PHP2Shell: critical PHP flaws are putting websites at risk. Is yours safe?
What is PHP2Shell?
PHP2Shell is the name given to two critical security flaws in PHP, the programming language behind WordPress and a very large share of the world's websites. Both are rated 9.2 out of 10. An attacker does not need a password or a login: if the server is reachable and runs an unpatched PHP version, they can try to run their own commands on it and take control.
What happened
- 17 October 2026: Amazon detected an attempt to exploit the flaw on its security sensors, four days before it was made public.
- 21 October 2026: the PHP team released emergency fixes: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and urged all users to update immediately.
- 23 October 2026: a third, narrower PHP issue was announced. It needs an unusual server setting, and the same recommended setting reduces the risk.
- Attack tools appeared within hours of the fixes, and attempts are expected to continue now that the technical details are public.
How big is it
- Cloudflare reported thousands of attack attempts in the 10 hours before the announcement, and hundreds of thousands within two hours after it.
- Imperva counted 482,342 attack requests against 21,998 websites in 103 countries in the first 24 hours.
- Internet scanner Censys counted up to 32 million services still running an affected PHP version on 26 October.
- Government websites in the Netherlands, France, Finland and Belgium were taken offline as a precaution, as well as systems at Wikipedia and the Internet Archive. TechTarget reports that the BBC also restricted access to its site until it was patched.
- Al Jazeera quotes a University of Melbourne cybersecurity lecturer saying PHP powers more than 70 percent of websites.
Is your website at risk?
Your website may be exposed if any of these apply:
- It runs on WordPress, WooCommerce, Laravel, Joomla, Drupal or custom PHP code
- It is on a VPS or dedicated server, where nobody updates PHP for you
- It runs PHP 8.1 or older, which no longer gets security fixes
- Your hosting company has not confirmed that PHP was updated after 21 October
- Nobody has checked the site for unknown admin users or new files since mid-October
What to do now
- Update PHP to a fixed version and restart every PHP worker on the server.
- Ask your host to confirm in writing that your server is patched, if you are on shared hosting.
- Check for signs of a break-in: admin accounts you do not recognise, files you did not add, and unusual traffic since 17 October. The patch does not undo a break-in that already happened.
- Change passwords for hosting, WordPress and database if anything looks wrong.
- Update WordPress, plugins and themes too. They have their own security issues, separate from PHP.
- Add a web application firewall, such as Cloudflare, and keep daily backups.
- Replace very old websites that cannot run on a supported PHP version.
Questions
Is my WordPress website affected?
WordPress runs on PHP, so it depends on the PHP version on your server. If your server runs an unpatched PHP version, your site is exposed even if WordPress itself is up to date.
Does my hosting company fix it for me?
Many shared and managed hosts patched PHP automatically. If you have a VPS or dedicated server, you usually have to update PHP yourself. Either way, ask your host to confirm in writing.
My server is patched now. Am I safe?
The patch stops new attacks through these flaws, but it does not undo anything that happened before. Attack attempts were seen from 17 October, so it is worth checking for unknown admin users, new files and unusual traffic.
What if my website runs PHP 8.1 or older?
Old PHP versions no longer get security fixes. The safest step is to move the site to a supported PHP version, or rebuild it if the old code cannot run on a new version.
Sources
This page summarises public reports. Figures are as reported by the sources below.