PHP2Shell: two critical PHP flaws under attack, update now
Two flaws in PHP let attackers take over a server without logging in. Fixed on 21 October 2026. Who is affected, how to check, what to do.
Affects:PHP 8.2 to 8.5 before 21 OctPHP 8.1 and olderWordPress and WooCommerce
On 21 October 2026, the PHP project released urgent security updates for two critical flaws in PHP itself, the programming language that runs WordPress, WooCommerce and most small-business websites. Security researchers call the pair "PHP2Shell". Both let an attacker run their own code on the server without logging in.
Security firms and hosting companies report attacks already under way, some starting before the fix was published. php.net's own advice is plain: all PHP users are strongly encouraged to update immediately.
Who is affected
Any website running PHP on a version older than the fixed releases:
| PHP branch | Fixed in |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
| 8.1 and older | No official fix |
That includes WordPress and WooCommerce sites, and other PHP software. Your plugins and theme don't matter here: the flaw is in PHP, underneath them.
PHP 8.1 and older no longer receive fixes from the PHP project. Some hosts and Linux distributions patch older versions themselves, but you can't assume yours does.
How to check your site
- In WordPress: go to Tools, then Site Health, then the Info tab, and open Server. The PHP version is listed there.
- In your hosting panel: cPanel, Plesk and most hosts show the PHP version per site, often under "PHP version" or "PHP settings".
- Ask your host: if you can't find it, ask your hosting support which PHP version your site runs and whether it already includes the 21 October fixes.
What to do now
- Update PHP to a fixed version. On most shared hosting, your host updates PHP for you or lets you switch versions in the panel. Ask them to confirm it's done.
- If you're on PHP 8.1 or older, move to a supported version. Take a full backup first, then test the site on the new version (many hosts offer a staging copy). Old plugins can break on newer PHP, which is a reason to check them anyway.
- Don't rely on a settings change. Researchers report that configuration tweaks don't fully block these attacks. Updating is the only complete fix.
- Check for signs of a break-in. Look for administrator accounts you don't recognise, plugins or files you didn't add, and unexpected changes to your pages. If something looks wrong, restore a clean backup from before 21 October and change all passwords.
Also from php.net
On 23 October, php.net published a separate, smaller advisory about the "session upload progress" feature. Until the next regular PHP update, it suggests switching that feature off (session.upload_progress.enabled=0). Most WordPress sites don't use it. If you manage your own server, it's a quick change; if you're on shared hosting, your host decides.
This alert reports what php.net and security researchers have published. It isn't a guarantee that your site is or isn't affected: only checking your PHP version tells you that.