Free tool · No signup

Am I affected by PHP2Shell?

A serious hole in PHP, the software behind a huge share of small business websites (including most WordPress sites), was announced on Oct 21, 2026. Type your website below and get a plain-English answer in about 10 seconds.

We only look at your public homepage, the same way any visitor's browser would. We send nothing harmful and don't store the address.

What happened, in plain words

No jargon, promise.

PHP is the programming language that runs a large part of the web, and WordPress is built on it. Two flaws, CVE-2026-109618 and CVE-2026-109619 (together nicknamed PHP2Shell), let a stranger take control of a server running an unpatched PHP, without a password. In technical terms: unauthenticated remote code execution in core PHP.

Fixed PHP versions came out on Oct 21, 2026: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Every earlier release is affected. PHP 8.1 and older are no longer supported by the PHP project, so they only get source backports, and fixes come through your host or Linux vendor if at all. The US cyber agency CISA put out an alert on Oct 21 saying to patch immediately, and reports of active attacks are emerging.

The fix is a PHP update, and it is your host's or developer's job, not something you do in WordPress. The email below makes that easy.

Email your host or developer

Copy this, or tap the button to open it in your email app. Fill in the brackets.

Open in my email app

If you run your own server

The steps from the CISA alert, in order.

Patch now. Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or the newest version of your branch), or install your Linux vendor's fixed package. Restart PHP-FPM, Apache or whatever serves PHP afterward.
Can't patch yet? Take it offline. If a PHP system can't be fixed right away, take it off the internet until it can.
Inventory your PHP. List every server, container and hosting account that runs PHP, and which version each one has. Forgotten old sites are the usual problem.
Watch your logs. Look for odd requests, new files you didn't create, and unexpected processes or outbound connections, from now on.
Report it. If you find signs of a break-in, report it at IC3.gov.

PHP 8.1 and older: no official release exists. Use your distro's backport (Ubuntu 22.04, 24.04, 26.04 and 26.10 shipped fixes on Oct 21; RHEL 8, 9 and 10 were still pending that day) or move to a supported PHP.

On the house

Want me to check it for you?

Leave your website and I'll check it for PHP2Shell, plus run a full security check-up and send you a plain-English report. If anything needs fixing, the report includes a quote, so you know what it would take. No pressure, no follow-up calls. Use it however you like.

Free tips

Get more AI and tech tips

One useful, plain-English tip for your business, now and then. No spam. Unsubscribe anytime.

Sources

Help Net Security: PHP2Shell, PHP vulnerabilities patched (CVE-2026-109618, CVE-2026-109619)
NCSC-NL: php2shell on GitHub
CISA alert, Oct 21, 2026: "Critical Vulnerabilities in PHP Require Immediate Patching" (see cisa.gov)

This is a quick outside check, not a security audit. It can't see your server's insides. Vendors can patch PHP without changing the version number your server shows, and a server can show a version that isn't the real one. When in doubt, ask your host.