Check your PHP version
Type the PHP version your website or server runs. You can find it in cPanel under Select PHP Version or MultiPHP Manager, or by running php -v on the server.
Runs in your browser; nothing is sent to us. Linux distributions such as Ubuntu, Debian and Red Hat sometimes patch PHP without changing the version number, so if you use their packages, also check your vendor's advisory.
What PHP2Shell is
PHP2Shell is the name given to two critical vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619, which the PHP project rates as critical. Some reports give a severity score of 9.2 out of 10 unverified. The PHP project says both can allow unauthenticated remote code execution: an attacker who can send a request to the server may be able to run their own commands on it.1
The researchers who found the flaws also warn they can expose server memory, which may contain passwords, login tokens, API keys and certificates.3 The PHP project's advisory does not say this unverified. Because the bug sits in PHP rather than in any one app, updating WordPress, Drupal, plugins or themes does not fix it. Updating PHP does.
Who is affected
- Every PHP installation that serves web requests, whether through PHP-FPM, Apache mod_php, php-cgi, FrankenPHP or LiteSpeed.1
- Every version before the fixed releases. The researchers say versions back to PHP 5.4 are affected; the PHP project's advisory does not give a lower bound unverified.3 The PHP project says the risk is highest on Apache with mod_php, where an attack can trigger before any application code runs.1
- News reports say exploitation has been demonstrated against widely used platforms including WordPress, Drupal, Joomla, Magento, Laravel, Symfony, Nextcloud and phpMyAdmin unverified.2
| PHP branch | Fixed in | Note |
|---|---|---|
| 8.5 | 8.5.12 | Current |
| 8.4 | 8.4.27 | Supported |
| 8.3 | 8.3.36 | Supported |
| 8.2 | 8.2.35 | Security support ends 31 December 2026 |
| 8.1, 8.0, 7.4 | No official release | The PHP security team published source-code patches; upgrading is safer |
| Older | None | Long out of support: upgrade |
Source: PHP security release, 21 October 2026.1
Found with AI, attacked at AI speed
PHP2Shell was found by researchers from Wiz, OpenAI's Codex Security team and Calif, working with Google's Gemini team.3 Google Cloud said AI models contributed to discovering the flaws, developing the exploit, detecting attacks and validating the patch.2
Details leaked online before the fix was ready. One security firm predicted mass exploitation within 15 minutes of the patch release, and security firms reported exploitation attempts soon after.4,5 On 21 October, Canada's Cyber Centre said no active exploitation had been identified yet, but that a proof-of-concept exists.6 This is the pattern we warn about. AI shortens the gap between a flaw being found and being used, and defenders have hours, not months.
What to do now
- Find every PHP runtime. List each website, server and container running PHP, with its version and how it runs (mod_php, PHP-FPM, LiteSpeed). Include old, forgotten and third-party systems.
- Prioritise what faces the internet. Public websites, portals and APIs first, starting with Apache mod_php.
- Patch. Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your Linux vendor's fixed package, and restart all PHP workers. On managed hosting, ask your provider to confirm.
- Contain what you can't patch today. The PHP project publishes interim settings that reduce the risk. If even that isn't possible, news reports say the NSA advises taking the system offline until it is fixed unverified.2
- Rotate secrets. If a server was exposed, assume anything in its memory may have been read. Replace passwords, API keys, tokens and certificates after patching.
- Watch for attacks. Monitor logs and traffic for exploitation attempts, and keep watching after you patch.
How Aki Labs can help
Our PHP2Shell rapid response is an assessment service delivered by our team, separate from the Aki Horizon product. It is passive and read-only: we never try to break in.
- Exposure inventory: the PHP runtimes, versions and server modes in the scope we agree with you, in one view.
- Priority plan: internet-facing and high-value systems first, with interim containment for anything that can't be patched today.
- Secret rotation: a key-by-key plan to replace credentials, API keys and certificates that may have been exposed. This is our core expertise in cryptography and key management.
- Evidence: a short report for your board, insurers and regulators showing what was found, fixed and verified.
The Rapid Exposure Assessment starts from £2,500 for up to 10 systems. See pricing.
Items marked unverified come from news reports or the researchers and are not stated in the PHP project's own advisory.
- PHP: Security advisory: Critical remote code execution vulnerabilities, update now (21 October 2026)
- Newsweek: PHP vulnerability, list of websites powered by PHP as hacker threat prompts scramble (21 October 2026)
- PHP2Shell disclosure site (Wiz)
- SecurityWeek: PHP2Shell, mass exploitation looms for leaked critical PHP flaws
- watchTowr: PHP2Shell remote code execution exploited
- Canadian Centre for Cyber Security: AL26-026, critical vulnerabilities impacting PHP (21 October 2026)