PHP2Shell: what it means for your business website
On October 21, 2026, CISA issued an alert about two flaws in PHP, CVE-2026-109618 and CVE-2026-109619. If your website runs on PHP, here is what to check and how we can help.
Read the transcript
This week, a serious security flaw called PHP2Shell was announced in PHP, the software behind most small business websites. If your site runs an older version of PHP, it may need an update. The fixed versions are now available. So ask your web person or your hosting company two questions: which PHP version is my site on, and has this week's fix been applied? Not sure, or don't have anyone to ask? Matano IT can confirm it and take care of the update for you. Visit matanoit.com/php2shell to chat, book a time or email us.
What is PHP2Shell?
PHP is the programming language behind many business websites, including most WordPress sites. PHP2Shell is the name for two flaws in PHP that CISA flagged on October 21, 2026. Any site running an affected version should be updated or confirmed as fixed by its host.
Which versions are affected
PHP 5.4 through 8.5.11 are affected unless the fix has been applied. These versions include the fix:
| If your site runs | Update to |
|---|---|
| PHP 8.5 | 8.5.12 or later |
| PHP 8.4 | 8.4.27 or later |
| PHP 8.3 | 8.3.36 or later |
| PHP 8.2 | 8.2.35 or later |
| PHP 8.1 or older | No fix is coming from PHP. Move to a supported version. |
Some hosts apply the fix without changing the version number, so the number alone doesn't always tell the whole story. Your host can confirm it for you.
What to ask your host or web person
- Which PHP version does my website run? In WordPress you can see it under Tools, then Site Health, then Info, then Server.
- Has the fix for CVE-2026-109618 and CVE-2026-109619 been applied?
- If we're on PHP 8.1 or older, what is the plan to move to a supported version?
- Are our plugins and theme ready for the newer version, and can we test on a copy of the site first?
When it's worth a second look
- You aren't sure who hosts your website.
- Nobody has updated the site in the last year.
- The person who built the site is no longer around.
- Your WordPress dashboard shows warnings about PHP or updates.
How Matano IT helps
We confirm which PHP version your website runs and whether the fix is in place. If it needs an update, we test it on a copy of your site first, make the update, and check that everything still works afterward. We can work alongside your host or web person, or take care of it for you.
Matano IT is an IT company in East Windsor, New Jersey, serving businesses.
Read the blog post: PHP2Shell, what business owners should check
Common questions
Does my website use PHP?
If your site is built on WordPress, Joomla or Drupal, yes. Many custom built sites use it too. Your host or web person can tell you for certain.
My host manages WordPress for me. Do I need to do anything?
Managed hosts usually update PHP for you. It's still worth asking them to confirm the fix is in place for CVE-2026-109618 and CVE-2026-109619.
Can you tell from the outside whether my site is affected?
Sometimes. Many sites hide their PHP version, so confirming it usually takes a look at your hosting account. Our website check shows what is visible from the outside, and we can take it from there with you.
What if we're on PHP 8.1 or older?
Those versions won't get a fix from PHP. The safe path is moving to a supported version, which can affect older plugins and themes, so it should be tested before it goes live.
Not sure where your website stands?
Run our website check, book a 15-minute review with us, or send us an email. We'll tell you plainly what we see and what we'd do next.