PHP2Shell: Is Your Website Affected? What UK Businesses Should Do Now

Updated 22 October 2026.

If you own a WordPress, WooCommerce or other PHP-based website, check it today. Two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, are being referred to as PHP2Shell. Both are rated 9.2 under CVSS v4.0 and can allow unauthenticated remote code execution in vulnerable PHP environments.

The PHP project released fixed versions on 21 October 2026 and says updating is the only complete solution. NHS England has also warned that proof-of-concept exploitation has been demonstrated and assesses future exploitation as highly likely.

For a UK business owner, the useful question is not “What does the code do?” It is “Is my website affected, who is responsible for the PHP update, and how do I get confirmation that it is fixed?”

Is my website affected by PHP2Shell?

If your main store is Shopify: see the separate guide Is Shopify affected by PHP2Shell? It explains what Shopify merchants do and do not need to check.

The 60-second answer for WordPress and WooCommerce owners

If your website runs WordPress or WooCommerce, PHP2Shell matters because PHP runs underneath the application. Updating WordPress, WooCommerce, a theme or a security plugin does not by itself patch the PHP runtime.

Ask your host to confirm the exact PHP version serving the live site and whether the fixes for CVE-2026-109618 and CVE-2026-109619 have been applied. WordPress has published its own advisory making clear that these vulnerabilities are in PHP rather than WordPress itself.

Which PHP versions fix PHP2Shell?

The PHP project released these fixed upstream versions on 21 October 2026:

PHP 8.1 and older are outside normal upstream security support. Some operating-system or long-term-support vendors may backport the fix, so a version string can differ from the upstream list. If your host says it has backported the patch, ask it to confirm specifically that CVE-2026-109618 and CVE-2026-109619 are fixed.

Source: official PHP security release.

What happened?

PHP disclosed two critical vulnerabilities on 21 October 2026. Both affect the PHP runtime itself and can be triggered before normal application-level protections necessarily have a chance to help.

CVE-2026-109618

This issue involves memory corruption during out-of-memory handling. In a vulnerable environment, a specially crafted request can lead to unsafe memory handling and potentially remote code execution.

CVE-2026-109619

This issue involves stale global state and freed memory persisting between parts of request handling. The result can include sensitive memory disclosure or remote code execution.

You do not need to understand either memory-safety flaw to take the correct business action. The relevant fact is that the fix is at the PHP runtime/server level.

What does the UK guidance say?

The UK National Cyber Security Centre advises organisations to identify systems running PHP, prioritise internet-facing systems, monitor for malicious activity and apply the available security updates. Where immediate remediation is not possible, it says organisations should consider taking the affected system offline until the risk is fully mitigated.

NHS England's cyber alert also notes that proof-of-concept exploitation has been demonstrated against applications integrating PHP and assesses future exploitation as highly likely.

What should a website owner do today?

1. Find out whether the site uses PHP

If you use WordPress or WooCommerce, it does. For another CMS or custom website, ask the host or developer.

2. Get the exact PHP version

Do not accept “PHP 8” as the answer. You need the full patch version.

On WordPress, go to Tools → Site Health → Info → Server and look for the PHP version. The hosting control panel may show it too. If the two disagree, ask the host which version is actually serving the public site.

3. Ask whether the two CVEs are patched

Managed hosts may have patched their servers centrally. That is good, but get confirmation rather than assuming. If the provider uses a backported security package, ask it to confirm the two CVE numbers explicitly.

4. Back up before a major PHP branch change

A security patch inside the same supported branch is different from jumping an old site to a newer PHP branch. If a version change is required, make sure you have a recoverable backup and check plugin/theme compatibility.

5. Apply the security update

If you manage the server, install the vendor-supported patched packages and restart the relevant PHP/web-server workers as required. If your host manages the server, ask it to perform the update or confirm it has already been completed.

6. Test the parts that make money

• homepage and key landing pages;
• product and category pages;
• basket and checkout;
• forms and lead capture;
• customer login;
• search and filters;
• payment integrations;
• order emails, webhooks and scheduled jobs.

7. Review for anything suspicious

Patching closes the known vulnerability going forward; it does not prove a previously exposed server was never targeted. If the site was vulnerable, review web-server and application logs, changed files, administrator accounts, scheduled tasks and security alerts. If you suspect a compromise, involve your hosting provider or a qualified cybersecurity specialist.

Not technical? Copy this email to your hosting company

Hi,

I understand that two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), were patched on 21 October 2026.

Could you please confirm:

1. Which exact PHP version is currently serving my production website?
2. Whether the fixes for CVE-2026-109618 and CVE-2026-109619 have been applied, including any vendor backport?
3. If the site is on PHP 8.1 or earlier, what supported upgrade path do you recommend?
4. Whether you recommend reviewing logs or other indicators because the site was internet-facing before it was patched?

Website: [your URL]

Thanks.

Does updating WordPress fix PHP2Shell?

No. WordPress has stated that the vulnerabilities are not specific to WordPress and that no WordPress update is required for this PHP issue. The PHP runtime itself needs to be patched by whoever manages the hosting environment.

That means updating WordPress core, themes, plugins or a WordPress security plugin is sensible general maintenance, but it does not replace the PHP security update.

Is WooCommerce affected?

WooCommerce runs on WordPress, so a WooCommerce site depends on PHP. The vulnerability is not a WooCommerce flaw, but a vulnerable PHP runtime underneath the store can still expose it.

After the PHP update, prioritise checkout, payment gateways, order emails, subscriptions, webhooks and scheduled jobs in testing.

Is Shopify affected?

A standard hosted Shopify merchant does not manage a PHP runtime for the storefront and there is no PHP-version setting to patch in Shopify Admin. Shopify documents Liquid as its theme template language.

But a Shopify business may still have PHP systems around the store: a WordPress blog, an old WooCommerce installation, custom middleware, a separately hosted landing page or a developer staging site. Those systems need to be checked independently.

Read the focused guide: Is Shopify affected by PHP2Shell? What Shopify store owners need to know.

What if you cannot update immediately?

The official PHP advisory describes technical measures that can reduce exposure to particular attack paths, but it is clear that these are not complete fixes. For a small-business owner, the safest route is to send the advisory to the host or developer and get the supported patch applied.

If the UK NCSC guidance applies to your organisation and immediate remediation is not possible, consider whether the affected internet-facing system should be taken offline until it is properly mitigated.

Confirmed facts and what is still developing

Confirmed

• The two vulnerabilities are CVE-2026-109618 and CVE-2026-109619.
• Both are rated 9.2 critical under CVSS v4.0.
• Fixed upstream PHP releases were published on 21 October 2026.
• Updating the PHP runtime is the complete fix recommended by the PHP project.
• Updating WordPress alone does not patch the underlying PHP runtime.

Still developing

• The eventual scale of malicious exploitation.
• Which individual hosting providers and third-party systems were exposed before they patched.
• Whether a particular business experienced compromise. That requires evidence from its own systems and logs.

Frequently asked questions

What is PHP2Shell?

PHP2Shell is the name being used for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. In vulnerable PHP environments they can allow unauthenticated remote code execution or exposure of sensitive process memory.

Is WordPress affected by PHP2Shell?

WordPress itself is not the vulnerable component, but WordPress runs on PHP. A WordPress site served by a vulnerable PHP runtime therefore needs the underlying PHP environment patched.

Is WooCommerce affected by PHP2Shell?

WooCommerce runs on WordPress and therefore uses the site's PHP runtime. Check the PHP version with the host and make sure the relevant CVE fixes have been applied.

Is Shopify affected by PHP2Shell?

A standard Shopify merchant does not manage a PHP runtime for the hosted storefront, so there is no PHP patch to install in Shopify Admin. Check any separate WordPress, WooCommerce, custom or self-hosted systems connected to the business.

How do I know which PHP version my WordPress site uses?

In WordPress, go to Tools → Site Health → Info → Server. You can also check the hosting control panel, but if there is any doubt ask the host which version is actually serving the production site.

Which PHP versions fix CVE-2026-109618 and CVE-2026-109619?

The upstream fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Some supported operating-system vendors may provide a backported fix with a different package version, so confirm the CVE status with the provider.

If this exposed a bigger website problem

A security alert often reveals something more basic: nobody is quite sure what the business website runs on, who owns the hosting, which old sites still exist or which systems connect to the store.

I can help with the website and ecommerce side of that problem: mapping what is live, identifying the owner of each system and sorting out the Shopify/site work that follows. I am not a cybersecurity incident-response provider; if you suspect a breach, use your host or a qualified security specialist.

Book a free 20-minute call with Mind the Shop.

Sources

• PHP: official 21 October 2026 security release
• UK National Cyber Security Centre: critical security issue affecting PHP
• NHS England: Critical Vulnerabilities in PHP (PHP2Shell)
• WordPress: Critical PHP Security Release
• Shopify developer documentation: Liquid reference