PHP2Shell: critical PHP flaws let attackers take over websites
Two flaws in PHP itself allow remote code execution without logging in. Attacks were seen before the fix came out.
What happened
On 21.10.2026 PHP released fixes for CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2). Details leaked early, and exploitation attempts were seen from 17.10.
Am I affected?
- Your website runs on PHP (WordPress, WooCommerce, PrestaShop, Joomla, most shared hosting)
- PHP version is below 8.5.12, 8.4.27, 8.3.36 or 8.2.35
- Or you are still on PHP 8.1 or older
What our daily plans do
Daily plans apply the PHP update on the day of release and confirm it in the next morning's report.
What you can do yourself
- Ask your hosting provider which PHP version your site runs
- Upgrade to a fixed version from the hosting control panel
- If you are on PHP 8.1 or older, plan an upgrade now