Security Assessment
We check your PHP version, identify any risks and provide clear recommendations.
PHP2Shell critical security alert
Is Your Website at Risk
Is Your Website at Risk
from the PHP2Shell Vulnerability?
Two critical PHP vulnerabilities, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), have been discovered. Your WordPress, WooCommerce, Laravel or custom PHP website may need an urgent PHP update.
- Free Security Assessment
- Professional PHP Updates
- Backup & Compatibility Check
- Keep Your Website Safe & Secure
Request a Free
PHP Security Assessment
Let our experts check if your website is affected and advise the best solution.
Protect Your Business
Prevent security breaches and data loss
Keep Your Website Online
Avoid downtime and disruptions
Better Performance
Take advantage of the latest PHP improvements
Expert Support
Supporting businesses worldwide
What Is PHP2Shell?
Two Critical PHP Vulnerabilities: CVE-2026-109618 and CVE-2026-109619
On October 21, 2026, two critical security vulnerabilities, now known as PHP2Shell, were disclosed in PHP: CVE-2026-109618 and CVE-2026-109619. Both have a critical severity score of 9.2/10 and could potentially allow attackers to execute malicious code remotely without authentication.
The flaws are in the PHP engine itself, so every PHP version from 5.4 up to 8.5.11 is affected, whether your site runs on Apache, PHP-FPM, LiteSpeed or Nginx. Updating WordPress, WooCommerce, Laravel or your plugins does not fix PHP2Shell. The PHP version on your server has to be patched or upgraded.
Last updated:
If your website is running an affected PHP version, it’s important to update as soon as possible.
Patched PHP Versions
Update to the latest patched version to stay secure from PHP2Shell:
| Your PHP branch | Patched version |
|---|---|
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |
| PHP 8.1 and older | Upgrade or obtain verified vendor security backports |
Is My Website Affected by PHP2Shell?
Your website is likely at risk if any of these apply:
- It runs on any PHP version from 5.4 to 8.5.11
- It is on PHP 8.1, 8.0, 7.4 or older, which no longer get official fixes
- Your hosting provider has not confirmed that the PHP patch is installed
- You run WordPress, WooCommerce, Laravel, Drupal, Magento or a custom PHP application
How to Check Your PHP Version
- WordPress: go to Tools > Site Health > Info > Server.
- cPanel: open “Select PHP Version” or “MultiPHP Manager”.
- Other hosting: ask your host which PHP version and patch level your site uses.
Not sure what you are looking at? We will check it for you, free.
Check My WebsiteOur PHP2Shell Fix & PHP Security Update Services
We help businesses patch PHP2Shell, update PHP and keep their websites secure, with minimal disruption.
PHP Updates & Patching
Safely update PHP to the latest secure version and apply necessary patches.
Compatibility Fixes
Resolve any theme, plugin or custom code issues after the update.
Backup & Testing
We take a full backup, test your website and ensure everything works correctly.
Why Choose Createch IT Solutions?
We’re a web development company helping businesses around the world, with years of experience in WordPress, WooCommerce, Laravel and custom PHP websites.
Experienced Team
Skilled in PHP, WordPress and Laravel
Proven Track Record
Trusted by businesses around the world
Transparent Pricing
No hidden costs
Ongoing Support
We’re here when you need us
Our Simple Process
A straightforward and risk-free approach to keep your website secure.
- 1
Free Assessment
We review your website and check your PHP version.
- 2
Plan & Quote
We recommend the best solution with a clear quote.
- 3
Update & Test
We update PHP, fix any issues and test everything.
- 4
Ongoing Support
Your website stays secure and we’re here to help.
PHP2Shell Fixes for All Major PHP Platforms
PHP2Shell affects every platform that runs on PHP. From popular CMS platforms to custom-built applications, we can help.
- WordPress
- WooCommerce
- Laravel
- Custom PHP Websites
- Other PHP Applications
Keep Your Website Secure and Up to Date
Get a free PHP security assessment from our experts today.
PHP2Shell: Frequently Asked Questions
What is PHP2Shell?
PHP2Shell is the name given to two critical vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619, disclosed on 21 October 2026. CVE-2026-109618 is a memory-corruption flaw in how PHP handles running out of memory. CVE-2026-109619 is a use-after-free flaw that can let data from one request carry over into the next request handled by the same PHP worker. Both are rated 9.2 out of 10 and could let an attacker run code on your server without logging in.
Will updating WordPress or my plugins fix PHP2Shell?
No. PHP2Shell is in PHP itself, not in WordPress, WooCommerce, Laravel or any plugin or theme. Updating your CMS does not fix it. The PHP version on your server has to be patched or upgraded, which is done by your hosting provider or by a developer with server access.
How do I know if my website is affected?
Every PHP version from 5.4 up to 8.5.11 is affected unless it has been patched. Many hosting accounts are not updated automatically. Request a free assessment and we will check your PHP version and tell you exactly what needs doing.
Which PHP versions fix CVE-2026-109618 and CVE-2026-109619?
The fixes are in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. If your site is on one of these branches, update to that version or later.
Is PHP 8.1 or PHP 7.4 affected?
Yes. PHP 8.1 and older have reached end of life, so the PHP project is not releasing official fixed versions for them. The safest option is to upgrade to a supported, patched version such as PHP 8.3 or 8.4. If you cannot upgrade straight away, a verified security backport from your hosting or Linux vendor is the minimum.
How can I check my PHP version?
In WordPress, go to Tools > Site Health > Info > Server. In cPanel, open "Select PHP Version" or "MultiPHP Manager". Your host can also tell you. Or request a free assessment and we will check it for you.
Will the update break my website?
Older themes, plugins and custom code are not always compatible with newer PHP versions. That is why we take a full backup and test your site on the new version first, fix anything that breaks, and only then switch your live website over.
How long does the update take?
Most WordPress and WooCommerce websites can be updated within one to two working days. Larger custom PHP or Laravel applications depend on how much code needs checking, so we give you a clear timeline with your quote.