FAQ
PHP vulnerability questions, in one place
The questions people ask most about PHP2Shell and keeping PHP safe, each with a short answer and a link to the page that covers it properly. Start with the group that fits where you are.
Last reviewed against php.net, the NCSC and CISA.
About PHP2Shell
What is PHP2Shell?
The name for CVE-2026-109618 and CVE-2026-109619, two critical flaws in PHP itself that can let someone with no login run code on a web server. The PHP project fixed them on 21 October 2026.
Which releases contain the fix?
8.5.12, 8.4.27, 8.3.36 and 8.2.35, plus anything later on those branches. Each release has its own page with where to get it.
Is anyone exploiting it?
CISA put both CVEs on its Known Exploited Vulnerabilities catalogue on 26 October 2026, which means it has evidence of exploitation.
Is PHP2Shell related to Click2Shell?
No. Click2Shell was a WordPress flaw fixed in WordPress 7.1.1. PHP2Shell sits in PHP, underneath WordPress, and needs a PHP update.
Your site
How do I find out which PHP version my site uses?
Your hosting panel, WordPress Site Health or a temporary phpinfo() file will show it. The command line can report a different PHP from the one serving your site.
Does my site need to come offline?
Only if it is exposed and cannot be fixed or mitigated soon. The risk calculator scores your site out of 100 and places it against the NCSC's and CISA's guidance.
Could my site already have been attacked?
If it was public on a vulnerable build, check it. Look for PHP files nobody added, changed files and unknown admin accounts, and keep the logs before you clean anything.
My hosting company looks after PHP. What do I need to do?
Ask them which version your site runs and whether it has the 21 October fix, and switch to a fixed version in your panel if you can.
Updating
Where do I start with updating PHP on a server?
With where your PHP comes from: a hosting panel, a Linux distribution, Windows, a container or your own build. Each has its own guide.
Why does my patched Linux server show an old PHP number?
Distributions often patch the version they shipped rather than moving to the new upstream number. Check the distribution's notice for the CVEs, not the number.
Is installing the update enough?
Not until PHP restarts. PHP-FPM workers, Apache with mod_php and LiteSpeed's PHP processes keep running the old build until they are replaced.
What if we cannot update PHP for weeks?
Do not leave the system exposed as it is. Put mitigating controls around it, such as a WAF, network segregation and closer monitoring, and if the business decides to carry the risk, record it with a named executive owner and an expiry date.
Can I hold off the update with a configuration change?
Partly, for a few days. The PHP project lists interim settings, but says plainly that updating is the only complete fix.
Old and retiring branches
Is there a fix for PHP 7.4, 8.0 or 8.1?
Not as a PHP release. Distributions, hosting panels and the PHP security team's source-only backports carry it for some installs; the lasting fix is a supported branch.
When does PHP 8.2 stop getting fixes?
After 31 December 2026. 8.2.35 fixes PHP2Shell, but anything found from January 2027 will not be fixed on 8.2 by the PHP project.
Which PHP version should I move to?
The newest one your platform and code support: 8.3, 8.4 or 8.5. The upgrade guides cover each route from 7.4, 8.0, 8.1 and 8.2.
Will my platform run on a fixed PHP version?
Most current releases will. Some older ones, including PrestaShop 8 and Magento 2.4.4 and 2.4.5, only accept PHP 8.1 or earlier.
This site
Who is behind PHP Vulnerability?
CyPro Consulting Ltd, a cyber security consultancy based in London. The partners answer for what the site says.
Does this site test or scan my website?
No. Nothing here contacts your website, and the risk calculator keeps your answers in your browser.
Know your exposure
Find every PHP server you run
Patching the server you know about is the easy part. A vulnerability scan finds the forgotten staging site, the old microsite and the appliance with PHP inside, then tells you which ones are still exposed.