What is PHP2Shell?
PHP2Shell is the name given to two critical security flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. PHP is the programming language behind WordPress, Joomla, many online shops and a large share of small business websites hosted on shared hosting plans.
The flaws let an attacker run their own code on a web server without logging in. In practice that can mean a hacked website, spam pages added to your site, customer data exposed, or your server quietly used for someone else's purposes. Security researchers have already seen the flaws being used in real attacks.
Which websites are affected?
Almost every PHP version from 5.4 up to 8.5 is affected unless it has been updated since 21 October 2026. If your website runs on WordPress, it runs on PHP, so it is worth checking today.
Safe versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or newer.
PHP 8.1 and anything older will not receive a fix, because those versions are no longer supported. If your site is on one of them, it needs moving to a supported version.
How to check your website in seconds
Use our free PHP2Shell checker. Enter your website address and it tells you whether your site runs on PHP, and if your server shows its PHP version, whether that version is patched.
Many well-run servers hide their PHP version, which is good practice. If the checker says your version is hidden, you can confirm it yourself in a minute.
In WordPress: go to Tools, then Site Health, then the Info tab, and open the Server section. It shows your PHP version.
In cPanel or Plesk: look for "Select PHP Version", "MultiPHP Manager" or "PHP Settings".
Or ask your hosting company: "Is our PHP updated for PHP2Shell (CVE-2026-109618)?" A good host will already have done it or will tell you when.
What to do if your site is affected
Update PHP to a fixed version. On most hosting plans this is a setting in your control panel, and many hosts are updating their servers for you. Take a backup first, and check your site afterwards, because older plugins and themes sometimes break on a newer PHP version.
If your site is on PHP 8.1 or older, plan the move to 8.3 or 8.4 now. Running an unsupported version means the next flaw will not be fixed either.
If you suspect your site has already been tampered with, for example strange pages in Google, redirects you did not set up, or a warning from your host, speak to your host before anything else.
Why InstaWebsite sites are not affected
InstaWebsite sites do not run on PHP, so PHP2Shell does not apply to them, and there are no plugins for you to keep updated. We look after the hosting, security updates and certificates as part of the monthly plan.
If you are tired of WordPress updates and security scares, see how a managed website works or check your current site first.