PHP2Shell: What Indian Website Owners Must Patch Now

PHP2Shell is the name for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, that were disclosed and patched on 21 October 2026. They can let an attacker run code on a web server with a single request, without logging in. If your website runs on PHP, which includes every WordPress site, update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now.

This matters a lot in India, where lakhs of small business sites, blogs and online shops sit on shared hosting and nobody checks the PHP version for years. Here is what the bug does, how to check your site in five minutes, and what to tell your hosting company.

What is PHP2Shell

PHP2Shell covers two separate memory bugs in PHP itself, not in any one plugin or app. According to Help Net Security, the details are:

Also readWordPress Site Hacked? A Step-by-Step Recovery Checklist

• CVE-2026-109618: if PHP runs out of memory in the middle of a request, some internal data can be left half set up. The cleanup step can then treat that broken data as valid.
• CVE-2026-109619: some internal state from one request can survive after its memory is freed. A later request handled by the same worker can use that stale state.

A working exploit has already been shown. It needs just one unauthenticated request, and it fires before your website code even runs. That is why a fully updated WordPress install with good plugins is still at risk if the PHP underneath is old.

Who is affected

Any server where PHP handles web requests is in scope. That includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Setups that use mod_php face the highest risk.

In practice, this covers most shared hosting plans in India, cPanel and Plesk servers, and self-managed VPS machines running WordPress, WooCommerce, Joomla, Drupal, Laravel or custom PHP code.

Is it being exploited already?

Yes, at least in early attempts. Amazon Threat Intelligence says its honeypot network recorded a PHP2Shell exploit attempt on 17 October 2026, four days before the public disclosure. The UK’s National Cyber Security Centre has advised organisations to consider taking any system offline if it cannot be patched quickly.

Fixed PHP versions

Note the version number, not just the branch. “PHP 8.5” on your hosting panel is not enough if it is still 8.5.11 underneath.

How to check your PHP version in five minutes

1. WordPress Site Health: go to Tools, then Site Health, then the Info tab, and open the Server section. The exact PHP version is listed there.
2. Hosting panel: in hPanel, cPanel or Plesk, open the PHP settings or PHP version page for your domain. Look for the full number, such as 8.3.36.
3. Response header: many servers show the version in the X-Powered-By header. Your developer can check it with the browser’s developer tools under the Network tab.

If you run more than one website, check each one. On our own network of sites, we found domains on the same hosting account sitting on different PHP versions.

What to do if your site is on an old version

• Shared hosting: switch to the latest PHP branch your host offers, then confirm the full version number. If the patched build is not available yet, raise a ticket (sample text below).
• VPS or dedicated server: install the patched packages from your Linux distribution or panel. Plesk and cPanel users should update PHP from the panel’s installer, then restart PHP-FPM.
• Use Cloudflare as a stopgap: Cloudflare has deployed WAF rules for known PHP2Shell attack patterns for all customers, including the free plan. This buys time but does not replace the update.
• Test your site after the switch: open the home page, an article, the contact form and the checkout if you have one. Old plugins sometimes break on newer PHP.

Researchers at Searchlight Cyber have also released an open-source tool, php2shell-scanner, that tests whether a host is exposed. Ask your developer to run it rather than trying it yourself on a live server.

Message to send your hosting company

“Hi, please confirm that the PHP version on my account has been patched for PHP2Shell (CVE-2026-109618 and CVE-2026-109619). The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. My domain is [your domain] and it currently shows PHP [your version]. Please share the date by which the patched build will be available.”

Also check these while you are at it

An old PHP version is often a sign that the rest of the site has been ignored too. Update WordPress core, themes and plugins, remove plugins you no longer use, and check the user list for admin accounts you do not recognise. If you suspect your site is already compromised, follow our WordPress hack recovery checklist. For personal accounts, our guide on securing your digital footprint covers the basics.

The fix for PHP2Shell is a version update that takes a few minutes on most hosting plans. The cost of skipping it is a hacked site, spam pages in Google and days of cleanup. Check the number today.