PHP Site AuditPHP security
PHP2Shell: what website owners need to know
PHP2Shell is a nickname for two critical vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619. The PHP project released fixes on October 21, 2026. Site owners should confirm the PHP runtime serving their web requests has a vendor-supported fix and that its workers have restarted.
Why this matters to a website owner
PHP runs on the server that builds or processes a website. The October 2026 flaws were in PHP's request handling, below applications such as WordPress, Drupal, Laravel, and Magento. A vulnerable internet-facing PHP runtime can therefore put different applications at risk; updating a CMS or plugin alone does not update the PHP engine.
PHP says the flaws can allow unauthenticated remote code execution. That describes a potential capability, not proof that a particular site was accessed or compromised. Treat the issue as urgent, but keep incident conclusions tied to logs and forensic evidence.
What to do
Ask the hosting provider or server administrator which PHP runtime and package serve the domain, whether the appropriate security fix is installed, and when all workers were restarted. PHP lists 8.5.12, 8.4.27, 8.3.36, and 8.2.35 as fixed releases. Distribution and long-term-support vendors may backport the fixes while retaining their own version numbering, so ask for the vendor advisory and package evidence before judging an older-looking version string.
PHP's October 23 informational advisory also recommends setting session.upload_progress.enabled=0 until the next regular bug-fix release. Its newly described CVE-2026-115560 scenario requires a rare combination of session configuration and runtime code. This additional setting is a risk reduction, not a substitute for applying the October 21 security fixes.
For a small business, write down who controls the hosting account, who can authorize a runtime change, and which domains share the same server. A simple ownership map prevents an urgent request from stopping at a designer who cannot see the web package or restart its workers.
What a public check can establish
A public website check can observe response headers, TLS behavior, and some technology clues. It usually cannot read the server's PHP package database, inspect every virtual host, prove the runtime configuration, or determine whether a host applied a backport. A hidden version banner is not proof of a fixed runtime; a visible old banner is a reason to ask for confirmation, not a reliable vulnerability verdict.
Common questions
Can a WordPress update fix a PHP-core flaw?
No. Application files and the PHP engine are separate update layers; ask the host to verify the runtime package too.
Does a vulnerability mean my site was hacked?
No. A vulnerability describes a possible attack path, while compromise requires system-specific evidence such as logs, files or account activity.
Can an outside scan verify the PHP2Shell patch?
It can report public response signals, but it cannot inspect server packages or prove a vendor backport.