PSA: Update anything PHP related as fast as possible

This is a quick one, but an important one. If you have a website, self-host something, or run things that are reachable from the internet, it's a good idea to take a look and see if any of them runs PHP.

On October 21, 2026, PHP released emergency fixes for two critical security problems, known as PHP2Shell. In plain words, an attacker can send a single request to a website and run their own code on the server. No login, no password, no plugin needed. Even CISA (the US cybersecurity agency) published an alert asking everyone to patch immediately.

I know that "update PHP" might not mean a lot to you, so let's break it down.

Why should you care?

PHP is the language that runs a huge part of the web. You may not know it, but if you use any of these, you are using PHP:

• WordPress (including WooCommerce stores)
• Drupal
• Joomla
• Most "one-click install" websites from hosting companies
• Many forums, wikis, booking systems and online shops

The problem is not in WordPress or in your plugins. It's in PHP itself, the "engine" underneath. So having WordPress fully updated does not protect you. The attack happens before WordPress even starts. Security researchers have already shown it working against clean, out-of-the-box WordPress, Drupal and Joomla sites.

What should you do?

It depends on how your site is hosted, so let's go through the most common cases.

If you use WordPress on a hosting company (shared hosting, managed WordPress)

This is most of you. The hosting company controls PHP, not you, so your job is to check and ask.

1. Go to your WordPress dashboard, then Tools > Site Health > Info > Server, and check the PHP version.
2. You are safe if it's 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or newer in the same line).
3. If it's lower, contact your hosting company today and ask: "Have you patched PHP2Shell (CVE-2026-109618 and CVE-2026-109619)?" PHP2Shell is the name given to these two problems, and the CVE numbers are their public IDs, so your host knows exactly what you mean. A good host will have an answer ready.
4. If your site is on PHP 8.1 or older, there is no official fix. Ask your host to move you to a supported version. Most hosting panels let you change the PHP version yourself in a few clicks.

If you manage your own server (VPS, Docker, home lab)

1. Update PHP to one of the versions above.
2. Restart everything that runs PHP (PHP-FPM, Apache, your containers). PHP-FPM is the service that runs PHP for your web server. Installing the update without restarting does nothing, because the old version is still the one running.
3. If you use Docker images, pull the new image and recreate the container. The old image keeps the old PHP.
4. If you are stuck on PHP 8.1 or older, this is the moment to upgrade. Those versions don't get security fixes anymore, so upgrading is the only fix.

If you have a device or panel with a web interface

Some routers, NAS boxes (network drives you keep at home or in the office), control panels (cPanel, Plesk) and other appliances use PHP behind the scenes. You can't update PHP there yourself, so check the vendor's website for a security update in the next few days and install it.

Is anyone being attacked already?

The short answer is that we don't know yet, but I would assume yes. The details leaked online a day before the official fix, so PHP had to rush the release. Some security companies say they are already seeing attack attempts, while others (including CISA) say they haven't confirmed real break-ins yet.

AI is making it faster to find issues like this, but remember that criminals have access to AI as well, so weaponizing these things is quite fast.

I wouldn't wait for confirmation. Once it's confirmed, automated tools will be scanning every website on the internet, including yours.

How do I know if I was hacked?

For most of you, your hosting company is in a better position to tell, so ask them. Here are a few things you can check yourself:

• New administrator users in WordPress that you didn't create
• Files in your site that you don't recognize
• Your site redirecting visitors to strange pages
• Warnings from Google Search Console or your host about malware

If you see any of these, contact your host and change your passwords after the site is cleaned and patched. Otherwise the attacker could see the new ones as well.

Final Thoughts

I don't usually write posts like this, but this one is serious enough that I wanted to make sure you knew. It takes 2 minutes to check your PHP version and 5 minutes to send an email to your hosting company. Please do it today.

And if you know someone with a WordPress site (a friend, a small business, a local association), send them this post. They are the people most likely to have no idea this is happening.

Keep safe out there.

Sources

• CISA: Critical Vulnerabilities in PHP Require Immediate Patching
• PHP: Security advisory, critical remote code execution vulnerabilities
• GitHub advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
• GitHub advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
• The Hacker News: PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws
• SecurityWeek: PHP2Shell, Mass Exploitation Looms for Leaked Critical PHP Flaws
• Huntress: PHP2Shell timeline and detection
• watchTowr: PHP2Shell FAQ
• Rapid7: CVE-2026-109618 and CVE-2026-109619

Photo by Compagnons on Unsplash