Have a website? A serious PHP flaw was found. Here's the one thing to do

On October 21, 2026, the PHP project released urgent fixes for two critical security flaws, nicknamed “PHP2Shell.” PHP is the behind-the-scenes software that runs most websites, including sites built with WordPress, Joomla and Drupal. The flaws can let an attacker take over a website's server by sending it a single specially made web request, with no password needed.

Why this one matters

• Both flaws are rated Critical (9.2 out of 10) by the PHP project.
• They affect every PHP installation that serves web pages, including all the common server setups (PHP-FPM, Apache mod_php, LiteSpeed and others).
• According to BleepingComputer, Cloudflare's CTO said the company was already seeing early attacks before the fixes came out, and the EU's cybersecurity service CERT-EU says early proof-of-concept attack code has begun to circulate.
• PHP's developers say updating is the only complete fix; temporary settings changes only reduce the risk.

The one thing to do: check your PHP version

Most people with a small website pay a hosting company (such as GoDaddy, Bluehost or Hostinger) to run it. Many hosts update PHP for you, but don't assume.

1. Log in to your hosting account and look for your PHP version (in cPanel it's under Software › MultiPHP Manager; other hosts may call it “PHP settings”). Note: this screen often shows only the series, like “8.3”, not the exact update number, so the surest check is to ask your host the question below.
2. The fixed versions are: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. A higher number in the same series (for example 8.3.37) is fine too.
3. Can't find it, or not sure? Contact your host's support and ask exactly this:

If someone else built or manages your site, forward them this page and ask them to confirm.

If your site runs PHP 8.1 or older

The PHP project no longer updates PHP 8.1 and older versions. Some hosting companies and Linux providers make their own fixes for old versions, so ask your host whether yours is covered. The safer choice is to ask your host to move your site to PHP 8.2 or newer. Older sites or plugins can break after a big PHP update, so make a backup first and check your site afterward, or ask whoever built it to do the upgrade.

Watch out for scam emails about this

Big security news brings scammers. You may get emails or calls saying “your website has been hacked” or “your site is vulnerable, pay us to fix it.”

• Don't click links or call numbers in those messages.
• Go to your hosting company directly, by typing its address yourself or using the number on your bill.
• Never give passwords or remote access to someone who contacted you out of the blue. It's the same trick as the fake virus pop-up scam.

Signs something may be wrong with your site

• Pages you didn't create, strange text or links, or your site sending visitors to other websites.
• New admin users you don't recognize in WordPress or your site's dashboard.
• A warning from your host, Google or your browser saying the site is unsafe.
• Customers saying your site looks odd or their browser warned them.

See any of these? Contact your host right away and tell them you're concerned about the October 2026 PHP flaws.

Sources

• PHP project: RCE via OOM corruption (CVE-2026-109618)
• PHP project: RCE via stale global state (CVE-2026-109619)
• PHP.net: 2026 news archive (release announcements)
• CERT-EU: Critical Vulnerabilities in PHP (advisory 2026-018)
• BleepingComputer: PHP ships emergency patches for critical PHP2Shell flaws
• cPanel: MultiPHP Manager