PHP2Shell is the name given to two serious security flaws in PHP, the software behind many websites. PHP released fixes on October 21, 2026.
If you own a website, ask your hosting company whether it has installed the fixes. If you only visit websites or use apps, their operators need to update their servers. You do not need to install PHP on your phone or computer.
Checked October 22, 2026. The table below shows the first versions that fixed these two flaws. Your host may offer a newer security update.
What is PHP?
PHP helps websites work behind the scenes. It can load a blog post, handle a form or get information from a database. It runs on the server: the computer that hosts the website. WordPress and many other website systems use it.
PHP2Shell affects PHP itself. A website may need a PHP update even when its themes and plugins are up to date. The researchers’ explanation of PHP2Shell describes the risks, which include attackers running their own code or reading private information on an affected server.
What are the two PHP security flaws?
The flaws have two reference numbers, which help website owners and hosting companies identify the right fixes:
- CVE-2026-109618: PHP can mishandle a request when it runs out of memory. An attacker may be able to use that mistake to run code on the server.
- CVE-2026-109619: PHP can keep using memory from an earlier request after it should have stopped. This can expose private information or let an attacker run code.
PHP rates both flaws as critical, with a severity score of 9.2 out of 10 under CVSS 4.0. Attackers may be able to use them without signing in. An affected website needs attention, but that does not mean it has already been hacked.
Who needs to do something?
| If you… | Your next step |
|---|---|
| Use a website or app | Check its official service notices. The operator handles the server update. |
| Own a WordPress site | Ask your hosting company to confirm that your site uses patched PHP software. |
| Manage your own server | Find every PHP installation, apply the fixes and restart the services that use PHP. |
| Use a product that includes PHP | Follow the product maker’s security update instructions. |
The UK’s National Cyber Security Centre advises checking all systems that use PHP. Start with those that people can reach over the internet. A fairly new PHP version can still need these fixes.
Which PHP versions include the fixes?
| PHP version family | First fixed release |
|---|---|
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |
Check the full number. Seeing “PHP 8.3” is not enough; the first standard PHP 8.3 release with these fixes is 8.3.36.
Some hosts and Linux providers add the fixes to their own PHP packages without changing the main version number. If your host has done this, ask it to confirm that its package fixes both CVEs. The official PHP security notice explains these options.
PHP 8.1 and older no longer get regular security updates from the PHP project. Some providers offer fixes for older versions, but you need to check with them. Also plan ahead if you use PHP 8.2: its security support ends on December 31, 2026, according to the PHP support schedule.
How to check PHP on a WordPress website
WordPress’s notice about these PHP flaws makes clear that PHP needs its own update. Updating WordPress alone will not install the fix.
- Check your PHP version. In WordPress, open Tools → Site Health → Info → Server. Look for “PHP version.” Your hosting panel may also show it.
- Ask your host about both flaws. Give it the two CVE numbers above. Ask whether the PHP software actually running your site has been patched.
- Back up your site before making changes. Include its files and database. Our guide to WordPress backups explains the options. If you need to move to a newer PHP version family, check that your themes and plugins work with it. The WordPress PHP upgrade guide covers that preparation.
- Install the fix and restart PHP. Your host should handle this on managed hosting. If you manage the server, follow your provider’s instructions and restart the services that run PHP so they use the updated software.
- Check that everything works. Confirm the update is active. Then try logging in, submitting forms and uploading files. Test checkout too if you run a shop. Repeat the checks for other sites or servers you manage.
Here is a message you can send your host: “Has the PHP software running my website been patched for CVE-2026-109618 and CVE-2026-109619? Have you restarted the services that use it? Please confirm the active PHP or package version.”
Will a firewall or security plugin fix it?
A firewall may block some attacks, but you still need the PHP update. Cloudflare says it has added PHP2Shell protections and seen attack traffic. It still tells customers to patch PHP.
A WordPress security plugin or a new password does not replace this server update. Temporary settings may reduce some risks, but PHP’s team says they do not cover every attack.
If your host cannot patch promptly, ask what protection it can provide in the meantime. The NCSC advises considering taking an affected system offline if temporary protections cannot be applied or would take too long.
Are the Pokémon app outages linked to PHP?
Pokémon Support’s October 21 emergency maintenance notice lists Pokémon HOME, Pokémon Champions and Pokémon Sleep as undergoing or scheduled for maintenance.
The notice does not name PHP as the cause or say that user data was stolen. Check that page and each game’s official accounts for updates. A service going offline can be a precaution; it is not proof of a hack.
What if your website has already been hacked?
A PHP update fixes these flaws, but it will not remove files or accounts an attacker may have left behind. Contact your host, save relevant logs and write down what happened and when.
Our guide to signs of a hacked WordPress site lists things to check. Follow WordPress’s recovery guidance if you suspect a break-in. A website that looks normal can still need investigation.
Frequently asked questions
Is PHP a virus?
No. PHP is software used to run websites. PHP2Shell is the name associated with these security flaws and the research into them.
Does updating WordPress fix PHP2Shell?
No. Your host must update the PHP software behind your site. Keep WordPress, themes and plugins up to date as well.
Is PHP 8.3 safe from these flaws?
The first standard fixed release is PHP 8.3.36. If your host uses an older number, ask whether its own package includes both fixes.
Do I need to install a patch on my phone?
You do not need to install PHP to use a website or app. Its operator needs to fix the server. Follow the service’s official notices.
Can I wait until my website stops working?
No. A website can work normally while using vulnerable PHP. Check with your host even if you have seen no errors.
Does this mean my data has been stolen?
No. A security flaw creates a risk; it does not prove a particular service was hacked. Affected services should publish their own updates about any confirmed incident.