Website security guide
What is PHP2Shell, and how do I fix it?
Two critical flaws in PHP itself. Here is what they mean for your website and the order to fix things in.
What happened
CVE-2026-109618 and CVE-2026-109619 are flaws in the PHP engine, rated 9.2 out of 10 (CVSS v4). Public reporting describes one as memory corruption during out-of-memory handling and the other as a use-after-free in state kept between requests. Either can let an unauthenticated attacker run code on the server.
Details leaked on October 20, ahead of a planned disclosure, and PHP published fixed releases on October 21, 2026. Proof-of-concept exploits are circulating and security vendors reported attack attempts within a day.
Which versions are affected and which are fixed
- Affected: PHP 5.4 through 8.5.11.
- Fixed: 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or later in each line.
- No fix coming: PHP 8.1 and older. These must be upgraded to a supported line.
What to do today
- Find out the exact PHP version (your host’s control panel, or
php -v). If you cannot, assume you are exposed. - If it is not a fixed release, put a web application firewall in front of the site now. It buys time; it is not the fix.
- Back up the site and database.
- Update the CMS, theme and plugins first, then PHP, on a staging copy if you have one.
- Re-scan to confirm, and check for anything an attacker may have left behind if the site was exposed for any length of time.
Not sure where to start? A free Feli-Scan takes under 30 seconds, and Feli-Scan Protect does all five steps for you within 24 hours.
Questions people actually ask
Before you call
Does hiding the PHP version protect me?
It removes an easy clue, which is good practice, but the flaw is still there. Attackers can simply try the exploit.
My host says they patch automatically. Am I safe?
Possibly. Ask which PHP version your site is running now, in writing. Many hosts keep old PHP lines available for compatibility, and a site pinned to one is not covered by automatic updates.
Still have the question?
Ask us directly. We answer these on calls all day.