PHP2Shell: PHP and WordPress Fixes, Scanner and Help
Check PHP2Shell patch versions and get help in Slovenia: urgent PHP updates, WordPress repair after a PHP upgrade, WooCommerce fixes and migrations.
Preberite članek v slovenščini →
PHP2Shell security updates are available. If your business runs WordPress, WooCommerce or another PHP application, ask your hosting provider to confirm that the PHP runtime serving your website has been patched. Updating WordPress alone is insufficient: the vulnerable component is PHP itself. The first fixed upstream versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP security advisory, 21 October 2026.
Need someone to handle it? Flisko helps companies in Slovenia assess exposure, update PHP, repair WordPress sites that broke after a hosting upgrade and migrate hosting when needed. Request an urgent assessment, or start with the PHP2Shell website checker.
Checked: 21 October 2026. This guide uses the published PHP advisories and release notices. The Aikido PHP2Shell article raised the alarm during coordinated disclosure; the official fixes are now published.
What is PHP2Shell, and why does it matter?
PHP2Shell refers to two critical flaws in how PHP handles memory and request state. Both advisories carry a CVSS v4.0 severity score of 9.2:
- CVE-2026-109618: memory exhaustion can leave internal request data in an invalid state, potentially enabling remote code execution during cleanup. PHP advisory for CVE-2026-109618.
- CVE-2026-109619: a worker can retain references to memory from an earlier request and use them after that memory has been freed. Exploitability depends on the relevant application operations and configuration. PHP advisory for CVE-2026-109619.
Researchers demonstrated attacks against WordPress, Drupal and Joomla in controlled environments. Those examples do not establish that every installation is exploitable. The researchers' PHP2Shell overview also describes potential exposure of sensitive process memory. Treat an unverified PHP runtime as an urgent maintenance task, not as evidence that your business has already been breached.
Which PHP versions should you install?
Use the fixed release for your branch, or a newer security release from a trusted supported source. The table lists the first upstream releases containing the fixes; it is not a reason to install an older release when a newer one is available.
| Current PHP branch | First fixed upstream release | What to do |
|---|---|---|
| PHP 8.2 | 8.2.35 | Apply the patch and plan a supported upgrade. |
| PHP 8.3 | 8.3.36 | Update every runtime serving the application. |
| PHP 8.4 | 8.4.27 | Update and check the running workers. |
| PHP 8.5 | 8.5.12 | Update and test the application's important flows. |
| PHP 8.1 or older | Vendor-specific; no supported upstream release | Obtain explicit vendor patch evidence and plan migration. |
A version number alone can mislead. Distributions may backport a fix without changing the upstream version shown by PHP. For example, Ubuntu lists the fixed PHP 8.3 package for Ubuntu 24.04 as 8.3.6-0ubuntu0.24.04.13. Compare the complete installed package against the correct operating-system advisory. Ubuntu USN-8948-1.
PHP 8.1 and older are outside upstream support. PHP 8.2 security support ends on 31 December 2026, so a business still on 8.2 needs both an immediate patch and a longer-term upgrade plan. PHP support schedule.
Check your website for PHP2Shell
Start with our PHP2Shell checker for an initial review of public website signals and a manual PHP version comparison. Only check websites you own or are authorised to assess. This is a passive assessment: it does not attempt to exploit PHP or send a memory-exhaustion payload.
The result is a starting point, not a security certificate. A CDN, cache or hidden version header can make the server impossible to identify externally. A reported older version may include a vendor patch. Even a patched-looking version cannot establish whether every backend worker was restarted or whether an earlier compromise occurred. Confirm the result with the hosting provider or server administrator.
Start with the facts.
Check public PHP and WordPress signals. Or compare the runtime version confirmed by your host.
Enter a public address without secrets. We do not save results to a database; hashed IP and domain identifiers are used for rate limits. Your host sees an ordinary visit. Privacy policy.
What should a WordPress or WooCommerce owner do today?
Find the reported PHP version in Tools → Site Health → Info → Server. The hosting provider controls the server runtime; a WordPress administrator may not have permission to replace it. WordPress PHP update guidance.
Then assign one person to coordinate these tasks:
| Situation | Next action | Evidence to request |
|---|---|---|
| Managed or shared hosting | Ask the provider to verify both CVEs for your account and domains. | Installed package, advisory reference and confirmation that running workers use it. |
| VPS, dedicated server or containers | Have the administrator update all relevant runtimes and replace or restart affected processes. | Package or image version and post-update verification. |
| An old plugin breaks on newer PHP | Test compatibility on a staging copy; repair or replace the blocker. | Working forms, login, scheduled tasks and checkout where applicable. |
| The host cannot confirm a fix | Request a concrete remediation plan and assess a move to supported hosting. | Destination runtime, migration scope and a controlled cutover plan. |
| Unexpected files, users or redirects appear | Preserve logs and backups and request an incident assessment. | Findings and containment steps, separate from patch status. |
For a web shop, test an order from cart to confirmation, payment callbacks, stock updates and transactional email. For a lead-generation site, submit a real test enquiry and verify delivery. A page loading successfully is only one part of the acceptance check.
Do not consider a WAF rule or a configuration workaround a permanent fix. The PHP project states that configuration changes do not cover all attack paths. Have an administrator follow the current advisory while arranging the actual update. PHP remediation guidance.
WordPress broken after a PHP upgrade: what should you do?
If WordPress shows HTTP 500, a fatal error or a blank page after your host changes PHP, investigate the failure while keeping a patched runtime. Older plugins, themes and custom code can have compatibility problems on newer PHP. The error alone does not identify the cause or prove a PHP2Shell attack. WordPress guidance on PHP compatibility.
Our rescue process starts with the actual failure:
- Record the change and preserve data. Obtain the old and new PHP versions, the time of the change and relevant error logs. Take a current backup before editing; restoring an old shop database can erase newer orders.
- Reproduce on a staging copy. Identify whether a plugin, theme, custom code or server configuration causes the error. Apply a compatible update, repair the code or replace the unsupported component.
- Verify business functions before reopening. Test login, forms, scheduled jobs and, for WooCommerce, checkout, payment callbacks and order emails. Agree a controlled production change with the host.
If temporary rollback is necessary, the administrator must first verify that the target runtime contains fixes for both PHP2Shell CVEs, including any vendor backports. Reverting to an unpatched version simply trades an outage for exposure. A rebuild is an option when repair cannot produce a maintainable site; it is not the automatic next step.
Request WordPress or WooCommerce rescue after a PHP upgrade. Include the exact error and when it started.
PHP patching, WordPress repair or migration: which service fits?
An urgent assessment comes first. Flisko can review your hosting details, PHP package evidence, application dependencies and operational constraints. You receive a proposed scope and price before implementation. If your provider has already applied the correct fix and no compatibility problem remains, there may be no reason to migrate.
| Service | When it is useful | Scope we can agree |
|---|---|---|
| PHP2Shell assessment and remediation | The patch status is unknown or the administrator needs help. | Runtime inventory, vendor verification, update coordination and a written verification record. |
| WordPress and WooCommerce rescue or upgrade | The site broke after a PHP change, or old code blocks a supported release. | Error diagnosis, staging copy, compatibility fixes, backup plan and business-flow testing. |
| WordPress hosting migration | The current host cannot provide the required runtime or maintenance. | Transfer of files and database, DNS planning, TLS and cutover verification. |
| Legacy PHP application migration | A custom application depends on unsupported PHP. | Dependency review, code changes, deployment plan and acceptance checks. |
For migrations, we agree how to handle incoming orders and enquiries during cutover, redirects, existing URLs, analytics, email configuration and rollback. These details protect the business function of the website as well as its search visibility. A rollback must not silently leave an exposed old runtime serving traffic.
Request urgent PHP or WordPress help in Slovenia
Send the website address, hosting provider, PHP version if known, and whether the site takes orders, payments or bookings. Tell us whether you have a current backup and who manages the server. Do not send passwords, private keys or customer exports through the enquiry form; access can be arranged separately.
Request an urgent PHP2Shell assessment from Flisko. We will confirm availability, the proposed work and pricing before starting. You can also request help with a wider website security review.
Frequently asked questions
What is PHP2Shell?
PHP2Shell is the name used for two critical vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619. Depending on the runtime and configuration, they can enable remote code execution without an account. PHP security updates were released on 21 October 2026.
Which PHP versions fix PHP2Shell?
The first upstream fixed releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Install the current patched release for your supported branch, or a vendor package explicitly fixing both CVEs, and restart the relevant PHP services and workers.
Does updating WordPress fix PHP2Shell?
A WordPress update alone does not patch the PHP interpreter on your hosting server. Your hosting provider or server administrator must verify and update that runtime. Keep WordPress, plugins and themes maintained as a separate task.
What if WordPress stops working after a PHP upgrade?
Ask the host to confirm the running PHP version and review error logs, then test plugin, theme and custom-code compatibility on a staging copy. Do not blindly downgrade to an unpatched runtime. Flisko can assess the failure, repair compatibility and test important flows such as WooCommerce checkout before a controlled return to service.
Can an online PHP2Shell scanner prove my website is safe?
A passive website check cannot prove that PHP2Shell is exploitable, patched or absent. Headers may hide PHP versions, proxies can conceal the origin, and vendor packages may contain backported fixes. Verify the running server package and its vendor advisory.
Do I need to migrate away from WordPress?
PHP2Shell alone does not require replacing WordPress. A verified PHP security update may resolve the runtime issue. Migration becomes useful when the host cannot supply a supported patched runtime, or incompatible plugins and legacy code prevent a maintainable upgrade.
Who can help with PHP2Shell in Slovenia?
Flisko offers PHP2Shell assessments, PHP upgrades, WordPress and WooCommerce compatibility work, and hosting or application migrations for companies in Slovenia. Request an urgent assessment through the contact form on the PHP2Shell service page; scope, availability and price are agreed before work starts.