On 21 October 2026, the PHP team released unscheduled security updates. They fix two flaws that have become known as “PHP2Shell”: CVE-2026-109618 and CVE-2026-109619. Both are rated critical with a score of 9.2 out of 10. They allow an attacker to run their own code on the web server without logging in and, in the worst case, take over the entire website.
The details became public before the planned date. As a result, the first attack attempts took place before the updates were available. Several authorities and universities, including in Switzerland, took their websites offline as a precaution.
Who is affected
PHP powers a large share of all websites, so a very large number of systems are affected:
- websites built on WordPress, Joomla, TYPO3 or Drupal
- online shops using WooCommerce, Shopware, Magento or PrestaShop
- customer portals, booking systems and internal web applications
- web interfaces of PHP based software such as Nextcloud or webmail
Important: the flaw is in PHP itself, the software on the server. Updating WordPress or its plugins does not close it.
Which versions are safe
The problem is fixed in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 and later. For PHP 8.1 and all older versions, the PHP project no longer provides a fix. Anyone running such a version has to move to a current release or use a provider that backports security fixes to old versions.
After updating, all PHP processes must be restarted. Until then, the old vulnerable code remains loaded in memory.
What you should do now
- Ask your hosting provider. If your website is hosted externally, ask in writing whether PHP on your server has been updated and restarted, and which version is now running.
- Check the version. In WordPress, Tools → Site Health → Info shows the PHP version under “Server”.
- Update your own servers. If you run the web server yourself, install the operating system updates and restart PHP-FPM or the web server.
- Look for traces. Because attacks started before the update, patching alone is not enough. Check for unknown administrator accounts, new PHP files in upload folders or modified files.
- Change credentials. If you suspect a break in, change the passwords for the database, FTP, hosting and administrator accounts.
- Check your backup. Make sure a backup from before 20 October exists and can actually be restored.
How we help
For clients with a support contract, installing updates like these is part of ongoing maintenance. If we do not yet look after your website, we are happy to carry out the check at short notice:
- We find out which PHP version your website actually uses, including sites with an external hosting provider.
- We install the updates or coordinate them with your hosting provider.
- We examine files, user accounts and logs for traces of an attack and clean up the website if needed.
- For outdated systems, we plan the move to a current PHP version and test beforehand that your website, shop and plugins work with it.
Our own website a-bot.ch runs without PHP and was not affected by the flaw.
Call us or write to us using the contact form. If you suspect an attack, we will get back to you as quickly as possible. More about our services under IT security. To prepare for the next incident, read our article on the IT emergency plan.
Frequently asked questions
Is my WordPress website affected?
Probably yes, if the server uses a PHP version older than 8.2.35, 8.3.36, 8.4.27 or 8.5.12. WordPress itself is not faulty, but it runs on PHP. What matters is the PHP version on the server.
Is it enough that my hosting provider installed the update?
The update closes the flaw going forward. If the website was attacked before, a planted back door remains in place. Checking for traces is therefore worthwhile.
How can I tell whether my website has been taken over?
Typical signs are new administrator accounts, unknown PHP files in the upload folder, redirects to other sites, spam content or a sudden rise in outgoing email. Often, however, there are no visible signs.
What about PHP 7 or PHP 8.1?
These versions no longer receive security updates from the PHP project and remain vulnerable. Moving to a current version is urgent.
