Website security
PHP2Shell: What the New PHP Security Flaw Means for Your Website
On October 21, 2026, the team behind PHP released emergency fixes for two critical security flaws now known as PHP2Shell. PHP is the software underneath WordPress, Joomla, Drupal and a large share of the web. On a server that hasn't been updated, these flaws can let an attacker take control of a website without logging in.
If your website runs on PHP, ask your hosting company or web developer today to confirm the fix is installed. Below: what happened, how to tell if your site is affected, what to do, and what we're doing at Alchemy Effect.
What happened
Security researchers found two flaws in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619. Wiz, one of the research teams, says every PHP version released in the last decade is affected by at least one of them. Because the problem is in PHP, not in a plugin or theme, a site can be exposed no matter which plugins it uses.
The PHP team released fixed versions on October 21, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged everyone to patch immediately.
Attacks have already started. Amazon's security team recorded a first attempt on October 17, four days before the flaws were announced, and broad attempts followed the patch release. Cloudflare reported millions of attack attempts within hours of the announcement.
Is your website affected?
Your website almost certainly runs on PHP if:
- it's built with WordPress (including WooCommerce stores), Joomla or Drupal
- your hosting control panel lets you choose a "PHP version"
- you run a website or web app on your own server or on a network storage device (NAS)
If your site is on a fully hosted website builder, where you never manage a server or choose a PHP version, the platform runs its own servers and it's the platform's job to apply the fix. Watch for its announcements.
Not sure? Send your web developer or hosting company this question:
Question for your host or developer
Does my website run on PHP? If it does, has PHP been updated to a version that fixes PHP2Shell (CVE-2026-109618 and CVE-2026-109619)? If not, when will it be?
What to do now
| Your setup | What to do |
|---|---|
| WordPress, Joomla or Drupal on a hosting plan | Ask your host to confirm PHP has been updated to a fixed version. |
| Your own server | Install the PHP update from your operating system's packages, then restart PHP so the new version is the one running. |
| A fully hosted website builder | Nothing to install. Follow the platform's announcements. |
| A Synology NAS | Update the PHP packages in Package Center (see below). |
- Confirm the update. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. On a hosting plan, your host installs them; ask them to confirm in writing.
- If your site runs an older PHP version, plan the upgrade now. PHP 8.1 and earlier no longer get regular updates. The PHP team released limited fixes for 7.4, 8.0 and 8.1, mainly for people who build PHP themselves, and versions older than 7.4 get no fix at all, according to Tenable.
- Can't update today? Ask your host what protection is in place in the meantime. If your site uses Cloudflare, its firewall rules for the known attacks are available on every plan, including the free one, but Cloudflare says they're no substitute for updating. CISA and the UK's National Cyber Security Centre advise taking a system offline if it can't be fixed right away.
- Change passwords after you update. Wiz says the flaws can also leak information from the server's memory, which can include passwords, tokens and access keys. If your site ran an unpatched version, change your admin passwords and any access keys stored on the site once it's updated, and turn on two-step verification.
- Ask your developer to check for signs of trouble since October 17. Amazon advises looking back to October 17, not just to the announcement. Warning signs include repeated server errors, memory errors after unusual upload requests, unusually large session cookies, and unexpected new or changed files. Normal website logs may show very little.
Updating WordPress, its theme or its plugins doesn't fix PHP2Shell. The fix is updating PHP itself.
If you have a Synology NAS
Synology says the PHP built into its operating system, DSM, can't be reached from outside, so the risk there is very low. The apps that use PHP are the ones to update: Web Station, WordPress, Joomla, MediaWiki, phpMyAdmin, Synology Calendar, Mail Station and a few others. Synology Drive isn't affected.
- Open Package Center → Installed and update any PHP package. The apps that depend on it restart on their own.
- Update Mail Station separately, if you have it.
- PHP 7.3 gets no fix. If nothing needs it, remove it.
- If you run apps in Container Manager, each container carries its own software, so update any PHP-based container too.
The fixed package versions are in Synology's security advisory.
What we're doing at Alchemy Effect
The websites we build and care for run on fully hosted platforms that manage their own servers, and they don't include PHP code of our own. We're still not taking that for granted:
- We're updating our own server.
- We're confirming with the platforms that host our clients' websites that the fixes are in place.
- We're emailing every client directly about what this means for their website.
If you're one of our clients, there's nothing you need to do for the website we manage for you. Watch for our email, and reply to it with any questions.
Frequently asked questions
What is PHP2Shell?
PHP2Shell is the name for two critical flaws in PHP, CVE-2026-109618 and CVE-2026-109619, fixed on October 21, 2026. On a server that hasn't been updated, they can let an attacker run their own code without logging in.
Is my WordPress site at risk?
It depends on the PHP version your host runs. WordPress runs on PHP, and researchers showed working attacks against WordPress, Drupal and Joomla on unpatched PHP. Ask your host to confirm PHP is on a fixed version.
Is updating WordPress enough?
No. The flaw is in PHP, the software WordPress runs on, so PHP itself has to be updated. Keeping WordPress, its theme and its plugins current is still good practice.
My website is on a website builder. Do I need to do anything?
If you never manage a server or choose a PHP version, the platform runs its own servers and applies the fix. Follow its announcements, and keep two-step verification turned on for your account.
Has PHP2Shell been used in real attacks?
Yes. Amazon recorded an attempt on October 17, four days before the flaws were announced, and broad attempts followed the patch release on October 21.
Not sure what your website runs on? Contact us and we'll help you find out.
Updated October 24, 2026. We'll keep this page current as the fixes and guidance change.