What is PHP2Shell?
On 21 October 2026 the PHP team released an urgent update for two security bugs. Researchers named the problem PHP2Shell. Through these bugs, someone can run their own code on a website's server without any login or password, and from there get to the data stored on the site.
The bugs had been sitting in PHP for more than ten years. They were found by researchers at the security companies Calif and Wiz, together with OpenAI, using AI tools that read code much faster than people can. Details leaked online a day before the official announcement, so the usual quiet window for site owners to update didn't really happen.
Security agencies in the US, Europe and Japan told site owners to update straight away, or to take their sites offline until they could. Japan's prime minister even posted about it on X. Soon after the update came out, working attack code appeared online, so this is not a "maybe someday" problem.
Is my WordPress or PrestaShop site affected?
It depends on what your website is built on. PHP runs on the server, behind the scenes, so the question is who looks after that server.
Not sure what your site runs on? Ask whoever built it, or send us the address and we'll tell you.
How to check your PHP version in WordPress and PrestaShop
WordPressSite Health
Log in to your WordPress dashboard and open:
PrestaShopBack office
Log in to your PrestaShop back office and open:
The PHP version is in the server information block.
Anything elseHosting panel
Most hosting panels show the PHP version too, usually in a section called "PHP version", "Select PHP Version" or similar.
PHP2Shell patch: what your version means
| Your version | What it means | What to do |
|---|---|---|
| 8.2.35, 8.3.36, 8.4.27, 8.5.12 or higher | The fix is already installed | Nothing. You can relax |
| 8.2, 8.3, 8.4 or 8.5, but a lower number | Right version, the fix isn't installed yet | Ask your hosting support or developer to update PHP today |
| 8.1 or older | These versions won't get a fix at all | Ask your developer to move the site to a newer version |
The small update inside a version (say, from 8.3.20 to 8.3.36) is usually installed by the hosting company on the server. You can't do it from WordPress. Almost every hosting has a support chat or a ticket form in your account, and one short message is enough.
Hi! Because of the PHP security update from 21 October (CVE-2026-109618 and CVE-2026-109619), could you please check that PHP on my site [your site address] is updated to the latest patched version? Thank you!
If someone else manages your site, send the same message to them.
If your site is very old
Sites that haven't been touched for years often run on PHP 8.1, 7.4 or even older. These versions are no longer supported, so there won't be an official fix for them.
Moving to a newer PHP version is the right move, but don't just switch it in the hosting panel yourself. Old themes and plugins can stop working on a new version, and the site can break. Ask a developer to check and update the plugins first, then switch.
If that can't happen quickly, the official advice from security agencies is to take the site offline for a short while. It sounds drastic, but a few hours offline is better than a hacked site and your clients' data in the wrong hands.
Old WordPress sites usually have more than one problem at once. If yours hasn't been updated in a long time, read 5 signs your website needs a redesign, sign 05 is about exactly this.
Watch out for scams
Scammers love big news like this. In the next weeks you may get emails like "Your website is at risk because of the PHP bug, log in here urgently" or "Pay to fix your site today".
Don't click links in these emails
Go to your hosting account or WordPress dashboard yourself, by typing the address.
Don't send passwords
Real hosting support never asks for your password by email.
Change passwords if a service asks you to
If a service you use announces it was affected and asks you to change your password, do it from its official site or app.