In This Guide
By Harsimran (Harry) Singh, Director · CCNA R&S, ITIL 4, MCSA, ACS Certified Professional · Updated 22 October 2026
If you own a website — a WordPress site, a WooCommerce shop, a business site your nephew or an old web designer built — you may have seen headlines about a "critical PHP vulnerability" and wondered whether it's your problem. This guide is the calm, step-by-step version.
We're a local IT support business, not the PHP project, and everything below is stated as at 22 October 2026 from PHP's own advisory and the security vendors listed at the end.
1. What Happened (in One Paragraph)
On 21 October 2026, the PHP project released fixes for two critical security flaws, nicknamed "php2shell" (CVE-2026-109618 and CVE-2026-109619). Both are rated 9.2 out of 10 (CVSS v4.0, critical). Either one can allow unauthenticated remote code execution — in plain English, someone on the internet may be able to run their own code on the web server that hosts your website, without ever logging in.
The important part: this is a bug in PHP itself, the programming language behind WordPress, WooCommerce, Joomla, Drupal, Magento and most cPanel and Plesk hosting. It is not a fault in your plugin or theme, and keeping WordPress up to date does not remove it. The fix is a new PHP build installed on the server. PHP's own advice: there are no complete mitigations, updating is the only safe choice.
Researchers (Calif, via Tenable) say they confirmed the unauthenticated attack against specific versions of WordPress, Drupal, Joomla and Magento. The identifiers leaked on 20 October, before the planned disclosure, so PHP brought its release forward to 21 October 2026.
Security firms are reporting early attack attempts, and exploit code is circulating. Treat it as urgent. Cloudflare reports early attacks emerging and watchTowr reports exploitation attempts; Sophos had said it saw no confirmed in-the-wild exploitation, and the PHP Foundation said at release it had not identified a functional public exploit. Calm and quick is the right response — not panic.
2. Am I Affected?
You are affected if your website runs on PHP — which includes any WordPress or WooCommerce site, and most sites built on Joomla, Drupal or Magento. The flaw covers every way of serving PHP to the web: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP says the risk is highest for Apache mod_php.
| Your situation | Who installs the fix | What you do |
|---|---|---|
| WordPress, WooCommerce or similar on shared hosting (cPanel, Plesk, a managed WordPress plan) | Your web host | Confirm in writing that it's done, then check your PHP version yourself |
| Your own VPS, dedicated or cloud server | You or your IT provider | Update PHP through the package manager or control panel, then restart PHP-FPM / Apache / LiteSpeed — without a restart the old code keeps running |
| A site a web designer or relative built and you're not sure where it's hosted | Whoever hosts it | Find out who that is (the domain or hosting invoice usually shows it), then use the message further down |
| A site that doesn't run PHP at all (for example plain HTML pages) | — | This particular flaw isn't about your site. If you're unsure, ask whoever hosts it |
3. How to Check Your PHP Version
WordPress (easiest)
- Log in to your WordPress dashboard (usually yourwebsite.com.au/wp-admin).
- Go to Tools → Site Health, then click the Info tab.
- Open the Server section and find PHP version. Write down the full number, for example 8.3.30.
- Compare it with the table below. If the last number is lower than the fixed version for your branch, you are not patched yet.
cPanel hosting
Go to Software → Select PHP Version (CloudLinux) or MultiPHP Manager. This shows the branch (for example 8.4). The exact patch number (8.4.27) may only appear in a phpinfo page or from your host — so ask them.
Plesk hosting
Go to Websites & Domains → PHP Settings and read the PHP version.
php -vRunning php -v on the command line is not proof — the web server can use a different PHP build. Check through a phpinfo page (delete it straight afterwards) or ask your host. After updating, restart the PHP workers.
What counts as patched
| PHP branch | Fixed version | Notes |
|---|---|---|
| PHP 8.5 | 8.5.12 or newer | Supported |
| PHP 8.4 | 8.4.27 or newer | Supported |
| PHP 8.3 | 8.3.36 or newer | Supported |
| PHP 8.2 | 8.2.35 or newer | Reaches end of life on 31 December 2026 — plan a move to 8.3 or newer |
| PHP 8.1 and older | No official fixed release | End of life. PHP published minimal source backports for 7.4, 8.0 and 8.1 only (build-from-source). Some distributions and long-term-support vendors ship their own backported builds — ask yours. |
4. Who Fixes It — Your Host or You? (Message to Copy)
Managed or shared hosting: the host installs the fixed PHP build. Your own server: you or your IT provider do, then restart the PHP workers. Either way, ask first and verify afterwards.
On shared or managed hosting you usually can't patch PHP yourself — your host has to. So your job is to ask clearly, get an answer in writing, and then verify. Copy, paste and fill in the square brackets:
Subject: Urgent: PHP security update (php2shell) for my website [your domain]
Hi,
PHP published critical security fixes on 21 October 2026 for two vulnerabilities nicknamed "php2shell" (CVE-2026-109618 and CVE-2026-109619). My website is [your domain], account/username [if you know it]. Could you please tell me:
- Which PHP version, and exact patch build, is my site running right now?
- When will you install (or when did you install) PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor-supported fix if my site is on an older PHP branch?
- Have the PHP workers been restarted since the update was installed?
- What interim protection (for example WAF rules) is in place until then?
- Have you checked my account for signs of compromise?
Please reply in writing so I have a record. Thank you.
[Your name] · [Your phone number]
As at 22 October 2026, cPanel's EasyApache 4 fixed PHP builds have been released for all versions, Plesk Obsidian updates are available, and CloudLinux's alternative PHP builds are rolling out. That doesn't tell you whether your host has installed them yet — which is why you ask.
5. Signs Your Site May Already Be Compromised
Most sites will show nothing at all, and there is no need to assume the worst. But because exploit attempts are being reported, it's worth a calm check for these signs:
- New or unfamiliar files in your website folders, especially
.phpfiles inside the uploads folder - Admin users in WordPress that you didn't create
- Plugins you don't recognise, or unexpected scheduled tasks (cron jobs)
- Spam pages, strange redirects, or Google showing "This site may be hacked" (or a security issue in Search Console)
- A sudden spike in server load or outgoing traffic, or an email from your host about suspension
If you see any of them: don't just delete the odd file. Change your passwords first (hosting account, WordPress admins, database and SFTP), then restore from a clean backup if needed and scan the site — and only then patch PHP. Deleting one file while the door stays open usually means it comes back. In Australia you can report an incident and get advice from the Australian Cyber Security Centre (1300 CYBER1, or 1300 292 371).
6. Interim Protection While You Wait
None of this replaces the PHP update, but it lowers risk while you wait for your host.
Put your site behind Cloudflare protection
Cloudflare switched on protection rules for these flaws on all of its plans, including the entry-level plan — but only for traffic that actually passes through Cloudflare. In your Cloudflare DNS settings, your website's records need the orange cloud (Proxied). A grey cloud (DNS only) gets no protection at all. Some hosts also added their own web-application-firewall rules (CloudLinux's Imunify360 rulesets 8.83–8.85 block known exploit patterns, though CloudLinux notes no rule yet covers the out-of-memory path). A firewall is a stopgap, not a fix.
Check your backups work
Before anyone changes PHP versions on your site — and in case you ever need to roll back from a compromise — confirm you have a recent backup stored somewhere other than the website itself, and that it can actually be restored. Changing PHP branch can also break sites: settings such as memory_limit are set per PHP version and don't carry over, so back up first and test the site afterwards.
If you run your own server
These are partial measures for administrators, not a substitute for updating:
- CVE-2026-109618: set
memory_limit=-1in php.ini or the FPM pool (asphp_admin_value, so applications can't override it), use a lowpost_max_size(8M with no uploads, 32M with uploads), and use a container or cgroup memory limit as the availability boundary (not RLIMIT_AS or RLIMIT_DATA). - CVE-2026-109619: set
session.upload_progress.enabled=0in php.ini, the FPM pool or server config (not viaini_setor.user.ini); on PHP 8.5 also setfatal_error_backtraces=0; then restart all workers. - CERT-EU's advice is to consider isolating internet-facing applications until they're patched.
7. Want a Geek to Do It for You?
If this all sounds like a lot, it doesn't have to be. In a remote session we can:
- Check which PHP version your site is running and whether it's one of the fixed builds
- Contact your web host for you and chase a written answer to the five questions above
- Check your site for the signs of compromise listed earlier
- Help you switch on Cloudflare protection (and make sure the orange cloud is actually on)
- Make sure your backups exist, are stored off the site, and can be restored
Remote support is $125/hr and an onsite visit is $205/hr, with a one-hour minimum and no call-out fee. You'll know the cost before we start. If you'd rather have someone sit with you, onsite is $205/hr.
We can't install PHP on your host's server if you're on shared or managed hosting — only the host can — and we can't promise a site is untouched. We'll tell you honestly what we find.
Book Remote Support
$125/hr, one-hour minimum, no call-out fee. Tell us your website address and we'll start with the PHP version check.
Book HelpRunning a business with several sites, staff and email? Our business IT support and managed IT plans cover this kind of patching on an ongoing basis.
8. Not in Brisbane?
This guide is written for anyone in Australia, and the steps are the same wherever your site is hosted. If you'd like it with local help details, we've also written short versions for:
Sources
PHP security advisory, 21 October 2026 · PHP supported versions · Tenable — php2shell FAQ · Cloudflare — WAF protection for the PHP vulnerabilities · CloudLinux incident notice · Australian Cyber Security Centre (cyber.gov.au). Everything here is stated as at 22 October 2026 and may change as vendors release updates.