PHP2Shell PHP Vulnerability: Are You Affected?

Key takeaways

The flaws are in PHP itself, not in a plugin. A site without a single plugin is affected too.
You are only safe once the new PHP version runs on your server. On most hosting plans, your host does that.
PHP 8.1 and older get no official new release. If you are on one of them, move to 8.3 or newer now.
Germany's BSI issued an orange warning. CERT-EU advises taking sites offline if you cannot update right away.
Don't forget old installs: test sites, staging copies, old copies of your website.

What happened?

PHP is the programming language behind a large part of the web. According to the researchers who found the flaws, it powers about 70 percent of all websites. Every time someone opens a WordPress or TYPO3 page, PHP assembles that page on the server.

The security team at Wiz found bugs in the core of PHP. Put simply: when PHP runs out of memory during a request, leftovers stay behind, and the next request reuses them. With carefully built requests, an attacker can turn that into running their own code on the server. No login is needed, and it does not matter which application runs on top of PHP. Wiz showed the attack against fresh installs of WordPress, Drupal and Joomla.

How the flaws were found is worth noting. Wiz used AI models to search for them, build the attack and check the fix, and the team writes that AI lowers the barrier to chaining bugs like these. We covered that shift in WordPress security flaws. The technical write-up is on the Wiz research blog.

Date (2026)	What happened
August 19	Wiz finds the first bug
August 20 to 21	Attack without login confirmed against Drupal, then WordPress
August 24	Reported to the PHP security team
October 20	PHP announces a security release for the next day
October 21	New PHP versions and public details. Cloudflare had already reported first attacks that morning

How serious is it?

Very. A score of 9.2 out of 10 (CVSS 4.0) means: reachable from the internet, no password needed, and full control of the server as the result. Germany's federal security agency BSI published a warning at level orange. CERT-EU, the security service of the EU institutions, advises taking websites offline where the update can't be installed right away.

Some did exactly that. On October 21 the University of Freiburg took its PHP websites, its ILIAS learning platform and student webmail offline as a precaution. The invoicing service easybill and the wiki host wiki.gg were offline for a while too. At some hosting companies, rolling out the update took until the evening.

Am I affected?

Probably yes, if your website runs on one of these systems and your server has not been updated yet:

WordPress (including WooCommerce), TYPO3, Drupal, Joomla, Contao
Shop systems such as Shopware or Magento
Self-hosted tools such as Nextcloud, or any other application written in PHP

Not sure what your site runs on? Here is how to check if a website is WordPress. Websites whose server runs no PHP are not affected: static websites, website builders that are not built on PHP (ask your provider if in doubt), and sites on ShiftPress.

How to check your PHP version

WordPress: go to Tools, then Site Health, then the Info tab, and open the Server section. The PHP version is listed there.
Other systems: look in your hosting control panel (often under "PHP settings"), or ask your host.
Compare: 8.5.12, 8.4.27, 8.3.36 and 8.2.35 contain the fix, as does anything newer in the same series.

One catch: some hosts and Linux packages apply the fix without changing the version number. An older-looking number does not always mean you are exposed. If in doubt, ask your host whether the fix for CVE-2026-109618 and CVE-2026-109619 is installed.

What to do now

Ask your host or check its status page. On shared hosting and managed WordPress, the host usually patches. Get it confirmed in writing.
Your own server? Update now to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart PHP.
On PHP 8.1 or older? There are only minimal source patches for people who build PHP themselves, plus packages from Linux distributions and vendors such as cPanel. Plan the move to a current version now, not during the next emergency. Work like this is a large part of what website maintenance really costs.
Can't update today? CERT-EU and the UK's NCSC then advise taking the site offline for now. As a stopgap, the setting session.upload_progress.enabled = 0 blocks one of the known attack paths. It does not block all of them.
Hunt for forgotten installs. Staging sites, old test installs, a campaign page from 2019, an old copy of your website on a subdomain. Each one needs the update or should be switched off.
Watch for traces. Wiz lists repeated 500 errors, memory-limit errors after unusual upload requests, and oddly large or broken PHPSESSID cookies as warning signs. If you see these, bring in a professional. An update closes the hole, but it does not remove a backdoor that is already there.

You do not need a WordPress update, by the way. WordPress.org has confirmed that no WordPress update is needed or planned for these flaws.

Why sites on ShiftPress are not affected

On October 21 we did not have to touch a single customer site. The reason is how they are built:

Finished pages instead of PHP. Every page is built ahead of time as finished HTML. When someone opens it, no program assembles the page. A file is simply delivered.
Delivered through Cloudflare. Pages are served from Cloudflare's global network. There is no web server per customer that someone has to patch on an ordinary weekday afternoon.
No PHP anywhere in the system. Forms and bookings go to our own service, which is not written in PHP (what that covers is in what a static website can and can't do). Our codebase does not contain a single PHP file.
No public admin login on your domain. Changes happen in the ShiftPress dashboard, not under yourdomain.com/wp-admin.

To be honest: no software is immune. Our own stack (JavaScript, a database, Cloudflare) can have flaws too, and we depend on providers like everyone else. The difference is in two places. Your public website runs no program that anyone could talk into doing something. And when our platform needs a fix, we apply it once, centrally, instead of every customer calling their host.

Depending on a platform is a fair worry, so one more point: a ShiftPress site is ordinary code in its own git repository, and you can download it as a ZIP at any time. More on that in no lock-in: your site belongs to you.

Open source or SaaS: the wrong question

After a day like this, you quickly read that "open source is insecure". That is not quite right. The PHP team handled the report confidentially, prepared fixes for every version from 7.4 to 8.5, and published on a fixed date. That is how it is supposed to work.

The real problem is a different one. Millions of websites each run their own server with their own PHP, and someone has to update every one of them on the same afternoon. At a small business, that someone often doesn't exist, which is one reason WordPress feels like work. You always depend on someone, whether an open-source project, a host or a SaaS provider. The question is how much of the work and the risk lands on you when something breaks. For the wider trade-off, read static websites: benefits and weaknesses.

Frequently asked questions

Do I need to update WordPress?

No. The flaws are in PHP, not in WordPress. WordPress.org has confirmed that no WordPress update is needed or planned. What matters is the PHP version on your server.

Is TYPO3 affected?

TYPO3 runs on PHP, so yes, as long as the server has not been updated. The flaw is not in TYPO3 itself. As with WordPress, the PHP update on the server is the fix.

Which PHP versions are safe?

8.5.12, 8.4.27, 8.3.36 and 8.2.35, and anything newer in each series. For 8.1 and older there is no official new release, only minimal source patches and packages from Linux distributions or vendors such as cPanel.

Has the flaw already been exploited?

Yes, first attacks have been seen. Cloudflare reported them on the morning of October 21, before the fixes came out. Whether attackers knew about the flaws earlier is still unclear.

Does Cloudflare or a firewall protect me?

Partly. Cloudflare, Fastly and Google published firewall rules that catch known attacks. That buys time, but it does not replace the PHP update.

Are sites on ShiftPress affected?

No. ShiftPress sites are finished HTML files delivered through Cloudflare, and no PHP runs on them.

The bottom line

If your site runs on PHP, check today that the update is installed, including on old and forgotten installs. In the longer run, it is worth asking whether your website needs a server that has to be patched at all. For a site that mainly shows what your business does, the answer is usually no, and a move does not have to cost you your Google position: see moving off WordPress without losing rankings.

Sources: Wiz Research, Codeable (WordPress guidance), Born's Tech and Windows World (BSI warning), netzwelt (CERT-EU), University of Freiburg.

PHP2Shell: the critical PHP security vulnerability of October 2026, and what to do now