Security | Scale SEO AI | SEO Agency for Google and AI Search

Synopsis

On 21 October 2026, PHP fixed two critical flaws, known as PHP2Shell, that let attackers take over a server without logging in. Make sure your site runs PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer, or ask your host to confirm they’ve applied the fix. On PHP 8.1 or older, you need a patched build from your host or a move to PHP 8.3+. Updating WordPress alone won’t fix this.

Is your site affected?

Almost certainly, if it runs on PHP and its server hasn’t been patched since 21 October 2026. PHP2Shell affects every PHP version from 5.4 up to 8.5.11, and it lets an attacker run their own code on your server with no password and no login.

And PHP is everywhere. WordPress, WooCommerce, Laravel, Drupal, Magento and most shared hosting plans run on it. So when PHP itself has a hole, it doesn’t matter how carefully your own site was built. Millions of sites are in the same boat at once.

One thing trips people up: a lot of hosts (CloudLinux, cPanel, Ubuntu) patch PHP in place without changing the version number. So if your dashboard says 8.3.35, don’t panic yet. You might already be covered. Ask your host whether they’ve applied the 21 October PHP security release, or check the package changelog for both CVE numbers (InMotion Hosting).

Which PHP versions are still supported in 2026?

Right now, only four versions get security fixes: PHP 8.2, 8.3, 8.4 and 8.5. Everything older is on its own.

PHP’s support model is simple once you see it. Each version gets two years of full support, then two more years of security-only fixes, and every cut-off lands on 31 December (php.net).

PHP version	Status (Oct 2026)	Security fixes until	Safe build after PHP2Shell
8.5	Active support	31 Dec 2029	8.5.12 or later
8.4	Active support	31 Dec 2028	8.4.27 or later
8.3	Security fixes only	31 Dec 2027	8.3.36 or later
8.2	Security fixes only	31 Dec 2026	8.2.35 or later
8.1 and older	End of life	Already ended	No official fix

Two things jump out. PHP 8.2 runs out of support in about two months, so if you’re upgrading anyway, skip it and go straight to 8.3 or newer. And old versions are far more common than you’d think: in late September 2026, about 16.7% of WordPress sites reporting to WordPress.org were still on PHP 7.4 (Xictron). That version hasn’t had a single fix since 2022.

How do you check and update your PHP version?

Check which PHP version your site runs, take a backup, update to PHP 8.3 or newer (or confirm your host has applied the 21 October fix), then restart PHP and double-check. Who does each step depends on your hosting.

Who has to act depends on your hosting. On managed WordPress hosting, the host patches PHP for you. On shared hosting with cPanel, the host patches the server but you choose the version. On a VPS or cloud server you manage, nobody patches it unless you do.

Step 1: Find out which PHP version you’re running

WordPress: go to Tools → Site Health → Info → Server.
cPanel: look under Software → Select PHP Version (or MultiPHP Manager).
Your own server: run php -v over SSH. Check what the website uses too, because the command line and the web server don’t always match.

Step 2: Back up, then test on a copy

Take a full backup of your files and database before you change anything. Jumping from PHP 7.x or 8.1 to 8.3 can break older themes and plugins, so try the new version on a staging copy first. Click through the homepage, your forms, the login page and checkout before you touch the live site.

Step 3: Update PHP

On shared hosting (cPanel): choose PHP 8.3 or 8.4 in MultiPHP Manager or Select PHP Version, then save.

On an Ubuntu or Debian server:

sudo apt update
sudo apt upgrade        # installs patched PHP packages from your configured repositories

# Then restart whatever runs PHP on your server (replace 8.3 with your version):
sudo systemctl restart php8.3-fpm   # PHP-FPM (Nginx, or Apache with FPM)
sudo systemctl restart apache2      # Apache with mod_php

On Docker: pull the latest official tag (for example php:8.3-fpm), rebuild your image and redeploy. A running container keeps its old PHP until you rebuild it.

On a cPanel/WHM server you manage: install the updated EasyApache 4 PHP packages (through WHM or a system update such as dnf update), then restart Apache and PHP-FPM.

Step 4: Restart and double-check

This is the step people skip. Installing the update isn’t enough on its own, because the old PHP keeps running in memory until you restart PHP-FPM, Apache, LiteSpeed or FrankenPHP.

Once you’ve restarted, confirm the fix actually landed. On Ubuntu or Debian, run apt changelog php8.3-fpm | grep CVE-2026-1096 (use libapache2-mod-php8.3 for mod_php). On AlmaLinux or RHEL, run rpm -q --changelog <php package> | grep CVE-2026-1096. You should see both CVE numbers. Packages from third-party repositories may not show a changelog this way, and on shared hosting the easiest check is simply to ask your host.

Can’t update today? Do this in the meantime

PHP has shared some interim settings, but be clear on what they are: they block the attack paths confirmed so far, not the bug itself (Google Cloud). Put them in the main php.ini, an FPM pool or the server config. Don’t use .htaccess, .user.ini or ini_set(), because those kick in too late. Then restart every PHP worker.

session.upload_progress.enabled = 0   ; blocks the confirmed session paths of CVE-2026-109619
fatal_error_backtraces = 0            ; PHP 8.5 only

There’s no safe config-only workaround for CVE-2026-109618. A web application firewall like Cloudflare, whose PHP2Shell rules are on by default even on the free plan, gives you an extra layer, but only for traffic that actually passes through it. So treat all of this as buying time, and patch as soon as you can.

What if your website breaks on newer PHP versions?

Don’t leave it exposed, and don’t rebuild it overnight either. Find exactly what breaks, get a patched build of your current PHP version, shrink the attack surface, then isolate the site and plan your way out.

This is common for sites built years ago on PHP 7, or with a theme that hasn’t been updated since: switch to PHP 8.3 and pages go blank. Here’s how to keep the site safe while you sort out the code.

Step 1: Find out exactly what breaks

Copy the site to a staging environment and switch the copy to PHP 8.3. Write down every error, blank page and broken form.
On WordPress, add define('WP_DEBUG', true); and define('WP_DEBUG_LOG', true); to wp-config.php on the staging copy, then read wp-content/debug.log. You need both lines; the log setting does nothing on its own.
For custom code, scan it with PHPCompatibility for PHP_CodeSniffer. Use version 10 (composer require --dev phpcompatibility/php-compatibility:"^10.0@dev"). It’s still in alpha, but the older 9.x release barely covers PHP 8 changes (WordPress Core Trac). Rector can then fix a lot of issues automatically. No scanner catches everything, so test by hand too.
Very often, it’s just one or two plugins causing the trouble. Swap them for maintained alternatives and the rest of the site may upgrade without a fight.

Step 2: Get a patched build of your current PHP version

The PHP team won’t patch 8.1 or older, but other vendors backport security fixes, including the PHP2Shell fix (InMotion Hosting).

Where your PHP comes from	Patched older versions
Shared hosting on CloudLinux (PHP Selector)	Every version, 5.2 to 8.5
cPanel servers (EasyApache `ea-php`)	7.4, 8.0 and 8.1 backported; 7.3 and older get no fix
Ubuntu/Debian with Ondřej Surý’s packages	Fix backported to 8.1 and older
Paid extended support (TuxCare ELS, HeroDevs NES)	Older branches, kept patched on an ongoing basis

Ask your host which of these they use. On shared hosting, a patched older build may still show the old version number.

Step 3: Shrink the attack surface while you’re on old PHP

Set session.upload_progress.enabled = 0 in the main php.ini or FPM pool and restart PHP. This blocks only the confirmed attack paths for CVE-2026-109619; no setting reliably stops CVE-2026-109618. Use it alongside Step 2, never instead of it.
Put the site behind Cloudflare or another web application firewall. Cloudflare’s PHP2Shell rules switch on automatically on the free plan; on paid plans, check that the Managed Ruleset is set to block (PPC Land). This only helps if all your traffic goes through Cloudflare, so set your server firewall to accept web traffic from Cloudflare’s IP ranges only.
With a WAF or ModSecurity rule, block multipart/form-data posts on URLs that don’t accept uploads, and keep upload size limits low.
Lock down the admin area. Restrict wp-login.php and /wp-admin/ to known IP addresses, but leave /wp-admin/admin-ajax.php open, because plenty of themes and plugins use it for regular visitors. Turn on two-factor login too.
Disable risky functions (exec, system, shell_exec) and stop PHP from running in upload folders.
Take daily off-site backups so you can bounce back fast if something does get through.

Step 4: Isolate it, then plan your way out

If the old site doesn’t need logins, a shop or live forms anymore, turn it into a static HTML copy. On WordPress, plugins like Simply Static do this. No PHP means no PHP vulnerabilities.
Host it on its own server or account so a break-in can’t spread to your other sites.
If it’s unpatched and you manage the server yourself, WordPress.org and the UK’s National Cyber Security Centre suggest considering taking it offline until it can be upgraded (Codeable).
Set a real deadline to fix or rebuild the code. Backports and firewalls buy you time. They’re not a permanent fix.

What is PHP2Shell, and why is it such a big deal?

PHP2Shell is a pair of bugs inside the PHP engine itself, both rated 9.2 out of 10 (Critical). They affect every PHP version from 5.4 all the way up to 8.5.11 (Google Cloud).

You don’t need to understand the internals to protect yourself, but here’s roughly what’s going on:

CVE	What goes wrong, in plain English	What an attacker gets
CVE-2026-109618	When PHP runs out of memory mid-request, it can leave some internal data half-built and later treat that broken data as valid.	Runs their own code, no login needed
CVE-2026-109619	Some data from one request sticks around after its memory is freed, so the next request on the same worker can pick it up.	Runs their own code and can leak memory

A few things make this one worse than the usual security patch:

Updating WordPress won’t save you. The bug lives below WordPress, your plugins and your theme. WordPress.org has confirmed there’s no WordPress update coming for this; the fix is the PHP update and nothing else (Codeable).
Attackers got a head start. Details leaked before the patch was out, and a working exploit showed up early. Cloudflare saw attack attempts climb into the millions within a day.
Some setups are hit harder. The risk is highest on Apache with mod_php, where the bug can fire before your site’s code even loads.
Old versions were left out. The PHP team only patched 8.2 to 8.5. If you’re on 8.1 or older, your fix has to come from your host, your Linux distribution or a paid support vendor.

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

How do you harden PHP so the next flaw does less damage?

Updating closes today’s hole. Hardening is what makes sure the next one, and there will be a next one, doesn’t turn into a disaster. Go through this once, then come back to it every few months.

Production php.ini settings

expose_php = Off
display_errors = Off
display_startup_errors = Off
log_errors = On
allow_url_include = Off
session.cookie_httponly = 1
session.cookie_secure = 1             ; only if the whole site runs on HTTPS
session.use_strict_mode = 1
session.upload_progress.enabled = 0   ; unless your app shows upload progress bars
post_max_size = 8M                    ; raise if you upload large media
upload_max_filesize = 4M
disable_functions = exec,passthru,shell_exec,system,proc_open,popen

Tune the upload limits and disable_functions to what your site really needs. Some backup, image-processing and security plugins rely on those functions, so test on staging first.

Server and site checklist

Run a supported PHP version (8.3 or newer) and turn on automatic security updates if your host allows it.
Run PHP as its own low-privilege user, with the web root read-only except for upload and cache folders.
Block PHP from running inside wp-content/uploads and any other upload folder.
Run composer audit and update WordPress core, plugins and themes every week. Delete anything you’re not using.
Put a web application firewall in front of the site (Cloudflare, Sucuri or your host’s ModSecurity rules).
Block outbound internet access from the web server where you can, so an attacker can’t pull in more malware.
Keep daily off-site backups, and actually test a restore at least once.
Keep an eye on logs for PHP worker crashes, odd PHPSESSID cookies and shell commands started by the web server user.
Use strong passwords and two-factor login for your hosting account, cPanel, SSH and CMS admin.

What other PHP vulnerabilities should you watch for?

PHP2Shell is grabbing headlines, but honestly, most hacked PHP sites aren’t broken into through PHP itself. They get in through the site’s own code, an old plugin or a forgotten theme. These are the usual suspects, and the fix for each one:

Vulnerability	How it happens	How to prevent it
SQL injection	Visitor input gets pasted straight into a database query.	Use prepared statements (PDO or mysqli) for every query.
Cross-site scripting (XSS)	Visitor input is printed on a page without escaping.	Escape output with `htmlspecialchars()` or your framework’s template escaping.
File inclusion (LFI/RFI)	A filename from the URL is passed to `include` or `require`.	Never include files based on user input; use a fixed allow-list and keep `allow_url_include = Off`.
Unsafe file uploads	Uploaded files land in the web root and can run as PHP.	Check type and size, rename files, store them outside the web root, block PHP in upload folders.
Insecure deserialization	`unserialize()` runs on data a visitor controls.	Use `json_decode()` instead, or pass `allowed_classes => false`.
Command injection	Visitor input reaches `exec()`, `system()` or `shell_exec()`.	Avoid shell calls; if you must, use `escapeshellarg()` and disable functions you don’t need.
Weak sessions and passwords	Predictable sessions, or passwords stored as plain text or MD5.	Use `password_hash()`, regenerate the session ID at login, set Secure and HttpOnly cookies.
Outdated dependencies	Old plugins, themes or Composer packages with known holes.	Run `composer audit` and keep plugins and themes updated on a schedule.

Why is PHP security an SEO problem too?

A hacked site rarely just goes down. More often, it keeps running and quietly serves spam pages, hidden links or redirects. And search engines usually notice before the site owner does.

Search warnings: Google can label a hacked site in search results, and Chrome can show a full-page warning for malware. Either one can wipe out your clicks overnight.
Spam injection: attackers often add thousands of junk pages. They waste your crawl budget and can lead to a manual action for hacked content.
Lost visibility in AI search: AI-powered search features draw on the same index, so pages that drop out of results lose that exposure too.
Speed: newer PHP versions generally run faster, which can lower server response time, one of the inputs to Core Web Vitals.

If you think your site’s been hit, open the Security Issues report in Google Search Console, clean up the site, then request a review.

Frequently asked questions

What is PHP2Shell?

PHP2Shell is the nickname for CVE-2026-109618 and CVE-2026-109619, two critical flaws in the PHP engine that were fixed on 21 October 2026. They let an attacker run code on a server without logging in.

Which PHP versions fix PHP2Shell?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or a build from your host or Linux distribution with the fix backported.

Does updating WordPress fix PHP2Shell?

No. The flaw is in PHP, not WordPress. You or your host have to update PHP itself.

Is PHP 7.4 or 8.1 still safe to use?

Not for the long term. The PHP project no longer fixes them. Some hosts and paid vendors ship patched builds that cover PHP2Shell, but you should still plan a move to PHP 8.3 or newer.

Which PHP version should I upgrade to?

PHP 8.3 or 8.4. PHP 8.2 stops getting security fixes on 31 December 2026, so it’s not worth moving to now.

Will updating PHP break my website?

It can, especially on older themes, plugins or custom code. That’s why you should test the new version on a staging copy first and keep a full backup.

How do I know if my site was already hacked?

Look for admin users you don’t recognise, new PHP files in upload folders, strange redirects, spam pages showing up in a Google site: search, and warnings in Search Console.

The bottom line

Check your PHP version today. Seriously, it takes a minute. If it’s below 8.5.12, 8.4.27, 8.3.36 or 8.2.35, update now or get your host to confirm they’ve applied the 21 October fix. If you’re still on 8.1 or older, plan your move to 8.3 or newer this month, and test it on staging before it goes live.

Need a hand? Scale SEO AI can audit your site’s PHP version, security setup and search health, and fix what we find. Get in touch for a free site check.

Prefer to watch instead?

Not in the mood to read all of this? This video walks through the same essentials: how to check your site’s PHP version, how to confirm your host has patched PHP2Shell, and how to reduce your exposure while you wait.

▶ Watch: All PHP Websites Are At Risk | 4 Step Process To Keep Your Website Safe (Amit Tiwari, YouTube)

Category: Security

PHP Vulnerabilities in 2026: How to Update and Secure Your PHP Site