PHP2Shell and the Websites Your Business Forgot About

Since PHP2Shell was disclosed on October 21, 2026, we've heard from a lot of clients, old and new, with the same question: is my website affected? The client sites we build and look after aren't affected. But the question tends to lead somewhere bigger. What else is out there with your business's name on it, and who is keeping it up to date?

What PHP2Shell is, in plain words

On October 21, 2026, the PHP project released fixes for 2 critical flaws known together as PHP2Shell: CVE-2026-109618 and CVE-2026-109619. Both carry a CVSS v4.0 score of 9.2. The first is a memory error while PHP reads form data. The second lets leftover state from 1 request be reused by the next. Either flaw can let an attacker run their own code on the server.

Proof-of-concept attack code is reportedly public, and security researchers reported attempts to use it within days of the fix.

The reach is what makes this a business conversation. W3Techs measured PHP on 69.3% of websites whose server-side language it could identify, as of October 22, 2026. WordPress, WooCommerce, Drupal, Joomla, Magento and Laravel all run on PHP.

The fix is a PHP update on the server. The fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12, depending on which line a site runs. PHP 8.1, 8.0 and 7.4 only got source-code fixes that someone has to build by hand, and PHP 8.1 reached end of life on December 31, 2025.

The sites nobody is watching

A business's main website usually has someone responsible for it: a host, a developer, an agency. The addresses we'd look at first are the ones that were launched for a reason, did their job, and were never switched off:

• An old WordPress site from before a rebrand, still live on the old domain.
• Landing pages from a campaign that ended long ago, on a subdomain like promo.yourbusiness.com.
• A booking or quote tool a vendor set up on its own subdomain.
• Internal tools: an intranet, a client portal, a staff scheduling page.
• A staging copy of the site that was made public for a review and never taken down.

Any of these can run PHP, and each needs someone to update it. When nobody owns a site, nobody updates it.

Updating WordPress doesn't close the gap, either. PHP is a program on the hosting server, so your host or developer updates it, and a WordPress site with every update applied can still run a PHP release from before the fix.

Why marketing teams should care

Many of these forgotten addresses come from marketing. A campaign microsite, an event registration page, a landing page builder a past agency connected to a subdomain. They get built quickly for a deadline, handed over, and left running when the campaign ends. IT may not know they exist, and the person who asked for them may have moved on.

Start with a list

Before you check anything, it helps to know what you have.

1. List every domain your business owns. Your domain registrar has them all in 1 place.
2. Ask whoever manages your DNS for every subdomain in use. Subdomains are where old campaign pages and vendor tools tend to live.
3. Add anything a vendor or past agency built for you: booking tools, portals, microsites, staging copies.
4. For each address, find out whether it runs PHP, which version, and who updates it.
5. Send each host or developer what you found and ask them to confirm the fixed release is in. Switch off anything you no longer need.

How to check each address for free

Step 4 is why we built PHP Scanner. Enter an address and it loads the page once, the way a browser does, and sends no attack traffic. It reads what the server sends back and tells you in plain English whether the site runs PHP, which version it reports when the server shows it, and who most likely updates it. Every result includes a ready-made email you can send to your host. It's free, and there's no signup.

A passive check has limits, and the result says so. Many servers hide their PHP version, which is good practice. When that happens, PHP Scanner shows you where to find the version yourself, or you can send the email and let your host confirm it. For a step-by-step walkthrough, see Is my website affected by PHP2Shell? on the PHP Scanner site.

Run it on your main site, then work down your list. A site that runs a fixed release, or doesn't run PHP at all, can come off it.

Need a hand with the list?

If your list is long, or you aren't sure who built what, talk to us and we'll help you work through it. Either way, start by checking your sites with PHP Scanner.

Frequently Asked Questions

Is my website affected by PHP2Shell?

It may be affected if it runs PHP and that PHP is older than the fixed releases: 8.2.35, 8.3.36, 8.4.27 or 8.5.12. Sites on Webflow, Shopify, Squarespace or Wix don't run PHP that you manage. If your business also has a WordPress blog or a portal on another address, check that address separately.

Does updating WordPress fix PHP2Shell?

No. WordPress updates its own files, while PHP is installed on the server and updated by your host or developer.

Can an online check prove my site can't be attacked?

No outside check can prove that, because proving it would mean attacking the site. A trustworthy checker tells you what it saw and what it couldn't see. PHP Scanner shows its evidence and its limits with every result.

What if my PHP is older than the fix?

Ask your host or developer to update PHP to the fixed release for your line, then restart PHP. If they can't do it right away, PHP published temporary settings that close some attack paths. PHP2Shell workarounds lists them.

‍

Sources: PHP security release announcement, October 21, 2026, The PHP Foundation, Canadian Centre for Cyber Security AL26-026, The Hacker News, W3Techs, and PHP supported versions.