PHP2Shell: what happened to PHP and how to tell if your website is at risk

Last week PHP announced two critical security flaws, and on Saturday, October 24, a researcher confirmed the first successful attack: a single request, with no username and no password, took control of a server. The flaws are called PHP2Shell, and PHP runs almost 7 in 10 websites whose server language is known, according to W3Techs.

If your business has a WordPress site, a WooCommerce store or a host with cPanel, your website runs PHP and its version is worth checking today. The websites we build were out of reach of this flaw, and at the end we explain why.

What PHP is

PHP is a programming language that runs on the server. On a WordPress site, every time someone visits, the server runs PHP, pulls the text from a database and only then sends back the finished page.

That server is a computer at your hosting company, connected to the internet around the clock. A flaw in PHP is a flaw in the front door of that computer, and it reaches everything built on top: WordPress, Joomla, Drupal, Magento, PrestaShop, WooCommerce and Moodle learning sites.

What PHP2Shell is

PHP2Shell is the name of two flaws, CVE-2026-109618 and CVE-2026-109619, that let an attacker run commands on the server with a specially crafted request. On servers with Apache and mod_php, the attack runs before the page even loads, so WordPress security plugins come too late.

Its severity is 9.2 out of 10 on CVSS, the scale the industry uses. It affects PHP from version 5.4, released in 2012, in every way PHP gets installed: PHP-FPM, Apache with mod_php, CGI, FrankenPHP and LiteSpeed. The researchers who found the flaws showed attacks against WordPress, Drupal, Joomla and Magento, and VirusTotal counts more than 5.1 million PHP servers exposed on the internet.

With the server in their hands, an attacker can change what your website shows, send your visitors to another site, read what comes in through your forms or use your domain to send spam. When Google detects something like that, it shows a red warning to anyone trying to open your website.

What happened, day by day

Adel Karimi, at Perplexity, recorded Saturday's attack on a honeypot, a machine left exposed on purpose to study attackers. Marcus Hutchins, a researcher at Expel, confirmed the result, and BleepingComputer reported it on Monday, October 26. Up to that day, what had been seen was scanning and attempts that failed.

How to tell if your website runs PHP

• Check what it is built with. WordPress, WooCommerce, Joomla, Drupal, Magento, PrestaShop, OpenCart and Moodle all run on PHP.
• Try the WordPress door. Add /wp-login.php to the end of your address, for example yourbusiness.com/wp-login.php. If a login screen appears, your website is on WordPress and runs PHP.
• Look at your hosting panel. If you manage your hosting through cPanel, Plesk or DirectAdmin, your plan includes PHP.
• Ask whoever built your website. It is the fastest answer.

How to see which PHP version you have

In WordPress, open the dashboard and go to Tools, Site Health, the Info tab, the Server section. The PHP version is listed there. In cPanel, look for MultiPHP Manager or Select PHP Version.

Then compare with this table:

What to do today if your website runs PHP

1. Ask your host to confirm the version. On shared hosting, updating PHP is the provider's job. The message to send is right below this list.
2. Update PHP, on top of WordPress. The flaw lives in PHP itself and only the new PHP version fixes it. Updating WordPress and your plugins is still good practice for everything else.
3. If you are on PHP 8.1 or older, plan the version change. CISA, the US cybersecurity agency, recommends taking servers offline when they cannot be updated. A big version jump can break old plugins: make a backup and test on a copy of your website first.
4. Put Cloudflare in front in the meantime. Cloudflare has carried rules against PHP2Shell since October 21, active with nothing to configure. It is a filter while you update: it only protects traffic that goes through Cloudflare, and the real fix is still the new PHP.
5. Check whether someone got in. The most common signs are admin users nobody created, new .php files in your website's folder, visits that end up on other sites and Google's red warning. If you see any of them, change every password and ask your host to restore an earlier backup.

The message for your host

The third flaw

On October 23 PHP warned of a third flaw, CVE-2026-115560, which affects even the fixed versions and gets fixed in the next regular release. It only hits servers with an unusual mix of configuration and code. In the meantime, the mitigation is turning off upload progress tracking, a one-line change in the PHP configuration: session.upload_progress.enabled=0.

Why our websites were out of PHP2Shell's reach

The websites we build are made a different way. Each page is a finished file, with its text and its images, published on Cloudflare's network and copied across its data centers. When someone visits, the nearest data center hands over that file as it is, already built.

Whatever needs logic, like a store or a tool, runs on Cloudflare Workers, Cloudflare's system for running JavaScript code inside its own network. Products and orders are stored in Cloudflare's databases.

That is why PHP2Shell met two layers of protection.

The attack needs a PHP server on the other end

PHP2Shell works when the request reaches a server that runs PHP. On our websites, the request reaches a Cloudflare data center that hands over a file.

On Monday, October 26, we checked every client website we have live, plus builttoclick.com. All of them answer from Cloudflare's network, none shows any trace of PHP in its responses, and on every one the address /wp-login.php leads to a page that does not exist.

Cloudflare filters the attack before it arrives

Cloudflare turned on its rules against PHP2Shell on October 21 at 00:02 Paraguay time, about nine hours before the flaws went public, according to its own report. The rules reached every website on its network by themselves.

It is the same network that sits in front of almost one in four websites in the world, according to W3Techs. Cloudflare has data centers in more than 335 cities in more than 125 countries and blocks about 230 billion threats a day on average. In the hosting guide we explain how we measured this network's speed from San Lorenzo.

If your website is with us, there is nothing for you to do this week: security is handled by the network, and the website by us.

Should you leave WordPress?

WordPress is the most used system in the world for building websites, and it works well when someone takes care of PHP, the theme, the plugins and the backups. If your website has someone doing that, this week brings them extra work. If nobody does, this is a good moment to decide who will.

We chose another route: websites published on Cloudflare's network, with security handled by the network. If your website is on WordPress today, we build a new one with your text and your photos.