PHP2Shell: What it is and why you don’t need to panic

Last updated: Oct. 27, 2026 [09:00 AM, UTC]

php2shell is the nickname for two safety holes established in PHP. Their authoritative names are CVE-2026-109618 and CVE-2026-109619 (CVE is the community catalog safety researchers use to track vulnerabilities).

About 69% of websites whose server-side tongue can be identified run on PHP, the behind-the-scenes tongue that handles interactive functions on a page, specified as logins, communication forms, and checkout carts.

It’s additionally the tongue that runs under famous content administration systems (CMSs) specified as WordPress, Magento, Drupal, and Joomla. As a result, PHP powers a broad range of website types, from individual blogs and small endeavor sites to online stores, news sites, and community forums.

The flaws are in PHP operating on servers, so fixing them falls to website operators and hosting providers.

How does php2shell logic damage?

Every period person visits a website, their browser sends the server a petition – think of it akin an command stumble handed to the kitchen. Normally, PHP says the stumble and prepares the page, fair akin a chef cooks the meal you ordered.

An attacker exploiting php2shell sends a deliberately malicious command stumble that overwhelms PHP during it’s motionless study it. In the confusion, PHP doesn’t tidy up properly, and the attacker can use that leftover disorder to stumble in their own instructions. From there, they can run their own code on your server.

Once that happens, they can do item your location can do: alter your pages, create admin accounts for themselves, peruse your repository (including client details), or tap the location offline.

What makes this worrying is that attackers don’t need a password, an account, or equal a particular leaf to target. On servers that run PHP through Apache’s mod_php module, among the most average tradition setups on the web, php2shell can activity through nearly any leaf on your site. Other famous setups, specified as PHP-FPM, are additionally at risk, although attacks there depend additional on how a location is configured.

If it’s all automated alongside AI agents, attackers can dispatch these requests to thousands of sites at formerly and see which ones are motionless unpatched.

If you’re fair visiting websites, you can’t trigger this by accident, and browsing an unpatched location won’t hack your computer. The hazard is to the location and the data stored on it.

How the php2shell bugs unfolded

The earliest signs of the issue date rear years, but researchers established the archetypal flaw nearly three months before most group heard of it. 

The array shows how connected events unfolded in the latest update on the bug’s betterment up until Oct. 23, 2026.

Are these php2shell attacks really happening?

As of Oct. 26, 2026, no prosperous php2shell break-in has been publically confirmed. Attackers are trying, though, and the gap between attempts and confirmed compromises is wide.

Amazon’s MadPot honeypots recorded one exploitation attempt on Oct. 17 from an anonymized IP address. AWS says it’s unclear how the performer got utilize data before disclosure. 

On Oct. 21, AWS identified multiple proof-of-concept exploits starting at concerning 02:00 UTC, approximately 12 hours before PHP’s scheduled 14:00 UTC release, and additional attempts on another infrastructure until 08:00 UTC.

Attempts to utilize Cloudflare’s servers climbed from thousands before the notice to millions by the end of the day, and attackers began tweaking their payloads to stumble former its protections.

Most of these numbers arrive from firewalls and honeypots, so they figure attacks that were blocked or deliberately lured, not sites that were breached.

A reported colony didn’t clasp up either. Unit 42 connected an assault on a European authorities agency to php2shell, afterward retracted the nexus on Oct. 25 since it couldn’t verify that the attackers gained admission through these CVEs.

These facts gave us no logic to panic, but there’s additionally no logic to postpone updating your PHP to the patched version. Attackers are actively probing sites, so if the update is yours to run, do it today.

How to be harmless from the php2shell bugs?

If you’re on shared or managed hosting, protecting the server is your host’s responsibility, so you’re likely already covered. To be sure, inspect your host’s position leaf or announcements, or dispatch their assistance squad a quick communication asking whether the php2shell fix is in place.

If you oversee PHP yourself, for example on a virtual personal server (VPS), you’ll need to update to among the patched releases (PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35) yourself, afterward restart PHP to justify the fix takes effect.

If you’re on a managed Hostinger hosting plan

If you’re on any of our managed web hosting plans, you’re all set. We already run patched builds of all PHP type we offer on web, cloud, managed WordPress, and bequest cPanel hosting. Even if your location runs an older PHP version, it’s protected.

When checking which PHP version your location uses in the Hostinger dashboard, you may motionless see an older PHP type listed as active. That’s normal. What’s crucial is ensuring the Build Date is listed as October 21, 2026, or later. 

Watch the video below if you’d akin a ocular walkthrough:

If you’re operating a VPS

On a VPS, including cPanel VPS plans, you oversee PHP yourself, so the update is in your hands. That applies to item on your server that runs on PHP – web apps, APIs, admin tools akin phpMyAdmin, and webmail all count, equal the ones you set up formerly and forgot about. 

If you’re on Hostinger’s VPS, our step-by-step guide walks you through the procedure and includes a impermanent workaround if you can’t update correct away.

There’s no authoritative place for PHP 8.1 or older, so moving to a newer type is the lone solution. Before you do, inspect that your theme, plugins, and apps assistance it, and test the alter on a staging copy archetypal if you can.

We extremely propose keeping PHP up to date, as older versions young female many safety fixes. PHP 8.2 stops receiving safety fixes on December 31, 2026, so PHP 8.3 or newer is a fine target.

If you can’t update PHP correct away, use a firewall to buy time

Firewall rules are part of how we protected sites on our managed hosting plans: they obstacle requests that equivalent the php2shell attack. 

If you oversee your own server, you can get akin safety from a assistance akin Cloudflare, which switched on php2shell protection for all location using its firewall, including on its liberated plan.

But a firewall lone buys you time. It isn’t the fix, for two reasons:

• Attackers adapt. Firewall rules obstacle assault patterns they recognize, and Cloudflare has seen attackers tweaking their requests to stumble former its rules. Even Cloudflare calls its safety an additional tier of defence and tells location owners to place PHP.
• It lone protects traffic that goes through it. If an attacker can attain your server directly, the firewall never sees them.

PHP’s own security advisory says updating is the lone harmless choice. Use a firewall to remain protected during you patch, not alternatively of patching.

Updating your CMS or plugins won’t fix php2shell

If your location runs on WordPress, Joomla, Drupal, Magento, or another PHP-based CMS, your archetypal intuition power be to hit “update all” on your center software, plugins, themes, or extensions. 

That’s a awesome habit, but it won’t defend you from this attack. php2shell sits underneath your website’s software.

All of these platforms, alongside alongside all plugin, theme, module, or expansion you add to them, are written in and run by PHP. So equal a completely updated location is motionless exposed if the PHP type underneath hasn’t been patched. The most straightforward type of the assault runs before your CMS equal starts, which method login pages and safety plugins never get a chance to stage in.

The fix has to happen anywhere your PHP is sourced: on your server, alongside your hosting provider, or in your receptacle depiction (if your location runs in Docker or a akin setup).

What to do concerning the third PHP flaw, disclosed on Oct. 23

If you’re on one of our managed hosting plans, you don’t need to do anything. We’ve already protected our servers against this third flaw, CVE-2026-115560, alongside alongside the php2shell fixes we rolled out on Oct. 21.

If you oversee PHP yourself, for example on a VPS, updating PHP won’t defend you from this one. The Oct. 21 releases don’t contain a fix for it, and the authoritative place volition be included in PHP’s next regular release. 

Until then, set session.upload_progress.enabled = Off in php.ini or your PHP-FPM pond config, afterward restart all PHP workers so the alter takes effect. If you already did this on October 21, you’re covered.

Turning this environment off is improbable to interrupt anything. It lone controls a rarely used characteristic that tracks document upload progress, and WordPress doesn’t use it. If you run a tradition app that does display upload advancement bars this way, that display volition halt operating until you rotate the environment rear on following the next PHP release.

What’s next

The two php2shell flaws have been fixed in the Oct. 21 PHP releases. The connected third flaw, CVE-2026-115560, volition get its authoritative fix in PHP’s next regular release, and the environment described complete keeps you protected until then.

This part reflects publically accessible data as of Oct. 26, 2026. Security direction can alter quickly, so inspect PHP’s authoritative advisories and your hosting provider for the latest updates.

If you’re a Hostinger customer, keep an eye on our live status page for updates. Our Customer Success squad is additionally accessible 24/7 via live conversation to answer questions concerning your website.