PHP security support
Do you need help with PHP2Shell?
If your website or business application runs on PHP, we can help you check your exposure, apply security fixes and investigate signs of compromise.
Book a callFor urgent help, call 1300 878 770.
What is PHP2Shell?
PHP2Shell is the name given to two critical vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619. Crafted web requests can corrupt PHP’s memory or leave stale internal state, potentially allowing an attacker to run code without logging in.
PHP’s advisory covers installations serving web requests, including PHP-FPM, Apache mod_php, CGI, FrankenPHP and LiteSpeed. It identifies mod_php as the highest risk, with a demonstrated attack before application code runs.
Successful exploitation runs with the web worker’s permissions. Depending on its access, this could expose customer data, database credentials or API keys, allow malicious files to be installed, disrupt services or provide access to connected systems.
Which systems should you check?
Common PHP applications to include in your review:
- WordPress, Drupal and Joomla websites.
- Magento / Adobe Commerce and WooCommerce shops.
- Laravel, Symfony and other custom PHP applications.
- PHP-based customer portals, admin tools and legacy systems.
Exposure depends on the underlying PHP runtime and configuration. An up-to-date application can still use a vulnerable PHP runtime.
Security fixes are available
PHP released fixes on 21 October 2026. Updating is the complete solution; temporary controls only reduce some attack paths. Patching does not remove an existing compromise.
Is your application running an older PHP version?
We can likely still help. PHP has provided source backports of the PHP2Shell fixes for PHP 7.4, 8.0 and 8.1. Depending on your hosting and how PHP is installed, we can apply those fixes without requiring an immediate application upgrade. We’ll check compatibility and test your application as part of the work.
These backports address PHP2Shell specifically. They don’t restore ongoing security support for older PHP versions, so we can also help you plan an upgrade.
Read the PHP security advisoryInformation checked on 22 October 2026.
How we can help
We start with a rapid check of your exposure. Our first priority is then mitigation: working quickly with you and your hosting provider to restrict access and contain the threat before moving on to patching and cleanup. A fuller investigation follows once containment measures are in place.
Detection
- Identify exposed PHP applications, runtime versions and hosting configurations.
- Check available logs, files and processes for signs of exploitation or persistence.
Mitigation
- Restrict access to exposed services and isolate suspected compromised systems.
- Configure a web application firewall (WAF), or help you move traffic through Cloudflare and restrict direct access to your origin server.
- Apply appropriate temporary controls while preparing the PHP update.
Patching
- Update PHP or apply your hosting vendor’s verified security fixes.
- Apply source backports for PHP 7.4, 8.0 or 8.1 where your hosting setup allows it.
- Restart affected workers and check the running web application is patched and working.
Cleanup
- Preserve available evidence, then remove malicious files and persistence or rebuild affected systems.
- Rotate exposed credentials and check restored services before returning them to use.
Blast radius report
- Assess which applications, data, credentials and connected systems may have been exposed.
- Receive a written report covering findings, evidence gaps and prioritised next steps.
Advice
- Work through your hosting options, PHP support status and upgrade requirements.
- Review file permissions, service accounts, database access and API credentials to limit what a compromised application could reach.
- Get practical recommendations for monitoring, access controls and future patching.
PHP2Shell questions answered
How do I know if my website is affected by PHP2Shell?
Check the PHP runtime serving your website against the PHP advisory or your hosting vendor’s security notice. Check the web server’s runtime, as it may differ from the command-line version. We can review your setup and confirm whether a fix is installed.
Can you fix PHP2Shell on PHP 7.4 without upgrading my application?
We can likely help. Source backports are available for PHP 7.4, 8.0 and 8.1. We’ll check whether they can be applied to your hosting setup and test compatibility. These fixes address PHP2Shell; they don’t restore ongoing security support for older PHP versions.
Will updating WordPress or Laravel fix PHP2Shell?
Updating WordPress or Laravel alone does not fix PHP2Shell. The vulnerabilities are in PHP itself, so the PHP runtime needs a security fix. Your hosting provider may need to apply it.
What signs might I see if my website has been exploited?
Possible signs include unexpected redirects or page changes, unfamiliar PHP files, unexplained slowdowns or outages, and unusual server processes or outbound connections. These can have other causes, and an attacker may leave no visible symptoms. We can review logs, files and processes to investigate whether your application has been compromised.
Does patching PHP2Shell remove an existing compromise?
No. Patching fixes the vulnerability, but malicious files, stolen credentials or other persistence can remain. We can investigate available evidence, clean up or rebuild affected systems, rotate exposed credentials and report on the likely blast radius.
Get your PHP application patched
Book a call to confirm the fix for your PHP application.
Get help fixing PHP2ShellFor urgent help, call 1300 878 770.