The PHP2Shell vulnerability is a critical flaw in PHP, the software that powers WordPress, Joomla and Drupal. It lets attackers run their own code on a web server without a password. Your site can be fully updated and still be exposed, because the weakness sits underneath WordPress and Joomla. Sentry Cyber is offering a free website security audit. It will show you if you are affected and what to do next.
This guide is written for business owners, not developers. First, you will learn what happened and who was affected. Then you will get a simple checklist to follow today. Finally, you will see how our free audit works.
PHP2Shell Vulnerability at a Glance
Here are the key facts in plain English.
- What it is: the PHP2Shell vulnerability covers two critical flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619.
- How serious it is: both score 9.2 out of 10 on the CVSS v4.0 scale.
- The risk: an attacker can run code on your server without logging in.
- Who is exposed: any website running PHP, including WordPress, WooCommerce, Joomla, Drupal and Magento.
- The fix: update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart it.
- The catch: updating WordPress, plugins or themes does not fix it.
The PHP project explains the details in its official PHP security advisory.
What Is the PHP2Shell Vulnerability?
PHP is the programming language that builds each page on your website. According to W3Techs, about seven in ten websites with a known server language use it. That is why one bug in PHP matters so much.
PHP2Shell is the nickname for two bugs in PHP itself. Both involve how PHP handles computer memory while it processes a web request. Attackers can abuse these bugs to make the server run commands of their choice. In many cases, they do not need a username or password. Experts call this type of attack remote code execution.
On Apache servers that use mod_php, an attack can start before any website code runs. Because of this, even a well-built site cannot protect itself there.
The PHP project gave advance notice on 20 October 2026. It released fixes on 21 October. However, details leaked online before the fixes arrived. By then, attack code had also appeared on GitHub. Amazon’s threat intelligence team recorded an attack attempt on 17 October, four days before the public fix. Still, the full number of successful break-ins is unclear.
Why Updating WordPress or Joomla Will Not Fix It
Think of PHP as the engine under your website. WordPress and Joomla are the body of the car. You can polish the body all day, but a faulty engine stays faulty.
Automattic, the company behind WordPress.com, made this point clearly. Researchers demonstrated attacks against current versions of WordPress, Drupal and Joomla. Updating core software, plugins or themes does not replace the PHP on your server. Instead, your hosting provider or IT team has to do that. Good WordPress security needs a patched server underneath.
Which Websites Face the Most Risk From the PHP2Shell Vulnerability?
Some sites need extra attention. Look closely if you run any of these:
- Online stores built on WooCommerce or Magento.
- Customer portals, booking systems and membership sites.
- Self-managed servers and VPS plans, where you or your developer must patch.
- Websites on PHP 8.1 or older, which no longer receive official fixes.
- Forgotten test or staging copies of your website.
Many large hosts patch shared plans for you. However, some are still rolling out fixes, so always confirm.
Which Organisations Were Hit by PHP2Shell?
The PHP2Shell vulnerability pushed many organisations to switch their sites off rather than risk an attack. Some said they had seen no sign of a break-in. Instead, they chose the safe option while they waited for the fix.
Australia’s Cyber Agency Took Its Website Offline
The Australian Cyber Security Centre issued a critical alert about the PHP2Shell vulnerability on 21 October. That night, iTWire reported that cyber.gov.au and other federal sites went offline. A spokesperson for the Home Affairs Minister told the ABC that some websites were temporarily unavailable. Teams were working to reduce the risk.
At the time of its first alert, the agency knew of no active exploitation. Then, on 22 October, it confirmed patches were available and urged organisations to apply them. You can find current guidance on the Australian Cyber Security Centre website.
Governments and Big Names Overseas
Overseas, the response to the PHP2Shell vulnerability looked similar. In the Netherlands, the national cyber security centre took its public sites offline. So did the Dutch government portal Overheid.nl. Finland, France and Germany also pulled some government sites or services as a precaution. Wikimedia shut down supporting services, and forums such as 4chan went offline while they waited for the patch.
So if governments with large IT teams switched sites off, a small business should take this seriously.
How to Check Whether the PHP2Shell Vulnerability
Affects Your Website
You can work through these five checks today. None of them needs deep technical skill.
- Find your PHP version. In WordPress, go to Tools, then Site Health, then Info, then Server.
- Compare it with the fixed versions: 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
- Ask your hosting provider to confirm in writing that the fix is installed and PHP has restarted.
- Back up your website, then test that you can restore the backup.
- Test your site for exposed weaknesses with a vulnerability assessment.
Why the Version Number Can Mislead You
Some hosts apply the fix without changing the version number you see. Others install the update but forget to restart PHP. Because of this, a written confirmation from your provider is worth more than a quick glance at a number.
What If You Run an Older PHP Version?
PHP 8.1 and earlier no longer receive updates from the PHP project. However, some hosting vendors supply their own backported fixes. The PHP team also published minimal source patches for versions 7.4, 8.0 and 8.1. Ask your provider which option applies to you. Otherwise, plan an upgrade now. Also note that PHP 8.2 reaches end of life on 31 December 2026.
Temporary Steps If You Cannot Patch Yet
PHP’s own team says only an update fully solves the problem. Even so, you can reduce exposure while you wait. On 23 October, PHP advised turning off session upload progress until its next regular release. For this, your host can set session.upload_progress.enabled to 0.
Security firm Sansec also warns that WordPress maintenance mode does not help, because the attack happens before WordPress loads. For a busy online store, a plain static page may be safer until the fix is in.
What to Do After You Patch
Patching is the first step, not the last. Use this short list to finish the job.
- Restart PHP and your web server, so the fix takes effect.
- Then review your logs for odd POST requests, memory errors and repeated PHP crashes.
- Also look for unexpected programs started by PHP, which can signal a break-in.
- If you suspect a break-in, rebuild the server and change every database password and API key.
- Finally, watch your inbox for scams that use the news as bait. Our cyber awareness training helps your team spot them.
Why change your passwords? PHP keeps your database login in memory while it runs. An attacker with code access can often read it. Therefore, a patched site can still carry risk from the PHP2Shell vulnerability if someone got in earlier.
How Our Free Audit Checks for the PHP2Shell Vulnerability
Sentry Cyber, an Australian cyber security company, offers a free security consultation and assessment. It runs for 30 minutes on a secure video call. You keep full control, because you share your screen and we guide you. You never hand over access.
Here is how it works:
- Book a time that suits you on our free security consultation page.
- Next, have your hosting and website admin logins ready.
- Then join the call and share your screen.
- After that, we assess your environment and web applications for exposure to the PHP2Shell vulnerability and other new security issues.
- Afterwards, you receive a high-level report in plain language.
- Finally, we give you clear guidance and recommendations to fix any problems.
You do not need any technical skills. We explain every finding in plain language, so you know exactly what to do next.
How Sentry Cyber Can Help Protect Your Website
An audit shows where you stand on the PHP2Shell vulnerability. After that, you may want deeper testing or ongoing protection. Our services cover each stage:
- Vulnerability assessment: finds known weaknesses, outdated software and exposed services.
- Penetration testing: safely tests whether attackers could exploit a weakness.
- Security assessment: reviews your wider environment and highlights areas that need attention.
- Cyber security monitoring: helps detect suspicious activity and emerging threats.
- Incident response: gives you expert help if you think someone got in.
- Essential Eight assessment: measures your patching and hardening against the ASD’s Essential Eight.
- AI security and risk assessment: helps you manage risks as AI speeds up both discovery and attack.
Speed matters more than ever. AI helped researchers find this flaw, and it also shortens the time attackers need to build exploits. Our guide to patch management and AI attacks explains why quick patching counts. Meanwhile, our article on the SME cyber security gap in Australia looks at the risks facing smaller businesses.
Need a longer-term plan? Our security consulting and compliance and certification teams can help.
Looking beyond your website? Download our free Google Workspace Security Playbook to tighten up email, files and accounts. A compromised website can also act as a stepping stone into the rest of your network. For that reason, it pays to protect those areas too.
Frequently Asked Questions About the PHP2Shell Vulnerability
What is the PHP2Shell vulnerability?
The PHP2Shell vulnerability is a pair of critical flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. They allow remote code execution, which means an attacker can run commands on your server. Both score 9.2 on the CVSS v4.0 scale. PHP released fixes on 21 October 2026, so patching is now possible.
Is my WordPress or Joomla website affected?
Yes, if your server runs a PHP version without the fix. WordPress, Joomla, Drupal and Magento all depend on PHP. However, many large hosts have already applied the fix, so ask yours to confirm.
Does updating WordPress fix the PHP2Shell vulnerability?
No. The flaw sits in PHP on your server, not in WordPress. Updating plugins, themes or WordPress core will not replace PHP. Instead, your hosting provider or IT team must install the PHP update.
Which PHP versions contain the fix?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 contain the official fixes. However, PHP 8.1 and older do not receive official updates. Some vendors offer backported fixes, so ask your provider.
Is the PHP2Shell vulnerability being exploited?
Yes, attempts have been reported. Amazon recorded one on 17 October, and other security firms report attacks too. However, the number of successful break-ins is still unclear. So assume attackers are scanning for vulnerable sites.
Do I need to take my website offline?
Not always. Many sites can patch quickly and stay online. However, if you cannot patch soon and your site holds customer data, consider a static maintenance page until the fix is in. Agencies including CERT-EU and the UK NCSC gave this advice for sites that cannot be patched.
Who can help me check my website for the PHP2Shell vulnerability?
Sentry Cyber is an Australian cyber security company that offers a free 30-minute security consultation and assessment. We check your website and web applications for exposure to the PHP2Shell vulnerability and other new issues. You then receive a high-level report and clear steps to fix any problems.
How much does the audit cost?
The consultation and assessment is free. Book yours through our free security consultation page.
Conclusion: Check Your Website Before Attackers Do
The PHP2Shell vulnerability shows how quickly a hidden flaw can become an emergency. Fixes exist, so your next step is to confirm that yours is installed. Do not assume your website is safe just because it runs normally.
So book your free 30-minute audit with Sentry Cyber today. We will show you whether this PHP security vulnerability affects you and what to fix first.