On October 21, 2026, the PHP project shipped emergency security updates for two critical flaws now nicknamed PHP2Shell. If your website runs on PHP, and that includes most WordPress, Joomla and Drupal sites, this one deserves your attention today.
What PHP2Shell is, in plain English
PHP is the programming language behind roughly 75 to 80 percent of websites, including every WordPress site. PHP2Shell is two separate bugs:
- CVE-2026-109618: remote code execution caused by memory corruption when PHP runs out of memory in the middle of a request.
- CVE-2026-109619: remote code execution caused by leftover data from one request being reused by the next one.
Both are rated 9.2 out of 10 in severity. In simple terms, an attacker can send one specially crafted web request to your site and, without logging in, run their own code on your server. That can mean a defaced site, stolen customer data, spam or malware served to your visitors, and a hit to your Google rankings.
Who is affected
Any server that uses PHP to handle web requests. That covers the common setups: Apache with mod_php (the highest risk), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. If your site is built on WordPress or another PHP platform, assume you are affected until you confirm your version.
How urgent is it
Very. Cloudflare and Amazon both say they are already seeing attacks in the wild, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the UK's National Cyber Security Centre (NCSC) are telling site owners to patch immediately.
The fix: safe PHP versions
Update to one of these versions or newer:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
PHP 8.1 and older no longer get regular updates from the PHP project. The PHP team published source-level backports for 7.4 through 8.1 and cPanel has pushed fixes for those versions too, but if you are still on one of them, plan the upgrade to 8.2 or newer.
What about GoDaddy hosting
As of October 22, GoDaddy says:
- Managed WordPress and Windows hosting: already patched, nothing to do.
- Web Hosting (shared cPanel plans): patches are rolling out, with temporary protections in place until they finish.
- VPS: you update PHP yourself, or pay GoDaddy's Expert Services to do it.
Other hosts are rolling out fixes on their own timelines, so check your host's status page.
How to check your PHP version
- WordPress: go to Tools, then Site Health, then Info, and open the Server section.
- cPanel: open Select PHP Version (sometimes called MultiPHP Manager).
Your action checklist
- Back up your site (files and database) before changing anything.
- Update PHP to a patched version above, or confirm your host already did.
- Remove unused PHP files and old installs. Old WordPress test sites, forgotten subfolders and unused scripts are easy targets.
- Check your host's status for the PHP2Shell fix, especially on shared or VPS plans.
- Update WordPress, themes and plugins while you are in there, so they work with newer PHP.
Static HTML sites: a quick note
If your website is plain HTML with no PHP, its pages are not directly exposed to PHP2Shell. On shared hosting PHP may still run on the server, though, so any PHP contact form, old install or hosting app in your account could still be a door in. It is worth a quick cleanup.
Need a hand?
Not sure what your site runs on, or do not want to touch your hosting settings yourself? Fouro Digital can check your site, confirm you are patched and clean up anything risky, so you can get back to running your business. Send your website address below and I will take a look.
Sources
- CISA: Critical Vulnerabilities in PHP Require Immediate Patching
- The PHP Foundation: Today's PHP security release
- BleepingComputer: PHP ships emergency patches for critical PHP2Shell flaws
- GoDaddy: Important PHP security update
Where to go next
More posts on the blog. If you want to know whether Google and AI assistants can currently find your business, there is a free ten minute check. Every price is on the pricing page.
Send me your website
I will look at it and tell you what I find, free, whether or not you hire me.
Mándame tu sitio y te digo qué encontré. Hablamos español.
Get a free look