PHP2Shell Leak: What Happened, Which Hosts Are Safe, and Who Still Needs to Update PHP

PHP2Shell is the name given to two critical security flaws in PHP, the language that runs WordPress, Laravel, Magento, Drupal and a huge share of the web. Details leaked online before the official fix was ready. That forced the PHP team to rush out an emergency patch on October 21, 2026.

If you own a website, you probably want three answers. Is my site at risk? Has my hosting company fixed it? And do I need to do anything myself? This guide answers all three in plain language.

Key Takeaways

• The flaws live inside PHP itself, not in WordPress or your plugins. Clean, well-kept code does not protect you.
• News of the flaws leaked on October 20, so PHP moved its release up by one day.
• Hostinger patched all hosting plans except VPS by October 22. Most big hosts did the same.
• Shared and managed hosting customers on a patched host usually need to do nothing.
• VPS, cloud and dedicated server owners must update PHP themselves and restart PHP.
• Sites still on PHP 8.1 or older are in the highest-risk group. Upgrade to PHP 8.3 or newer.

What Is PHP2Shell?

PHP2Shell is a set of memory-safety bugs in the PHP runtime. They involve how PHP handles session data, OPcache class caching and error backtraces when a request ends abnormally.

Here is the simple version. When a request uses up its memory limit, PHP stops it suddenly. This emergency stop is called a “bailout”. During a bailout, PHP does not always clean up its internal data properly. A later request on the same worker can then reuse that leftover data. An attacker can send a carefully built request to trigger this on purpose.

One confirmed attack path uses PHP’s session upload progress feature. This feature is switched on by default in most PHP setups.

What can an attacker do with PHP2Shell?

• Remote code execution (RCE): run their own commands on your server with no login.
• Memory disclosure: read PHP worker memory, which can expose passwords, login tokens and API keys.
• File reads and crashes: read files they should not see or crash PHP workers.

The attack happens very early, before your website’s code even runs. Security firm CrowdStrike confirmed that one anonymous request could make an Apache mod_php worker start a shell. That is why a well-maintained site is just as exposed as a neglected one. Setups using Apache mod_php face the greatest danger.

Who found PHP2Shell?

Researchers from Calif, OpenAI and Wiz found the flaws in August 2026, with Quarkslab also named in the disclosure. AI models helped them turn an old, hard-to-reach flaw into a working exploit. The underlying bugs had sat in PHP for many years.

The PHP2Shell Leak: How It Went Public Early

The original plan was a coordinated disclosure on Thursday, October 22, 2026. That plan broke down. Here is what happened, in order (times in UTC).

After the release, the PHP Foundation said the early publishing of fixed images ignored weeks of coordinated work. It also admitted that one of the flaws had been known since 2024, but the small security team could not agree on a fix in time. The Foundation called this a structural failure. It is now hiring more security staff and moving decisions from consensus to a majority vote.

Which PHP Versions Are Affected by PHP2Shell?

Every PHP installation that serves web requests is affected. That includes PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Use this table to see where you stand.

The scale is huge. Qualys looked at data from 12,000 customers. It found that about 71% of PHP installations (around 110 million) run end-of-life versions from 5.4 to 8.1. Only about 199,000 had been patched in the first 12 hours.

How Hosting Providers Responded to PHP2Shell

Most good hosts followed the same pattern: block known attacks at the firewall first, then install the patched PHP. Here is what the main providers did.

Hostinger: Patched on All Plans Except VPS

Hostinger was one of the quickest to act. Here is what it did:

• Added security rules for known exploit patterns to its ModSecurity firewall. The rules run in deny mode, so matching requests are rejected straight away.
• Tested the flaw on its live servers and said it could not be used to take over sites hosted with it, WordPress included.
• Rolled out PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 across the platform. The rollout finished on October 22 at 06:44 UTC, and customers were emailed.
• Deployed patched builds for every version from 5.2 to 8.5 on Web, Cloud and cPanel hosting.

What Hostinger customers should do: On Web, Cloud and cPanel hosting, nothing. On Hostinger VPS, you manage PHP yourself, so update and restart it now. To check your version, go to hPanel → Websites → Dashboard → PHP Info. To switch versions, use PHP Configuration and choose 8.3 or newer. For more details you can visit the Hostinger: protections against php2shell Page.

PHP2Shell Patch Status by Hosting Provider

Status below reflects each provider’s public statements as of October 22, 2026. Always check your host’s status page for the latest update.

Control Panels and Linux Vendors

If you run your own server, your fix comes from your control panel or operating system, not from php.net directly.

• cPanel (EasyApache 4): fixed packages are out, including fixes for PHP 7.4, 8.0 and 8.1.
• CloudLinux: backported fixes for ea-php52 to ea-php85. Its alt-php builds reached the stable repositories at 00:07 UTC on October 22.
• Plesk: fixes for PHP 8.2 to 8.5 on Linux came first. Check the Plesk installer for older and Windows builds.
• Ubuntu, Debian 12 and 13, Red Hat and AlmaLinux: fixed packages are shipping through normal updates.
• TuxCare ELS (paid): backports for end-of-life PHP 5.x to 8.1.

Who Is Safe and Who Still Needs to Update?

You can relax (no action needed) if:

• Your site is on shared or managed hosting with a host that has confirmed the patch (Hostinger, SiteGround, Kinsta, WP Engine, Cloudways, Pantheon, GoDaddy Managed WordPress and similar).
• Your host confirms that the exact PHP version your site uses is patched.
• Your site does not use PHP at all, such as a static site or a hosted builder like Webflow.

You must act now if:

• You manage your own VPS, cloud or dedicated server. This includes Hostinger VPS, GoDaddy VPS, DigitalOcean, AWS EC2, Linode and servers run through Laravel Forge.
• Your site runs PHP 8.1, 8.0, 7.4 or older.
• Your host has published no statement about PHP2Shell.
• You run Docker images built before October 21, 2026.
• You use devices or appliances that bundle PHP. Palo Alto Networks confirmed that all PAN-OS and Panorama versions are affected, and NAS devices like Synology needed updated packages.

Still finishing updates (as of October 22):

• Bluehost and HostGator (patched builds still deploying).
• DreamHost (final server groups in testing).
• InMotion Hosting VPS fleet.
• A small list of Namecheap servers.
• Some older and Windows PHP builds on Plesk.

If your host is on this list, check its status page today. Ask support to confirm your server runs a fixed build.

How to Check Your PHP Version

Checking takes less than two minutes. Pick the method that matches your setup.

1. In WordPress: go to Tools → Site Health → Info → Server and look at the PHP version.
2. In Hostinger hPanel: go to Websites → Dashboard → PHP Info.
3. In cPanel: open MultiPHP Manager or Select PHP Version (on CloudLinux servers).
4. On your own server: run php -v for the command line. Also check the version PHP-FPM or Apache is actually using, since it can differ.
5. Compare the result with the fixed versions: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. If you use a vendor backport, check the package changelog instead.

How to Fix PHP2Shell on a VPS or Your Own Server

The fix is a package update and a restart. The hard part is finding every PHP runtime you have. Follow these steps.

Ubuntu or Debian

sudo apt update

sudo apt upgrade

# restart PHP-FPM (change 8.3 to your version) and your web server

sudo systemctl restart php8.3-fpm

sudo systemctl restart apache2   # or: sudo systemctl restart nginx

AlmaLinux, Rocky Linux or RHEL

sudo dnf upgrade “php*”

sudo systemctl restart php-fpm

sudo systemctl restart httpd   # or: sudo systemctl restart nginx

cPanel/WHM, Plesk and Docker

• cPanel/WHM: update the ea-php packages (and alt-php on CloudLinux) through system updates, then restart PHP-FPM and Apache.
• Plesk: run the Plesk installer to update the PHP handlers.
• Docker: rebuild your images from a patched base image and redeploy every container.

Important: always restart every PHP worker after updating. Old workers keep running the unpatched code until they restart. Patch Apache mod_php servers first, because PHP rates them the highest risk.

Temporary Mitigation If You Cannot Patch Today

If you truly cannot update right away, you can reduce (not remove) the risk. PHP lists this setting as a stopgap that blocks the confirmed session path:

; add to php.ini or a conf.d file, then restart every PHP worker

session.upload_progress.enabled = 0

session.use_strict_mode = 1

Other ways to lower risk while you wait:

• Put your site behind a web application firewall. Cloudflare’s free plan already includes PHP2Shell rules.
• Limit public access, move the site behind a VPN, or take it offline until the patch lands. CISA, the NSA, the UK NCSC and CERT-EU all gave this advice for systems that cannot be patched.
• Do not install a “PHP2Shell fix” plugin or a code snippet from a forum. A plugin cannot change PHP itself, and fake proof-of-concept tools have already appeared around this disclosure.

Is PHP2Shell Being Exploited?

Yes, attacks are happening. Amazon saw a first attempt on October 17. watchTowr reported in-the-wild exploitation through its honeypots on October 21. Cloudflare counted tens of thousands of attempts within 45 minutes of the release, rising into the millions.

There is some good news. On October 22, e-commerce security firm Sansec said mass exploitation now looks less likely than first feared. A working attack needs specific knowledge of the target server, and the public exploits do not work against a default PHP setup. As of October 22, CISA had not added either CVE to its Known Exploited Vulnerabilities list. Even so, every expert agrees on one thing: update PHP.

Signs Your Site May Have Been Hit

If your server ran unpatched PHP and was open to the internet between October 17 and your patch date, check for these signs:

• Unknown PHP files, especially in upload folders.
• New admin users you did not create.
• New or strange cron jobs.
• Unexpected outbound connections from your server.
• Unusual multipart POST requests in your access logs.

Because PHP2Shell can leak memory, it is also wise to rotate secrets: database passwords, API keys, admin passwords and WordPress security salts.

PHP2Shell FAQ

What is PHP2Shell?

PHP2Shell is the nickname for CVE-2026-109618 and CVE-2026-109619, two critical flaws in PHP rated 9.2 on CVSS v4.0. They can allow remote code execution without a login on PHP 5.4 to 8.5.

Is my WordPress site affected by PHP2Shell?

Yes, if it runs on unpatched PHP. WordPress runs on PHP, and the flaw sits in PHP itself. Whether you need to act depends on who manages your PHP: your host or you.

I use Hostinger. Do I need to do anything?

Not on Web, Cloud or cPanel hosting. Hostinger finished patching on October 22. If you use Hostinger VPS, you must update and restart PHP yourself.

Will a WordPress security plugin fix PHP2Shell?

No. The flaw is in the PHP engine, not in WordPress. Only a patched PHP build fixes it. A firewall can help block attacks in the meantime.

Does disabling session.upload_progress fix PHP2Shell?

No. It blocks one confirmed attack path but not all of them. PHP says updating is the only complete fix.

Which PHP version should I use now?

Use PHP 8.3 or newer. PHP 8.2 is patched but reaches end of life on December 31, 2026, so plan your upgrade.

Why is it called a leak?

Details about the flaws, including the CVE numbers, became public on October 20, before the planned disclosure date of October 22. PHP had to release the fix a day early.

Was PHP2Shell found with AI?

Yes. Researchers from Calif, OpenAI and Wiz used AI models to help prove the old flaws could be exploited.

Final Thoughts

PHP2Shell is one of the most serious PHP security events in years. The leak gave attackers a head start, but most major hosts moved fast. If you are on shared or managed hosting with a host like Hostinger, SiteGround, Kinsta or WP Engine, you are most likely already protected.

The real risk now sits with self-managed servers and old PHP versions. If that is you, update PHP, restart every worker and move to PHP 8.3 or newer today. It is a small job that closes a very big door.