php2shell: What Website Owners Need to Do Now

Two serious flaws in PHP, the software behind almost 70% of websites including every WordPress site, were made public today, and any site running PHP should be treated as at risk until its PHP is updated. Attackers can use them to crash a site, run their own code on the server, or expose stored data, and Cloudflare reports it saw attack attempts before the official release. A web application firewall gives fast protection, but the lasting fix is updating PHP itself. Tierney Dynamics can help with both.

What happened

On October 21, 2026, researchers from Calif.io, Wiz, OpenAI, and Quarkslab disclosed two vulnerabilities in PHP, nicknamed php2shell. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) published an alert, and the National Security Agency (NSA) issued its own advisory recommending critical patches. Both agencies treat these flaws as urgent for internet-facing systems.

PHP is the programming language that runs a large share of the web. WordPress, Drupal, Joomla, and many custom business sites depend on it. Per the disclosure and the NSA advisory, the flaws can be triggered by specially crafted web traffic with no prior access or login, and a successful attack may let an outsider:

• take your website offline (denial of service)
• run their own commands on your server (remote code execution)
• read information stored on the server (data exposure)
• use a compromised web server as a foothold to move deeper into a network

The flaws come from how PHP handles memory when a web request goes wrong. A deliberately malformed request can leave PHP using data that was never set up properly or memory it has already released, and attackers can abuse that. Because the problem is in PHP itself—not in WordPress, a plugin, or a server setting—updating a website's code or plugins does not fix it. The NSA notes that cyber actors are likely to weaponize these vulnerabilities and that U.S. government systems are expected to patch immediately.

Is my website affected?

If your site runs on PHP, assume it is. The disclosure covers PHP 5.4 and later, which includes nearly every version still in use.

Not sure what your site runs on? These are the usual signs:

• It is built with WordPress, Drupal, Joomla, Magento, or another PHP platform.
• Page addresses end in .php.
• Your web host or developer can tell you the PHP version in a single email.

Sites built only with static HTML, or on non-PHP platforms such as ColdFusion, are not directly affected by these two flaws, though other software on the same server might be.

Old versions are the biggest worry. The PHP project released fixes only for versions 8.5, 8.4, 8.3, and 8.2. PHP 8.1 and older no longer receive updates from the project, so those sites need a fix from their Linux vendor or a move to a supported version.

What to do now

1. Inventory what runs PHP. The NSA and CISA both urge organizations to list internet-facing devices and services that depend on vulnerable PHP versions, including software that embeds PHP behind the scenes. Start with your main website, then ask your host or developer what else on the same account or server uses PHP.
2. Put a firewall in front of your site today. A web application firewall (WAF) screens incoming traffic and blocks known attack patterns before they reach your server. On October 21, Cloudflare turned on protection against php2shell by default for its customers, including free accounts, after preparing since early October. Using it means routing your domain through Cloudflare by pointing your DNS settings there, with no changes to the website itself. Customers on paid Cloudflare plans should also confirm their managed rules are switched on in block mode. A firewall adds a layer of defense but does not remove the flaw, so treat it as a temporary shield.
3. Update PHP itself. The flaws are in PHP, so updating WordPress, plugins, or themes alone will not fix them. The PHP project fixed both in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and says updating is the only safe choice. Watch for host and Linux vendor packages tied specifically to php2shell, as the NSA notes additional vendors may publish patches after the open-source release. If a hosting company manages PHP for you, ask them to apply it. Take a recent backup stored off the server first. Keep WordPress, plugins, and themes current as well, since outdated add-ons are a separate and common way in.
4. If you are on an older PHP, plan the upgrade—or take the site offline. PHP 8.1 and older no longer get updates from the project, so those sites need a vendor-supplied fix or a move to a supported version, which may need testing on older sites. The NSA recommends replacing end-of-life PHP services that cannot be patched, and both NSA and CISA say that if an immediate update is not feasible, take the system offline until it can be fully mitigated. PHP 8.2 reaches end of life on December 31, 2026, so choose your target version with that in mind.
5. Tighten settings if you cannot update right away. A developer or host can lower upload size limits and switch off certain PHP features to block some attack paths. The PHP project is clear that these steps do not make a server safe, and they do not replace the offline-or-patch guidance above.
6. Turn up logging and look for signs of a break-in. The NSA recommends enhanced logging in network and operational environments while patches roll out. Warning signs include admin accounts you do not recognize, unexpected .php files in your uploads folder, visitors being redirected elsewhere, unexplained traffic spikes, and PHP worker processes launching shells or downloading tools. If you find any, change passwords and restore from a known-clean backup.
7. Decide on the long-term fix. Many business sites do not need to run server-side code at all. A brochure-style site can often be rebuilt as a static site, which leaves far less for an attacker to target. The choice is usually between upgrading the server, rebuilding the site, or retiring it.

How Tierney Dynamics can help

Tierney Dynamics provides hosting, programming, and system administration for businesses that depend on their websites. For php2shell, we can:

• Check your exposure: your PHP version, platform, and plugins.
• Set up Cloudflare protection, including the DNS change, and walk through it with you on a screen-share.
• Update PHP, WordPress, and plugins on your current server, or move you to a modern hosting setup.
• Rebuild an aging site as a faster, safer static site.
• Scan for signs of a break-in and clean up if needed.

To get started, send us your website address through the contact form on tierneydynamics.com. We will tell you whether you are affected and what the safest next step is. Attackers were already probing for these flaws before the official release, so sooner is better.

Technical details

For IT staff and developers, the key facts as disclosed on October 21, 2026:

• Name: php2shell
• Identifiers: CVE-2026-109618 and CVE-2026-109619
• Severity: critical. The PHP project rated each 9.2 on the CVSS v4.0 scale and describes both as unauthenticated remote code execution.
• Disclosed by: Calif.io, Wiz, OpenAI, and Quarkslab, on October 21, 2026
• Affected: PHP 5.4 and later, on any setup that serves web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. The PHP project sees the highest risk with mod_php, where a request can trigger the attack before any application code runs.
• Impact: denial of service, remote code execution, and data exposure when an application processes specially crafted HTTP traffic
• Cause: unsafe memory handling when PHP hits an error mid-request. CVE-2026-109618 involves an out-of-memory interruption that leaves internal data uninitialized before cleanup. CVE-2026-109619 involves stale internal state that survives after its memory is freed, which a later request in the same worker can use.
• Fixed in: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35
• Older versions: PHP 8.1 and older receive no project updates. The PHP project published minimal source backports for 7.4, 8.0, and 8.1 for people who build from source, and some Linux vendors backport fixes.
• Mitigation: updating is the only complete fix. Configuration changes and WAF rules reduce exposure to specific attack paths but do not make an installation safe.

For affected versions and fixed releases, see the PHP advisory and your operating system or hosting vendor's notices.

Sources

• NSA advisory: critical patches recommended for PHP vulnerabilities
• CISA alert: critical vulnerabilities in PHP require immediate patching
• Cloudflare: Cloudflare deploys protections against php2shell vulnerability
• PHP security advisory, October 21, 2026