Critical PHP Vulnerabilities (October 2026): What Website Owners Need to Do Now

Whats Happening?

If your website runs on PHP, and that includes almost every WordPress, Drupal and Joomla site, the server it runs on needs updating this week.

This accounts for over 70% of websites on the internet. On 21 October 2026 the PHP project released emergency fixes for two critical flaws that can let an attacker take over a web server without logging in while also stealing API keys and login tokens.

The flaws have been nicknamed PHP2Shell. Security companies report attackers are already scanning for vulnerable sites.

Updating your plugins or your CMS will not fix this: the problem is in PHP itself, the engine underneath your site.

If all this jargon is overwhelming, the key takeaway is simple: check your PHP version and update it immediately if it's not current, or contact a professional for assistance.

The short version:

• Make sure your site runs PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or newer), or a patched build from your host. ( In WordPress admin panel go to Tools > Site Health > Info > Server to check your PHP version.)
• If you're on PHP 8.1 or older, you need to upgrade or get a vendor patch. There is no official fix for those versions.
• After updating, PHP services must be restarted for the fix to take effect.
• On shared or managed hosting, your host does the update. Ask them to confirm it's done.

Quick checks you can do right now to see if you've been compromised

As this mostly affects WordPress sites I will deal with this first.

• In the control panel on the left hand side of the WordPress Dashboard, check in Users to see if any new admin accounts have been added without your knowledge.
• Review recent posts and pages for unexpected changes.
• Look for unknown plugins or themes that may have been installed.
• Download Wordfence and install the free version, or a similar security plugin and run a full scan to detect any malicious changes.

What are the vulnerabilities?

The bugs discovered deep inside PHP let a remote attacker run their own code on the server, with no password needed. PHP rates both 9.2 out of 10 (Critical); the US National Vulnerability Database scores them 9.8.

Is my site affected?

Hosted website builders like Wix, Squarespace and Weebly are generally not affected directly, as the hosting provider manages the PHP environment. However, you should still check with your provider to ensure they have applied the necessary updates.

• Squarespace
• Wix
• Shopify (built on Ruby on Rails)
• Webflow
• HubSpot CMS
• Ghost (Node.js; can also be self-hosted)

If your website runs on any of the following you need to contact you host or web server administrator immediately:

Content management systems

• WordPress, plus everything built on it: WooCommerce shops, Divi and Elementor sites, and membership or LMS plugins
• Drupal
• Joomla
• TYPO3
• Concrete CMS
• Craft CMS
• Statamic
• Grav

E-commerce

• WooCommerce
• Magento / Adobe Commerce
• PrestaShop
• OpenCart

Assume your PHP installation is vulnerable unless your server already runs one of the fixed versions below. PHP says every installation that serves web requests is at risk.

The researchers say affected releases go back as far as PHP 5.4. Note too that PHP 8.2 reaches end of life on 31 December 2026, so sites on 8.2 should plan a move to 8.3 or newer soon after patching.

Check with your hosting provider

• See Blacknight Hosting updates on patching

• Lets Host Ireland

• Register 365

What to do now: a step-by-step guide

Work through these in order. Steps 1 to 3 apply to everyone; steps 4 to 7 matter most if you manage your own server.

If you dont know what to do contact a professional web developer or your hosting provider for guidance.

1. Find out which PHP version your site uses. Log into your Wordpress Admin page. In WordPress, go to Tools → Site Health → Info → Server. In cPanel, look under MultiPHP Manager or Select PHP Version. Note the full number, e.g. 8.3.36, not just 8.3.
2. If you're on shared or managed hosting, contact your host. They update PHP at server level, not you. Ask them directly: "Have you deployed PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 or a patched build, and restarted PHP?" Get a yes in writing.
3. If you're on PHP 8.1 or older, upgrade. Switch to PHP 8.3 or 8.4 in your hosting panel, after taking a full backup and testing the site on a staging copy if you can. Old themes and plugins sometimes break on newer PHP, so check the front end, forms and checkout afterwards.
4. If you run your own server (VPS or dedicated), patch and restart. Install the fixed PHP release or your Linux distribution's patched package, then restart Apache, PHP-FPM and any long-running PHP workers. Without the restart, the old vulnerable code stays loaded in memory.
5. Secure your accounts and server. Change passwords and turn on 2fa (two-factor authentication) wherever possible. Limit access to the server and sensitive areas of your site, and consider using a web application firewall to block malicious traffic.
6. Check for signs of compromise. Look back from 17 October onward for unexplained PHP crashes, repeated HTTP 500 errors, new admin users, unfamiliar files in your web root, or PHP processes launching shells. A clean result is not proof, because one flaw can leak data without leaving obvious traces.

Extra checks for WordPress, Drupal and Joomla sites

The biggest misconception this week is that clicking "Update all" in your dashboard protects you. It doesn't: CMS, theme and plugin updates don't change the PHP version underneath. Do these alongside the steps above.

• Confirm the PHP version in Site Health (WordPress) or Reports → Status report (Drupal) shows a fixed release.
• Review the user list for administrator accounts you don't recognise.
• Scan the site with your security plugin (e.g. Wordfence, Patchstack, Sucuri) and look for recently modified core files.
• Check wp-content/uploads (or your CMS's upload folder) for .php files, which shouldn't be there.
• Make sure you have a recent off-server backup, taken before any upgrade.
• Keep your CMS, themes and plugins up to date anyway, as normal good practice.

Still on PHP 8.1, 8.0 or 7.4?

The PHP project no longer issues releases for these versions, so there's no official update to install. You have three options, in order of preference:

1. Upgrade to a supported version (8.3 or 8.4). This is the real fix, and it brings speed and security gains too. Test on a staging copy first.
2. Use a vendor-backported patch. Check if your host is patching older versions of PHP.

Staying protected after this week

Make sure to keep your WordPress or other installation up to date, and regularly check for PHP updates from your host. Hire someone to carry out regular website maintenance tasks to protect your site from high jacking and malware.

PHP2Shell is serious, but it isn't the only PHP security issue in 2026. PHP shipped security fixes in July (8.2.32, 8.3.32, 8.4.23, 8.5.8, for CVE-2026-12184 and CVE-2026-14355) and again in September (8.2.34, 8.3.35, 8.4.26, 8.5.11). Sites that fall behind on PHP updates pile up risk quietly.

What can website maintainers help you with?

• Stay on a supported PHP version. Check php.net's supported versions page once a year and plan upgrades before end of life.
• Choose a host that patches fast and tells you when it has. This week is a good test.
• Put a web application firewall in front of your site. It won't replace patching, but it can block known attack patterns while you update.
• Keep tested, off-server backups so a compromised site can be restored quickly.
• Monitor your site: uptime alerts, file-change alerts and a security plugin catch problems early.
• Don't store more secrets on the server than you need, and rotate API keys periodically.

If you'd rather not keep track of all this yourself, a website care plan covers PHP version checks, updates, backups and security monitoring as routine.

Sources

• PHP security advisory: critical remote code execution vulnerabilities (php.net, 21 Oct 2026)
• GHSA-w8hw-w9fx-j79w (CVE-2026-109618) and GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) (PHP on GitHub)
• PHP Foundation: Today's PHP security release
• PHP2Shell researcher disclosure (Wiz Research, OpenAI Codex Security, Calif)
• Rescana: Two critical PHP vulnerabilities fixed
• Simon Willison: Today's PHP security release
• CISA alert, UK NCSC, CERT-EU 2026-018
• Help Net Security: critical PHP security release
• CraftedSignal: July 2026 PHP vulnerabilities