PHP2Shell: what the PHP vulnerability means for your site

On 21 October 2026 the PHP project released emergency updates for two critical flaws in PHP itself, now widely known as PHP2Shell. PHP is the language behind WordPress, WooCommerce, Joomla, Laravel and most of the websites hosted on cPanel in Kenya, so if your business website runs on shared hosting, there is a good chance this affects you. Attacks against unpatched servers were being observed the same day the fix came out.

What the vulnerabilities are

The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and both are rated 9.2 out of 10 for severity. They live in the core of PHP, not in a plugin or theme, which is why they reach so widely.

• CVE-2026-109618: when PHP runs out of memory partway through handling a request, internal data can be left half set up, and PHP may later treat it as valid.
• CVE-2026-109619: data belonging to one request can outlive the memory it pointed to, and the next request handled by the same PHP worker may use that stale data.

The practical result of both is the same. An attacker who sends carefully crafted requests to your website, without logging in, may be able to run their own code on your server. Researchers have also shown that the flaws can leak the contents of PHP's memory, which can include passwords, login sessions and API keys.

Who is affected

Almost every PHP installation that serves web pages is affected, whether it runs under PHP-FPM, Apache mod_php, php-cgi, LiteSpeed or FrankenPHP. The PHP project considers Apache mod_php the highest risk, because an attack can succeed before any of your website's own code has run. It does not matter how well your WordPress plugins are maintained: the weakness is underneath them.

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything older on those branches is vulnerable. Older branches are worse off. PHP 7.4, 8.0 and 8.1 have no official release, only patches from Linux distributions, hosting vendors or PHP's own minimal source backports. PHP 7.3 and earlier, including PHP 5, are affected and have no fix at all.

What to do today

If you have a cPanel account, open the section called Select PHP Version or MultiPHP Manager and note which version each of your sites uses. Then work through these steps:

• If your site is on PHP 8.2 or newer, ask your hosting provider in writing whether their servers now run the patched release. On shared hosting the provider installs PHP, so the update is theirs to apply.
• If your site is on PHP 8.1 or older, plan a move to a supported version now. Test it on a copy of the site first, because old themes and plugins sometimes break on newer PHP.
• Update WordPress, your theme and your plugins at the same time, so the newer PHP version does not trip over outdated code.
• Take a fresh backup before changing anything, and keep it somewhere other than the same hosting account.

If you manage your own server, update PHP from your distribution or from php.net and restart the PHP workers so the new version is actually in use. Updating is the only complete fix. Until you can, the PHP project lists temporary measures: setting session.upload_progress.enabled to 0, setting memory_limit to -1 through php_admin_value together with a low post_max_size and a container or cgroup memory limit, and on PHP 8.5 setting fatal_error_backtraces to 0. These reduce the risk but do not remove it.

Check whether anyone got in

Because attacks began as soon as the flaws became public, patching closes the door but does not tell you whether someone already walked through it. After updating, it is worth a short check:

• Look for administrator accounts in WordPress or your control panel that nobody on your team created.
• Look for unfamiliar PHP files, especially inside upload folders, and files changed on dates when nobody worked on the site.
• Change the passwords for your hosting account, database, site administrators and email, and replace any API keys stored on the server, such as M-Pesa, payment gateway or email service keys.
• Watch your site for redirects to unfamiliar pages, new pop-ups or warnings from Google Search Console.

Rotating keys matters even if you find nothing else, because a memory leak leaves no obvious trace on the website itself.

If you need a hand

Most business owners do not have the time to check PHP versions across several sites, test an upgrade and review files for signs of tampering. If your website was built on WordPress or another PHP platform and you are not sure where it stands, OctoPrograms can check the version, apply the update safely, and look for anything that should not be there. Get in touch and tell us which sites you run.