Which PHP versions fix PHP2Shell?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. PHP 8.1 and older get no new release, so move to 8.2 or newer. Support for PHP 8.2 ends on 31 December 2026, so plan that upgrade too.

My host manages the server. Do I need to do anything?

Your host installs the update, but check it: ask them when they patched and which PHP version your site runs, and make sure it is 8.2 or newer.

What does this check send to my website?

One normal request to your homepage, like any visitor. We look for signs of PHP and its version in what comes back. We don’t try the attack and we don’t log in.

The check says my PHP version has the fix. Am I safe?

Not necessarily. It shows the fix is installed now. If the site ran an older version after 20 October, check for a break-in: new .php files in upload folders, admin users you don’t recognise, new cron jobs and recently changed core files.

We found signs of a break-in. What now?

Don’t just delete the strange files. Restore a clean backup from before 20 October, update PHP, and change every password: admin, hosting, database, SFTP and API keys. If you’d rather have help, we start the same day.

Free check · PHP2Shell

Is your website at risk from PHP2Shell?

Two critical PHP bugs leaked on 20 October 2026 and are being exploited. Enter your website and we look at what any visitor can see: whether it runs PHP, and which version. We send one normal request to your homepage, nothing else.

Fixed versions

You run	Update to at least
PHP 8.5	8.5.12
PHP 8.4	8.4.27
PHP 8.3	8.3.36
PHP 8.2	8.2.35
PHP 8.1 or older	No fix: move to 8.2+

What to do now

1 Check your PHP version in 2 minutes

Shared or managed hosting: open your hosting dashboard and look for "PHP version" or "PHP settings" for the site.
WordPress: go to Tools → Site Health → Info → Server. The PHP version is listed there.
Your own server: run php -v. With PHP-FPM, also check the version the web server really uses, for example with a phpinfo() page that you delete right after.
Compare: you need 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer. PHP 8.1 and older get no fixed release.

2 Until you’ve updated

Make a full backup of your files and database, and keep it somewhere other than the server.
Apply PHP’s interim settings in php.ini or your FPM pool, then restart PHP. They lower the risk, they don’t fix it.
Behind Cloudflare or another CDN? Let your server accept traffic only from that CDN.
A webshop or a site with customer data you can’t patch today: put it in maintenance mode, or allow only page views.

3 After updating: check for a break-in

New or changed .php files in upload folders: wp-content/uploads for WordPress, storage/ and public/ for Laravel.
Admin users you don’t recognise, in WordPress or in your hosting panel.
New cron jobs or scheduled tasks.
WordPress core files that changed recently, and redirects to sites you don’t know.

What PHP2Shell is and what to do, step by step →

Rather not do this yourself?

We'll upgrade it for you

A senior developer updates PHP, closes what shouldn't be open and checks for a break-in. We start the same day, at $85 an hour.

We'll upgrade it for you

Run the full free scan on EngineeringScore

Security headers, exposed secrets, outdated software and more, in one free report.

Start the free scan →

FAQ

Frequently Asked Questions

Everything you need to know about how we work, what we deliver, and how we create long-term value for your business.

Kitar

COO

Still have questions?

Can't find what you're looking for? Our team is here to help! Whether you need clarification, have a specific question, or want to learn more about our services, we'd love to hear from you. Let's get you the answers you need.

Yes, if it runs on a PHP version without the fix, and almost every WordPress and WooCommerce site runs on PHP. The bugs are in PHP itself, so updating WordPress, themes or plugins doesn’t help: PHP has to be updated.

Got a dev problem?

You don't need to know exactly what's wrong. That's kind of the point.

Send the signal