Identify the runtime owner.
Document the site platform, hosting provider, PHP execution path, administrative access, and who can apply server updates.
Security notice · October 21, 2026
PHP2Shell: what happened, how to check your site, and what to do next.
Two critical vulnerabilities were fixed in supported PHP releases. If a website runs PHP—including many WordPress, Drupal, and Joomla sites—the important question is whether the web server's PHP runtime received the vendor-supported fix.
PHP published fixes for CVE-2026-109618 and CVE-2026-109619 on October 21. The flaws can allow someone to run code on an affected server without logging in. Read the PHP advisory.
WordPress and other PHP applications depend on the server’s runtime. Updating an application or plugin alone does not install this fix. Canonical’s guidance explains the affected Ubuntu packages and update process.
Public website check
Does your website appear to use PHP?
The checker requests the public homepage and looks for common PHP-platform clues. It does not test the vulnerability, access private files, or determine patch status.
Response steps
Verify, protect, update, and validate.
These steps apply whether the work is handled internally, by the hosting provider, or by an outside administrator.
Confirm recoverability.
Check backup freshness and restore access. Preserve relevant logs before changing a site when compromise is suspected.
Apply the vendor-supported fix.
Coordinate the host or update the authorized environment, restart the relevant services, and keep defense-in-depth controls enabled.
Test the actual web path.
Confirm the web-serving runtime, exercise essential site flows, inspect for unexpected changes, and document the result.
Patch or migrate?
Do you need to rebuild your website?
Usually, the immediate action is a supported PHP update. Rebuilding can be considered separately if the existing platform is difficult to maintain.
Stay on PHP when
- The platform is still the right operational fit.
- The host owns rapid security updates and backups.
- The application has active support and tested upgrades.
- A runtime patch resolves the immediate issue cleanly.
Consider a migration when
- The site is mostly informational and can become static.
- Unsupported plugins, themes, or PHP versions block safe updates.
- No one clearly owns patching, recovery, or monitoring.
- Ongoing maintenance cost exceeds the value of the current stack.
Moving a suitable informational site to a static or modern JavaScript stack removes its PHP runtime, but does not remove the need for dependency updates, access controls, backups, and monitoring.
If compromise is suspected: avoid routine cleanup that could destroy evidence. Preserve available logs and backups, restrict access where practical, and involve a qualified incident-response professional.
Primary sources
Read the published guidance.
- PHP — critical security advisory, October 21The project’s affected configurations, fixed releases, and update guidance.
- Canonical / Ubuntu — PHP2Shell fixes availableDistribution package versions and instructions for Ubuntu administrators.
- Netherlands National Cyber Security Centre — PHP2Shell overviewA public reference for tracking the vulnerabilities and remediation information.
- Cloudflare — PHP vulnerability protectionsAdditional protection at the network edge; the server still needs its update.
Need help verifying it?
Send the domain and hosting provider.
If the hosting company's answer is unclear, or you manage the server yourself, Root Web Services can review the setup and document the next action. No credentials or changes are requested before scope and authorization are confirmed.
Email:
rootwebservice@gmail.com