PHP Vulnerability 2026: What Website Owners Should Do Now

Key takeaways

• Only a PHP update on the server fixes it. Four releases close both flaws, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, as the 21 October 2026 advisory on php.net explains.
• Both flaws are rated critical. GitHub's advisories give each a CVSS v4 score of 9.2 out of 10, and say an attacker needs no login to reach them.
• WordPress itself needs no update. WordPress.org points out that the flaws are not WordPress problems, and no WordPress release is needed or on the way. The server's PHP is what needs updating.
• Old PHP gets no official fix. 8.1 and everything before it is no longer maintained by the PHP project. For 7.4, 8.0 and 8.1 the project released just small source patches, leaving backports as a question for your vendor.
• Settings only reduce the risk. The workarounds PHP lists "do not make an installation safe". Only the update is a full fix.
• Most small business owners cannot do this alone. PHP lives on your host's server. Your job is to find out which version you run, ask the host to update it, and confirm it was done.

What happened

On 21 October 2026, php.net put a banner on its front page headed "Security advisory: Critical remote code execution vulnerabilities, update now". The text says that two critical PHP vulnerabilities may permit unauthenticated remote code execution, so a stranger could run commands on the server with no login.

Sources: php.net front page (21 October 2026) and the php-src GitHub advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp, read on 22 October 2026.

Headlines from The Hacker News and Wiz call the pair "PHP2Shell". That is a press name, not an official one, and the CVE numbers above are what you should quote to a host. A Hacker News headline on 21 October also says exploit attempts have emerged. We have not independently confirmed that, so treat it as a reason to move quickly and not as a measured fact.

Who is affected

php.net says the risk is to "all PHP installations serving web requests", including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates mod_php highest, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.

GitHub's advisories list as affected every release that sits under its branch's fixed number (8.2.35, 8.3.36, 8.4.27 or 8.5.12). The UK's National Cyber Security Centre goes further and says organisations using any version of PHP are affected, and should not limit their search to old versions.

What this means for the kinds of site people ask us about:

A notice from Webflow's Trust Center dated 21 October 2026 states that customers have nothing to do. Nothing turned up for Shopify, Wix, Squarespace or Framer on 22 October 2026. For those four the table row rests on how the setup works, with no quote behind it, so asking each one directly is the safe route. Our guide to Webflow security goes through Webflow's notice.

What to do, in this order

1. Find out if you run PHP. If your site is on WordPress, you do. WordPress shows the number in Site Health: use the Info tab and its Server block. WordPress.org gives this route. A lot of hosting control panels display it too.
2. Compare it with the fixed releases. The target is one of 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and a later point release in that line also works. Certain Linux hosts apply the fix to the old release without changing its number, so php.net says to read your vendor's package notes.
3. Put the question to your host in writing: is the fixed version running on your site, and if not, when will it be? Copy the wording from our list of questions for your host on the PHP security fix. Some hosts could already be applying patches or filtering traffic for you, WordPress.org notes.
4. If you control the version, update it. Back up first, update WordPress, themes and plugins, and test. For the walkthrough, open our guide on how to check and update PHP on a WordPress site.
5. If the version is 8.1 or older, move off it. There is no official fix. Your host may sell a backported fix or extended support, or you need a newer PHP.
6. Know what the NCSC says about waiting. Where neither an update nor the temporary measures can be done fast, its advice is to think about taking the system offline until it is mitigated. WordPress.org repeats this for servers you run yourself on PHP older than 8.2. For a shop that takes orders, that is a real cost, so decide it on purpose.
7. Check for compromise if the site stayed exposed. The NCSC advises checking for evidence of compromise and for backdoors before you upgrade. If you are not confident doing that yourself, it points to assured incident response providers, and WordPress.org has an FAQ on what to do if your site was hacked.

Settings PHP lists if you cannot update yet

These come from the php.net advisory. They apply to your server's configuration, so they are for whoever manages it, and they should be applied in php.ini, the FPM pool or the web server configuration. The advisory cautions that an installation is not made safe by them.

Do not set a hard operating-system memory cap as a substitute. The advisory specifically says RLIMIT_AS and RLIMIT_DATA can cause the vulnerable allocation failure.

What is still unclear

• Real-world attacks. The reports we could read were headlines. We have no verified count of hacked sites, and the numbers circulating will change over the next days.
• Your host's status. Hosts patch on their own timetable. A host can say "done" for new accounts while an old plan still runs an older PHP.
• Version strings. A distribution can fix the bug and keep the old number, so a version check alone can mislead. Ask for confirmation, not only a number.
• Plugins. Neither WordPress.org nor PHP says plugins make the flaws better or worse. The risk sits below the plugin layer, so cleaning up plugins does not replace the update.

What it means for how you run a website

A PHP site needs someone to keep PHP, the CMS and the plugins current, and to answer on the day a flaw like this lands. Owning a WordPress site includes this, and it appears as a line in our guide to website maintenance costs. When choosing a platform, count this recurring effort. See the Webflow versus WordPress comparison for service businesses and the WordPress cost guide. What a PHP-free site looks like day to day is shown in our write-up on moving amariq.com off Webflow to a static site).

This is not a reason to panic-move a site. A well-kept WordPress site on a host that updates quickly is fine. It is a reason to know who owns the update. Related reading: RCE explained, PHP end of life, hacked WordPress sites, firewalls versus updates and WooCommerce shop advice.

Want to go further? Read how Wix, Squarespace and Shopify fare with the PHP flaw, what to do when a critical error appears after a PHP update, a comparison of PHP 8.3, 8.4 and 8.5, the question of who must carry out PHP updates, and whether WordPress handles PHP updates on its own.

How we help

Our team at Amariq creates and looks after WordPress, Webflow and Framer sites. On WordPress sites we limit plugins to reputable ones, apply updates carefully, keep backups and test ahead of a PHP change, and maintenance can include all of that. Details sit on our WordPress development and Webflow maintenance pages. Should you prefer to be free of PHP entirely, Webflow migration carries a WordPress site over and protects its URLs and rankings. Pricing follows each project's scope. Once the last payment is made, the files, text and design belong to you, and domain, hosting and analytics logins remain under your name. If you would rather hand the work over, read how to hire a PHP update safely, or ask for our PHP update service directly.

Frequently asked questions

What is PHP2Shell?

Press coverage and researchers apply it to the two PHP flaws patched on 21 October 2026, CVE-2026-109618 and CVE-2026-109619. The official names are the CVE numbers and the php.net advisory. Both allow unauthenticated remote code execution under the conditions the advisory describes.

Is my WordPress site affected?

If your host runs a PHP version below the fixed release for its branch, or a branch that has no fix, yes. WordPress.org says the flaws affect any server hosting a PHP application and that no WordPress update is needed. The fix is on the server.

Do I need to update WordPress?

Not for this. According to WordPress.org, nothing in WordPress needs updating for these issues, and nothing is planned. Still keep WordPress, themes and plugins up to date, and finish that before touching the PHP version.

Which PHP version should I be on?

Your own branch's fixed release is the floor, so 8.2.35, 8.3.36, 8.4.27 or 8.5.12. WordPress.org's current recommendation is PHP 8.3 or newer. Fixes from the PHP project have ended for 8.1 and earlier.

Can I protect my site without updating?

Only partly. The php.net settings listed earlier close off a few attack paths, but the advisory states that an installation is still not safe with them. Web application firewall rules at your host could add some cover, yet WordPress.org continues to advise owners to update.

Does this affect Webflow, Shopify or a static site?

The advisory is about servers that run PHP. No PHP serves the pages of a static site, and hosted builders operate their own servers. Webflow's Trust Center, writing on 21 October 2026, lists its core services as not affected. We found no statement from Shopify, Wix, Squarespace or Framer as of 22 October 2026, so put the question to them yourself.

Has my site already been hacked?

You cannot tell from the news alone. If your site was on an old PHP and stayed exposed, the NCSC advises checking for evidence of compromise and backdoors. Unexpected files, new admin users, odd redirects or a host warning are the signs to take seriously, and an incident response provider can help.