PHP2Shell: what to do now.

What happened

The PHP project released fixes early on 22 October, New Zealand time. Both flaws are rated 9.2 out of 10 for severity, and proof-of-concept attack code is circulating.

• Identifier: CVE-2026-109618

  Out-of-memory corruption

  A request that runs PHP out of memory at the wrong moment can leave half-built data behind, which an attacker can use to run their own code on the server.

• Identifier: CVE-2026-109619

  Stale state between requests

  An error at the wrong point can leave memory from one request in use by the next, which can also be turned into running code on the server.

• Status: Fixed in

  PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35

  Any earlier version in those lines is vulnerable. PHP 8.1 and older receive no official update.

Are you affected?

If your website runs on PHP, assume it is at risk until your hosting provider confirms PHP has been updated.

• WordPress, WooCommerce, Joomla, Drupal, Magento and most other self-hosted website and shop systems run on PHP.
• Every common way of running PHP is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
• PHP also turns up in booking systems, staff portals, firewalls and other devices, even where the main website does not use it.
• Sites on hosted builders, where the platform runs the servers for you, are the platform's responsibility. Check its status page.

What to do now

Most small businesses do not manage PHP themselves; the hosting provider does. Start there.

• Today

  Ask your hosting provider

  Ask whether PHP has been updated, and to which version. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

• If they cannot

  Take the site offline or reduce the risk

  The NCSC advises considering taking public-facing services offline until they can be patched. The PHP project lists temporary settings that reduce the risk, but they do not make a site safe.

• Older PHP

  Upgrade PHP 8.1 and older

  These versions need a fix from your hosting or Linux vendor, or an upgrade to a supported version. PHP 8.2 stops receiving security fixes on 31 December 2026.

• After patching

  Check for a break-in

  Updating does not remove an attacker who got in first. Look for admin accounts you do not recognise, changed files and unexpected redirects, and change your passwords.

• Also

  Ask your other suppliers

  The NCSC recommends checking with third-party suppliers whether they use PHP and need to act.

How Myola Digital can help

If you are not sure where your website stands, or your hosting provider is slow to answer, send the website address and I will take it from there.

• Cost: Free

  Exposure check

  A check from outside: what your site runs on, and whether it shows signs of an old PHP version, with your permission, and reported back in plain language.

  Some hosts hide the PHP version. If yours does, I will say so and tell you exactly what to ask them.

• Cost: Quoted

  Working with your hosting provider

  I talk to your hosting provider for you and confirm the update is in place.

• Cost: Quoted

  Updates

  PHP, WordPress and plugin updates, checked so the site still works afterwards.

• Cost: Quoted

  Break-in check and clean-up

  A look for signs of a compromise, then a clean-up or a rebuild if one is needed.

• Cost: By scope

  A website with no PHP to patch

  The site rebuilt as a fast static website with no PHP on the server, so flaws like these do not apply to it.

Sources

Advice changes as the vendors update theirs. These pages have the latest. This page was last checked on 23 October 2026.

• PHP security advisory, php.net, 21 October 2026.
• CVE-2026-109618 and CVE-2026-109619 affecting PHP, NCSC alert, 22 October 2026.
• NCSC encourages immediate patching against PHP vulnerability, NCSC, 22 October 2026.
• Today's PHP security release, The PHP Foundation, 21 October 2026.
• Critical Vulnerabilities in PHP, CERT-EU security advisory 2026-018, 21 October 2026.

If you think you have been attacked, you can also report it to the NCSC.