A site that’s patched now could have been hit before.
Not sure where you stand?
Tell us about your site. We’ll look at it, tell you what we find, and give you one flat rate to make it safe.
Tell us about your site. We do the rest.
You don’t need to know your PHP version, or anything else on this page. A few sentences about your site is plenty.
Tell us about it
What the site is and who hosts it. A few sentences is plenty.
30-minute call
We learn about your site and check we’re a good fit. Then you get one flat rate.
We update and test
AI finds what would break on a safe version of PHP and writes the changes. An engineer reviews every change before it ships.
You get it back, safe
Your site runs on a fixed version of PHP. Every line of code is yours.
We’ve taken over messy code before.
This page is new, so there are no PHP2Shell stories yet. Here’s a recent job where we took over from an offshore team.
Project sheet
Medical web app
- Where it stood
- We took over a medical web app from an offshore development shop. It was months behind schedule and well over budget.
- What we did
- Mapped the existing code with AI and gathered the business requirements.
- What we delivered
- The finished product in two months, for the guaranteed price.
FAQ
What is PHP2Shell?
It’s the name for two bugs in PHP, CVE-2026-109618 and CVE-2026-109619. They let someone run their own code on a web server that uses PHP, without a password. The PHP team released a fix on October 21, 2026.
Is my WordPress site affected?
It could be. The bugs are in PHP, which WordPress runs on, and researchers broke into specific versions of WordPress, Drupal, Joomla and Magento. It depends on your PHP version and how your site is set up. Reach out and we’ll check for you.
My site is old. Can it still be fixed?
Yes, but it can take more work. The PHP team isn’t fixing older versions, so old sites often need changes to their code too. Tell us about yours and we’ll tell you what it takes.
How much does it cost?
It depends on your site, so we read your code first. Then you get one flat rate and a date, before you commit. No hourly rate.
Who owns the code afterwards?
You do. Every change we make is yours to keep.
Do I need to get on a call?
Yes, and it’s free. We start with a 30-minute call to understand your site and check we’re a good fit. Then we send you one flat rate.
What should I do first?
Reach out. Tell us about your site in a few sentences. You don’t need your PHP version or any tech details.
Sources
- Canadian Centre for Cyber Security, alert AL26-026: fixed versions and the related bug.
- Tenable, PHP2Shell FAQ: severity score, timeline, affected apps, PHP’s share of websites and US agency guidance.
- CISA, Critical Vulnerabilities in PHP Require Immediate Patching
- CERT-EU, Critical Vulnerabilities in PHP
- BleepingComputer, PHP2Shell flaws now exploited in the wild: the confirmed break-in on October 24.
- TechCrunch, How two critical web bugs almost broke the internet: who took servers offline to patch.
Want it off your plate?
Tell us about your site in a few sentences. You don’t need your PHP version or any tech details. We’ll set up a 30-minute call, then send you one flat rate.