What Is the PHP Security Vulnerability (PHP2Shell)? Is Your Website Affected, and What Should You Do?

PHP2Shell is the name given to two critical remote code execution vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) that were fixed on October 21, 2026. Your site is affected if it runs on a PHP version older than 8.5.12, 8.4.27, 8.3.36, or 8.2.35. The full fix is to update PHP; ask your hosting provider or IT team today.

The development that appears in the news as the "PHP vulnerability" has led many organizations to ask the same question: is our site safe? This article gives a calm, source-based answer: we explain what the vulnerability is, which versions are affected, and what to do today.

The technical information comes from CERT-EU's security advisory and the PHP Foundation's announcement; you'll find the links in the article.

What is PHP, and why are so many sites affected?

PHP is a widely used programming language that runs on web servers. Many content management systems and e-commerce programs, such as WordPress, are written in PHP. A site running on PHP means this vulnerability may directly concern it; the vulnerability is not in applications like WordPress but in PHP itself.

According to CERT-EU, every PHP installation that serves web requests is at risk: including PHP-FPM, mod_php with Apache, php-cgi, FrankenPHP, and LiteSpeed. The PHP team rates mod_php as the highest-risk installation.

What exactly is PHP2Shell (the PHP vulnerability)?

PHP2Shell is the name under which two vulnerabilities in the core of PHP are referred to together. Both scored 9.2 on the CVSS v4.0 scale and can lead to remote code execution without authentication.

• CVE-2026-109618: Memory corruption that occurs when memory runs out (OOM).

• CVE-2026-109619: Use of stale state information after a request has ended (stale global state).

The PHP project announced the security release on October 20 and published the fixes on October 21, 2026. CERT-EU notes that technical details are being discussed publicly and sample code has begun to circulate, which raises the likelihood of the vulnerability being exploited. The recommendation is therefore clear: update.

Which PHP versions are affected?

The PHP team has also published minimal fix patches for PHP 7.4, 8.0, and 8.1 for those who compile from source. These should be seen not as a replacement for moving to a supported version but as a bridge until the move.

Sources: CERT-EU security advisory 2026-018, PHP Foundation announcement, AA report (Milliyet).

Is your website affected by the PHP vulnerability? How to check

Run this check together with your IT team or hosting provider. The order is as follows:

• Find out the PHP version. Look at the PHP version setting in your hosting panel, or run the php -v command on the server. The PHP on the command line and the PHP used by the web server can be different versions; make sure you're checking the web-side version. If you use a phpinfo page that shows version information, remove it when you're done.

• Compare the version with the table above. If it's older than the listed patch versions, an update is needed.

• Ask your hosting provider. If you use shared or managed hosting, ask in writing whether the patch has been applied and when it will be.

• Identify unsupported versions. PHP 8.1 and older versions get no updates from the PHP project. Ask whether your distribution or LTS provider offers the patch; if not, plan a move to a supported version.

• Don't forget third-party software that embeds PHP. CERT-EU notes that commercial and open-source products that use PHP in the background may also be affected, and recommends looking at NCSC-NL's GitHub repository (NCSC-NL/php2shell) to identify them.

• Check your package source. If you use the Remi repository (rpms.remirepo.net), the fix wasn't available there on release day; the PHP team recommends moving to distribution packages or compiling from source.

• Look at general security hygiene. Review the logs for traces such as unexpected file changes, unusual upload requests, or new administrator accounts. This step is not a list of attack traces specific to this vulnerability but a general good practice.

If you use WordPress, verify at the same time that the core, themes, and plugins are up to date. This isn't a consequence of the PHP vulnerability; it's always the first check for the question "is our site safe?"

What should you do if you can't update PHP right away?

CERT-EU recommends that organizations that can't apply the patch immediately isolate internet-facing applications from public networks until the fix is applied and verified. This should be seen as a temporary measure until a maintenance window.

The PHP team has also published some configuration measures; for example, lowering request size limits, turning off the session.upload_progress.enabled setting, and turning off the fatal_error_backtraces setting in PHP 8.5. However, as CERT-EU underlines, these measures narrow specific attack paths but don't make the installation secure; only updating closes the vulnerability completely. Applying these settings is your IT team's job, and the details are in the CERT-EU advisory.

What should you do after updating?

The patch solves the urgent part. Putting three things in order afterward spares you the same scramble at the next advisory:

• Version inventory: Keep a single list of which site runs on which PHP and CMS version.

• Update owner and timeframe: Write down who acts, and within how long, on a critical security update.

• Backup and restore testing: Taking a backup isn't enough; you need to test that you can restore from it.

If you suspect a breach affecting personal data, consult your legal counsel about notification obligations under KVKK (Türkiye's data protection law). For how to ask maintenance and security questions when choosing an agency and infrastructure provider, see our article How to Choose a Web Design Agency.

Frequently Asked Questions

What is the PHP security vulnerability?

Two critical vulnerabilities in the core of PHP, CVE-2026-109618 and CVE-2026-109619, can lead to remote code execution without authentication. Together they are referred to as PHP2Shell and were fixed in the PHP versions released on October 21, 2026.

Is my website affected by the PHP vulnerability, and how do I tell?

Find out your PHP version and compare it with 8.5.12, 8.4.27, 8.3.36, or 8.2.35. If your version is older than these, you are affected. If you're not sure, ask your hosting provider or IT team.

Are WordPress sites affected by this vulnerability?

The vulnerability is in PHP itself. Because WordPress runs on PHP, WordPress sites can also be affected until the PHP version on the server is updated. The fix is to update PHP.

What should I do if I can't update PHP right away?

CERT-EU recommends isolating internet-facing applications from public networks until the fix is applied and verified. Temporary configuration measures narrow some attack paths but don't make the installation secure; the full fix is updating.

How can Clockwork help with this?

Clockwork is an independent digital and creative agency based in Istanbul with 25 years of experience; it is certified to ISO 27001 and ISO 12207. We do website design and development. If you want to renew your existing site or change its infrastructure, we can work out the structure that fits your needs together.

If you want to renew your website after the PHP vulnerability

The patch solves today's risk. If your site relies on an old PHP version, unmaintained plugins, or an infrastructure that is no longer supported, it may make sense to turn this update into a decision to renew. The order matters: update first, then plan. Rather than a hasty migration, a planned renewal on an infrastructure that preserves SEO value and is chosen to fit your requirements is healthier.

At Clockwork, we design and develop corporate websites; we work with processes certified to ISO 27001 and ISO 12207. We can evaluate your site's security requirements, infrastructure choice, and migration plan together with you.

Would you like to renew your site on an infrastructure that fits your security requirements? Take a look at our website design and development services or get in touch with us.

Conclusion

The step to take today on the PHP vulnerability is simple: find out your version, update if needed, and isolate if you can't update. The deeper questions, namely version inventory, maintenance responsibility, and infrastructure choice, are topics to handle with a clear head after the patch.

If you'd like to review your site's PHP version and maintenance routine together, get in touch with us. If you're thinking about renewing your website, take a look at the section above as well.