Website Without PHP
English (United Kingdom)GB
  • English (United States)
  • English (United Kingdom)
  • Dutch (Netherlands)
  • Dutch (Belgium)
Menu

PHP2Shell, explained in plain language

You do not need to be technical to read this.

Which PHP version does your site report?

We read only what your site already sends in public: the headers and the top of the homepage. No scan, no login.

What should I do?

More about this

In five minutes you know what is going on and what to do.

Sources and details

Based on the confirmed facts from our status page last checked

How the flaw works, and how you fix it
  1. Step 1 Your site runs on PHP A version without the latest fix carries this risk.
  2. Step 2 The PHP project reports the flaw php.net, 21 October 2026
  3. Step 3 Your host or we update PHP To a fixed release: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35
  4. Step 4 The fix is in Then confirm the version: with the check if your site reports it, otherwise with your host. Up to date
PHP 8.1 or older? No more updates from the PHP project. Then migrating or rebuilding is the route.
Source: php.net security advisory, checked on 22 October 2026.

In one sentence

A serious security holeA vulnerability is a weakness in software that an attacker can use to do something the software was never meant to allow, such as reading private data. was found in PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it., the software behind many websites. A fix is available: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Have it installed as soon as possible.

What is PHP?

PHP is the engine behind many websites. WordPressWordPress is free software for building and editing a website in your browser. It is written in PHP, so it builds each page when someone visits. and most web shops run on it, for example. You do not see it as a visitor: it runs on the server of your hosting providerWeb hosting is the service that keeps your website's files on a computer that is always online, so visitors can open your site at any time., out of sight.

Think of it like the engine of a car. You drive the car (your website), but the engine is under the hood.

What went wrong?

Two holes were found in that engine. Through them, an outsider can run commands on the server where your website lives, without logging in.

In practice that can mean: someone takes over your website, changes it, or looks at data that is stored on it.

Does this affect my website?

If your website runs on PHP and has not been updated yet: very likely. Older PHP versions (8.1 and older) no longer get updates at all.

Not sure what your website runs on? Use the check below, or ask your hosting provider or the person who built your website.

What should I do?

  1. Ask your hosting provider or web developer to update PHP to a fixed version (PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35).
  2. Make sure a recent backupA backup is a separate copy of your website's files and database, so you can bring the site back after a mistake, a hack or a failed update. of your website exists before the update.
  3. Does your website run on PHP 8.1 or older? Then a regular update is not enough. Ask about an upgrade to a supported version.
  4. Do you not have anyone to do this? We can do it for you. Use the form on this page.

Want to hand it off? Have your PHP updated to a supported version. Want to know where you stand first?

Check which PHP version you run.

Is it being abused already?

CISA: both vulnerabilities added to the KEV list on 26 October (catalogue 2026.10.26); that does not say an attack succeeded. Since 27 October, CISA's SSVC assessment in both CVEA CVE is a public ID number for one known security weakness in software, such as CVE-2026-109618, so everyone talks about the same problem. records reads 'Exploitation: active', meaning reliable evidence that attackers are exploiting it in the wild; CISA does not say in those records whether an attack succeeded. Amazon: attempt on 17 October; whether it could succeed is unknown.

Sophos: attempts blocked by Sophos protections (22 October correction). Previdian: no successful code execution (22 October). None of these sources reports whether any attack succeeded.

See also which rumours are true and which are not.

Words you may come across: Security hole (vulnerability)A mistake in software that someone can misuse to get in., Update (patch)A new version of the software in which the mistake has been fixed., Hosting providerThe company where your website is stored and runs., CVE numberAn official ID for a security hole, so everyone knows which one is meant.

Want the details?

The status page lists every fact with its source and the time we checked it, plus a live timeline.

Go to the status page

  1. Domain
  2. Check
  3. Result
  4. Report

Which PHP version does your site run?

Enter your domain. We read only what your site already sends in public: the headers and the top of the homepage. No scan, no login.

We keep the domain and the result, never your IP address.