On October 21, 2026, one of the most widely used technologies on the internet received an emergency security fix.
PHP, the programming language behind an estimated 70% of websites, was patched for two critical flaws that could let attackers take over a server without a password. Within hours, working exploits were circulating.
If your website runs on WordPress, Drupal, Laravel or any custom PHP application, this affects you. CISA, the FBI, the NSA and the UK’s National Cyber Security Centre have all urged organizations to patch immediately.
This guide explains what PHP2Shell is, how to tell whether your site is exposed, and exactly what to do next.
It is written in plain language you can share with your developer, your hosting provider or your leadership team.
Quick answer
PHP2Shell is the nickname for two critical PHP vulnerabilities, fixed on October 21, 2026, that let attackers run their own code on a web server without logging in. Both are rated 9.2 out of 10 for severity and sit in PHP itself, not in your website’s code. Any WordPress, Drupal or Laravel site on an unpatched PHP server is exposed. Update PHP now, then review your logs back to October 17.
PHP2Shell at a glance
| Question | Answer |
|---|---|
| What is it? | Two critical PHP flaws that allow unauthenticated remote code execution |
| How severe is it? | 9.2 out of 10 |
| When was the fix released? | October 21, 2026 |
| Is it being exploited? | Yes. Amazon Threat Intelligence reports broad exploitation in the wild |
| Who is affected? | Any server running an affected, unpatched PHP version. W3Techs estimates nearly 70% of websites use PHP |
| What is the fix? | Update PHP. Temporary workarounds only reduce exposure |
| Who is warning about it? | CISA, the FBI, the NSA and the UK National Cyber Security Centre |
| How far back should I check logs? | October 17, 2026 |
What is the PHP2Shell vulnerability?
PHP2Shell is the nickname for a set of critical flaws in PHP, the programming language behind an estimated 70% of websites.
The flaws allow unauthenticated remote code execution.
That means an attacker can run commands on a vulnerable server over the internet with no username or password.
According to the NSA, a successful attack could help criminals steal sensitive data, disrupt services or move deeper into a company’s network.
The PHP development team released the fix on October 21, 2026.
Is my website affected by the PHP vulnerability?
Yes, if your website runs on a server with an affected PHP version that has not been updated.
The NSA stresses that the flaws are in PHP itself, so your application code and configuration do not change your exposure.
That includes sites built on:
- WordPress, which powers more than 40% of websites
- Drupal and Laravel
- Magento and WooCommerce
- Custom PHP applications, APIs and internal tools
Sites that do not run PHP are not exposed to these particular flaws.
Many companies still run PHP somewhere they forget about, such as an old microsite, a staging server, a customer portal or a blog on a subdomain. Check all of them.
Is PHP2Shell being exploited right now?
Yes. Amazon Threat Intelligence says PHP2Shell is now being broadly exploited in the wild.
Amazon reports that working proof-of-concept exploits appeared within hours of the patch release and were used against its sensors almost immediately.
The varied methods it saw suggest multiple attackers.
When CISA published its alert, it had not yet observed exploitation. The situation changed within hours, which is why agencies and researchers are urging immediate action.
| Date | What happened |
|---|---|
| October 21, 2026 | PHP releases fixes. CISA, the FBI, the NSA and the UK NCSC urge immediate patching. Exploits appear within hours |
| October 20, 2026 | Security firm watchTowr warns organizations to prepare to update quickly |
| October 17, 2026 | Amazon detects the first exploitation attempt on a decoy system, four days before the public fix |
| 2024 | The PHP Foundation says a possible exploit was theorized, but no concrete attack path was found |
How do I check my PHP version?
Run php -v on your server, or look in your hosting control panel or WordPress Site Health screen. Then compare the result with the fixed releases on the official PHP.net security announcement.
- Command line:
php -vshows the PHP version for that command-line environment. It can differ from the version your web server uses, so confirm in your hosting panel too. - WordPress: go to Tools, then Site Health, then Info, then Server to see the PHP version.
- Hosting control panel: most panels show the PHP version for each site and let you switch it.
- Docker and containers: PHP lives inside the image. Run
docker exec <container> php -v, then rebuild from an updated base image.
How do I fix PHP2Shell?
Update PHP to the fixed release. The PHP team says this is the only complete fix. Follow these steps:
- Take inventory. List every system that runs PHP: production sites, staging servers, internal tools, APIs and containers.
- Back up. Take a full backup of files and databases before you change anything.
- Update PHP. On your own servers, use your package manager or rebuild your images. On managed hosting, switch the PHP version in the control panel or ask your provider to do it.
- Test. Check plugins, themes and custom code on staging first, then confirm logins, forms, checkout and integrations in production.
- Hunt for compromise. Patching closes the door but does not show whether someone already got in. See the section on checking for a hack below.
- Keep watching. Add enhanced logging for PHP-based services and follow vendor updates, as the NSA advises.
Should I take my website offline if I can’t update right away?
If an immediate update is not possible, the FBI, the NSA and the UK NCSC all say to consider taking the system offline until it is fully mitigated.
For a low-value internal tool, that is an easy call. For a revenue-generating site, it is a business decision, so weigh the cost of downtime against the risk of a server takeover.
Do the temporary workarounds protect my site?
No, the PHP team says its temporary measures, such as adjusting memory and upload settings, only reduce exposure.
They do not make a server safe from exploitation. Use them only as a short bridge until you can update.
How do I know if my website was hacked through PHP2Shell?
Review server and access logs back to October 17, 2026, as Amazon recommends, and look for unusual requests and unexpected changes. Warning signs include:
- Unfamiliar files, especially in upload or cache folders
- New admin users you did not create
- Spikes in traffic or odd requests to PHP files
- Outbound connections you cannot explain
- Sudden slowdowns or unexpected server load
If you find any of these, treat the server as compromised. Isolate it, rotate all passwords and secrets, restore from a clean backup and bring in a security professional.
Does updating WordPress, plugins or my CMS fix PHP2Shell?
No, updating WordPress, Drupal, Laravel or any plugin does not fix a flaw in the PHP runtime.
The PHP version on the server must be updated. Keep your CMS core, plugins and packages current as well, because attackers often pair a new vulnerability with older, known weaknesses.
What are CISA, the FBI, the NSA and the NCSC recommending?
| Agency | Guidance |
|---|---|
| CISA (US) | Patch the PHP vulnerabilities immediately |
| FBI Cyber Division (US) | Update affected PHP installations immediately. Take the system offline if you cannot |
| NSA (US) | Inventory PHP-reliant services, apply patches, add logging, replace end-of-life PHP and take systems offline if you cannot update |
| National Cyber Security Centre (UK) | Prepare for immediate updating. Consider taking systems offline where that is not feasible |
Why is PHP2Shell such a big deal?
PHP2Shell combines huge reach, no login requirement and very fast exploitation. Three facts stand out:
- Scale: nearly 70% of websites use PHP, and WordPress alone runs more than 40% of the web.
- Speed: exploits appeared within hours of the fix. Amazon advises patching critical internet-facing systems within hours, not days or weeks.
- AI-assisted discovery: OpenAI says its AI models helped researchers find the flaws and calls it a new phase where AI can find bugs with internet-scale impact.
- The PHP Foundation also admitted that work on the fix stalled and restarted repeatedly before it became a top priority.
How can AddWeb Solution help?
If you would rather not handle this alone, our team can help with:
- PHP and server patching across WordPress, Drupal, Laravel and custom PHP applications
- Ongoing maintenance and monitoring: WordPress, Laravel and Drupal maintenance
- PHP upgrades and migrations for applications stuck on older versions
- Cloud and DevOps consulting for faster, safer deployments
- AI code audit and remediation to find weaknesses before attackers do
Not sure whether your site is exposed? Contact our engineers, and we will help you check your PHP version, patch it and review your environment.
Not sure whether your site is exposed? Contact our engineers and we will help you check your PHP version, patch it and review your environment.
Pooja Upadhyay
Director Of People Operations & Client Relations
Frequently asked questions
What is remote code execution (RCE)?
Remote code execution is a flaw that lets an attacker run their own commands on another computer over a network.
In the PHP2Shell case, the NSA says attackers could take control of affected web servers without prior access or authentication, which is why the flaws are rated critical.
Is PHP still safe to use?
PHP is still actively maintained, and the PHP team released a fix for PHP2Shell on October 21, 2026.
Safety depends on running a supported, patched version. Servers on end-of-life PHP versions that cannot be patched carry the highest risk and should be upgraded or replaced.
How quickly should I patch critical vulnerabilities like PHP2Shell?
Amazon Threat Intelligence advises applying critical fixes to internet-facing systems within hours, not days or weeks.
For PHP2Shell, working exploits appeared within hours of the October 21, 2026 patch, so waiting for the next maintenance window is risky.
Who discovered the PHP2Shell vulnerabilities?
OpenAI says its AI models helped researchers find the flaws, as part of a coalition of maintainers, researchers and security providers.
The PHP Foundation also says additional reports from a security researcher and Wiz helped make the fix a top priority.
What should I do if my hosting provider manages PHP?
Ask your hosting provider whether it has applied the PHP fix and which version your site now runs, then confirm it yourself in the control panel or WordPress Site Health.
Hosts often apply server updates, but you should still check your logs and keep plugins and themes current.
What happens if my PHP version is end-of-life?
End-of-life PHP versions no longer receive security fixes, so they may not get the PHP2Shell patch.
The NSA recommends replacing end-of-life PHP services that cannot be patched. Plan an upgrade to a supported version and consider taking the system offline until then.
