PHP2Shell Vulnerabilities in October 2026: Affected Versions and How to Protect Your Website

Has your hosting provider asked you to update PHP because of PHP2Shell? Before changing a setting, check whether the fix has already been installed. Some providers patched their existing PHP packages without changing the displayed version, so the number in your dashboard may tell only part of the story.

On October 21, 2026, the PHP team released updates for two critical vulnerabilities that can allow code to run on a server without logging in. Each received a CVSS v4.0 severity score of 9.2 out of 10. If you run a WordPress website or WooCommerce store, these are updates to check with whoever manages your hosting.

Start by establishing the status of the PHP runtime serving your website. If it has not been patched, arrange the update, then test the website. Here is what to check and what to ask your provider.

What happened in PHP?

PHP is the programming language WordPress uses to build pages and process requests. WordPress can therefore be fully updated while the PHP runtime on the server still needs a separate security fix.

The two vulnerabilities known as PHP2Shell concern the way PHP handles memory while processing requests:

• CVE-2026-109618: an out-of-memory error can stop a request before some internal data has been fully initialized. PHP may then use that incomplete data during cleanup, potentially allowing unauthorized code execution.
• CVE-2026-109619: references to memory released after an earlier request can remain in place. If a later request encounters that stale state, the flaw may lead to data disclosure or code execution.

PHP’s warning covers web runtimes including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The conditions and exploitation paths differ. PHP identifies mod_php as the highest-risk environment, with demonstrated exploitation before application code begins. Other runtimes still need to be assessed and patched.

For the technical details, read the official first advisory and official second advisory.

Which PHP versions need an update?

The PHP project released the following fixes on October 21. Find your website’s branch in the table and compare its version:

If your displayed version is older, ask your provider about the patch before concluding that the website remains exposed. It may have backported the fix into its existing package. Ask for confirmation covering both CVE identifiers or a reference to the patched package.

If the website runs PHP 8.1 or older, also start planning a move to a supported branch. Those versions are no longer supported by the PHP project, even if your provider supplies its own security patches.

Where should you start checking?

In WordPress, open Tools → Site Health → Info → Server. Record the PHP version shown there, then review your provider’s notices or ask its support team about the update.

If you manage several websites or subdomains, check each one. They may use different PHP runtimes. The version available from a command line may also differ from the one processing visitors’ web requests.

A specific question is more useful than asking whether the website is secure. You can send your provider this:

Is the PHP runtime serving my website patched against CVE-2026-109618 and CVE-2026-109619? Have the PHP services been restarted after the update? Please provide the package version or the method I can use to verify the fix.

That gives you a record you can check, rather than relying on the website appearing to work normally.

If your website is on Hostinger

Hostinger says it completed deployment of the two fixes across its hosting plans except customer-managed VPS. It also explains that some websites may still show PHP 8.5.11 because the fix was added to the existing package.

Open Websites → Dashboard → PHP Info and check Build Date. According to Hostinger’s instructions, a build dated October 21, 2026 or later contains the two fixes. This check is specific to Hostinger. If you use another provider, ask how to verify its packages.

For a VPS, follow up with whoever manages the server. See Hostinger’s PHP2Shell announcement for its guidance and deployment updates.

How do you update PHP without disrupting the website?

If your provider confirms that the fix is missing, arrange for it to be installed. You need a patched release or a provider-confirmed patched package, followed by a restart of the relevant PHP processes. Work through these steps:

Prepare a backup you can restore

Keep copies of the website files and database, and know where they are and how to restore them. If you are moving to a different PHP branch, check theme and plugin compatibility and try the change on staging first, particularly for stores with payment gateways or custom plugins.

Check that the updated runtime is actually in use

A new package can be installed while older workers remain in memory. Ask whether all PHP workers serving the website have been restarted, then check the web runtime again. Your provider or server administrator handles this, depending on the hosting arrangement.

Try the customer journey as well as the homepage

In WooCommerce, open a product, add it to the cart, and test checkout, the payment method, and order emails using the appropriate test mode. On a company website, submit a test contact form and confirm it arrives. Check login and any other function your business depends on.

Review the error log too. If a compatibility issue appears, you can identify and address it during the check rather than discovering it from a customer who could not complete an order.

What if you cannot update today?

An older theme or custom integration may need attention before you move to a newer PHP branch. First ask whether your provider can patch the current branch, then schedule the work needed to remove the compatibility problem.

The official advisories describe temporary ways to reduce specific attack paths, including request and upload restrictions and disabling session.upload_progress.enabled where appropriate. These settings do not replace the patch. A server administrator should assess them against your PHP runtime and the website’s requirements.

If upload progress tracking is disabled, set session.upload_progress.enabled=0 in configuration that applies before request parsing, and restart every worker. Setting it through ini_set() inside WordPress is not sufficient for this purpose. Avoid copying memory settings or upload limits from a general guide without checking their effect on uploads, imports, and store functions.

There is also an advisory from October 23

PHP published a further notice for CVE-2026-115560, involving upload progress tracking in an unusual configuration. The application must start with the php_binary or php_serialize session serializer, switch to php at runtime before calling session_start(), and leave upload progress tracking enabled.

The team recommends disabling session.upload_progress.enabled until the next regular bugfix release to protect against this path. According to the notice, applications that never change the serializer at runtime can keep the feature enabled.

Ask your provider about this notice when you check the original two fixes. The versions in the table address the October 21 vulnerabilities; they do not, by themselves, confirm that the October 23 issue has been resolved. Read the details in the official PHP news archive.

Questions you may still have

Is updating WordPress and its plugins enough?

These vulnerabilities require a patch to PHP on the server. Keep updating WordPress, the theme, and plugins too, but a dashboard showing that all WordPress updates are installed does not confirm the PHP patch status.

Does this mean my website was hacked?

An affected version does not prove a compromise. Equally, installing the patch does not establish that nothing happened beforehand. If you find unfamiliar files, administrator accounts you did not create, or hosting alerts, ask for the relevant logs and files to be reviewed before drawing a conclusion.

Do I need to move to another hosting provider?

Start with your current provider. If it confirms the patches and gives you a way to verify them, you have addressed an important part of the problem without moving the website. Consider alternatives if you cannot obtain a supported runtime or a clear answer about the update.

Sources and further updates

This information was reviewed on October 24, 2026 against the sources below. Security advisories can change as new details emerge, so check the latest PHP and hosting-provider guidance when carrying out the work.

• PHP releases and security notices for October 2026.
• Official advisory: CVE-2026-109618.
• Official advisory: CVE-2026-109619.
• Hostinger: patch deployment status.
• Hostinger: checking PHP version and build date.