Old code breaks
Functions like mysql_*, each() or create_function no longer exist in PHP 8. The website shows a blank page or an error.
Critical PHP vulnerability · October 2026
PHP2Shell: is your website safe?
A critical flaw in PHP itself lets attackers take over a web server without a password, and attacks are already happening. Most websites, web shops and applications run on PHP. We check your website, protect it right away and upgrade PHP and your code to a safe version.
- Fast response
- PHP 5 to PHP 8.6
- No downtime
- Professional team
What happened
Two critical flaws in the heart of PHP
In October 2026 two serious vulnerabilities in the PHP interpreter were published, together known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). The flaw is not in WordPress, a plugin or your code, but in PHP itself, so it affects every website on a vulnerable version, however well it is built.
An attacker needs no password or account. With a specially crafted request they can run their own code on the server, steal the database and customer data, install malware or take the website down.
- Severity score (CVSS 4.0) out of 10
- 9.2
- Affected PHP versions
- 5.4 – 8.5
- Websites run on PHP
- ~7/10
Timeline
-
17 Oct 2026
First attack attempts recorded, before the flaw was public.
-
20 Oct 2026
The vulnerabilities are announced after details leaked early.
-
21 Oct 2026
Fixed versions released: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
-
Today
Attacks are active. Unpatched servers are being scanned automatically.
Sources: PHP security advisories, CERT-EU and watchTowr.
Self-check
Which PHP version does your website run on?
Choose your version and see what you need to do. If you do not know it, we will check for you.
Where to find the PHP version
- In the hosting control panel (cPanel, Plesk, DirectAdmin) under "PHP version" or "PHP settings".
- In WordPress: Tools → Site Health → Info → Server.
- Ask your hosting provider or the developer who built the website.
No fix
There is no fix for this version
These versions have not received updates for years and will not get a fix for PHP2Shell. The only safe solution is moving to a supported PHP version. Old code almost always breaks on the new PHP, so it needs to be adapted first. That is exactly what we do.
End of life
No official release, an upgrade is needed
PHP 7.4 only got minimal source patches, without an official release. Some hosts can apply them, but the version stays unsupported and new flaws will not be fixed. We recommend moving to PHP 8.6 with the code changes that requires.
End of life
No official release, an upgrade is needed
PHP 8.0 is no longer supported and only got source patches, without an official release. Moving to PHP 8.6 is usually simpler than from PHP 7, but the code and plugins still need to be checked.
End of life
No official release, an upgrade is needed
Support for PHP 8.1 ended at the end of 2025, so there is no official fixed version. We recommend moving to PHP 8.6, the newest PHP version, supported until the end of 2030.
Update now
Update to PHP 8.2.35 or newer
A fix exists, but the server has to be updated and every PHP process restarted. Watch out: support for PHP 8.2 ends on 31 December 2026, so it is the right time to plan a move to PHP 8.6.
Update now
Update to PHP 8.3.36 or newer
A fix exists. The server has to be updated to 8.3.36 or newer and every PHP process restarted. If your hosting did not do it, we will.
Update now
Update to PHP 8.4.27 or newer
A fix exists. The server has to be updated to 8.4.27 or newer and every PHP process restarted. If your hosting did not do it, we will.
Update now
Update to PHP 8.5.12 or newer
A fix exists. The server has to be updated to 8.5.12 or newer and every PHP process restarted. If your hosting did not do it, we will.
Check
Get help with this
We will check it for you
Send us the address of your website and we will find out which PHP version it runs on, whether it is vulnerable and what needs to be done. Without obligation.
Why it is not one click
Why many websites cannot simply update PHP
Switching the PHP version in the hosting panel takes a second. The problem is everything that stops working afterwards.
Outdated plugins and themes
WordPress plugins and themes that have not been updated for years do not work on the new PHP.
Old framework versions
Applications on older Laravel, Symfony or CodeIgniter versions need a framework upgrade together with PHP.
No one to do it
The developer who built the website is no longer available, and no one knows how the system works.
Hosting is dropping old PHP
Hosting providers remove old PHP versions or charge extra for them. A website on old PHP can go down overnight.
Fear of breaking the website
The website brings in customers and orders, so every change without testing is a risk to your business.
How we solve it
From a quick check to a safe, upgraded website
First we stop the immediate danger, then we upgrade properly, without downtime and without surprises.
-
1. Quick check
We find out the PHP version, the server and the framework or CMS and tell you how exposed you are.
-
2. Immediate protection
A backup first, then a fixed PHP version where possible, and access restrictions and filtering where it is not.
-
3. Compatibility analysis
Automated tools and a code review show everything that will not work on the new PHP.
-
4. Code and dependency upgrade
We adapt the code, plugins, libraries and framework on a copy of the website, never on the live one.
-
5. Testing and switch-over
We test forms, payments and key functions, then switch the live website with no downtime.
-
6. Monitoring and maintenance
We monitor errors and suspicious activity and keep PHP up to date so this never catches you off guard again.
What we upgrade
Every kind of PHP project, old or new
We are a team of experienced PHP developers with more than 15 years of experience. We have worked with PHP from version 5 onwards, with projects without a framework and with the latest versions of Laravel, so no codebase scares us.
- WordPress & WooCommerce
- Laravel 4 to 13
- Custom PHP without a framework
- Symfony
- CodeIgniter & Yii
- Joomla & Drupal
- Magento & PrestaShop
- Web shops and portals
- ERP and business applications
Already hacked?
Suspicious files, a redirect to another website, spam emails or a warning from Google are signs of a break-in. We remove the malicious code, close the hole and get the website back online.
Call +387 66 773 998FAQ
Questions about PHP2Shell and PHP upgrades
What is PHP2Shell?
PHP2Shell is the name for two critical vulnerabilities in the PHP interpreter (CVE-2026-109618 and CVE-2026-109619), published in October 2026. They let an attacker run their own code on the server without logging in. They affect PHP versions 5.4 to 8.5 that have not been updated.
My website runs on WordPress. Is it affected?
Probably, if the server has a vulnerable PHP version. The flaw is in PHP, not in WordPress, so updating WordPress and plugins is not enough. PHP on the server has to be updated, and on older versions the website has to be moved to a newer PHP.
Which PHP versions are safe?
The fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 or newer. PHP 7.4, 8.0 and 8.1 did not get an official release, and versions 7.3 and older did not get a fix at all.
Which PHP version should we move to?
To PHP 8.6, the newest PHP version (stable release on 19 November 2026), with security updates until the end of 2030. Urgent cases that cannot wait for it we move to PHP 8.5 first, and the step from 8.5 to 8.6 is small.
Can a setting or a firewall solve the problem?
Only temporarily. According to the PHP team, no configuration change fully closes these flaws. Filtering and access restrictions buy time, but the real solution is updating PHP.
My hosting says they have updated PHP. Am I safe?
If your website really runs on one of the fixed versions, you are protected from this flaw. If it is on PHP 7.4, 8.0 or 8.1, or the host kept an old version just for your website, it is not enough. We will gladly check it for you.
How long does a PHP upgrade take?
Updating a supported version is often done the same day. Moving from an old PHP version depends on the size and state of the code, from a few days for a business website to a few weeks for larger applications. After the check you get a clear estimate.
How much does it cost?
It depends on the PHP version, the technology and the size of the project. After the check we send you a quote with no obligation, and for urgent cases we first close the immediate danger.
Will the website stop working during the upgrade?
No. We work on a copy of the website, test everything and only then switch the live website, with a backup ready in case it is needed.
Website down or under attack?
Call us right away. We will look into the problem and tell you the next step.
Do not wait for an attack to find your website
Send us the website address, and we will check which PHP version it runs on, whether it is vulnerable and what needs to be done.
Request a website checkPrefer to talk? Call us: +387 66 773 998