How to Protect Your Website From PHP2Shell: A Practical Update Guide

A website may appear normal even if the software behind it requires an urgent security update. This is the reason why protection against PHP2Shell should begin with checking your hosting environment, not by waiting for an error message or for any obvious sign of an attack.

PHP2Shell involves two serious flaws in PHP: CVE-2026-109618 and CVE-2026-109619. If the vulnerabilities are exploited, it will enable an attacker to carry out remote code execution without having to log in. According to the Canadian Centre for Cyber Security's latest advisory, there have been instances of the vulnerabilities being exploited in the real world and it has been confirmed that both of them were added to CISA's Known Exploited Vulnerabilities catalog on October 26, 2026.

For website owners the first aim is simple: find out where PHP is running, carry out the necessary corrections, check the services that are running, and then decide if earlier exposure should be investigated.

The guide in question shows how to get your work organised, matter of factly assuming that you are using shared hosting, a managed WordPress service or your own server. The security information is based on the advisories available on October 30, 2026.

Understand What the PHP2Shell Patch Addresses

PHP is the runtime used for carrying out code that is part of a website application; although the website application and the PHP runtime are related, they are each maintained separately.

The memory corruption involved in the first PHP2Shell vulnerability occurs when dealing with out-of-memory situations, and the PHP advisory states that interrupted initialization can result in invalid data being processed by the cleanup routines.

The second case involves a program's internal state persisting even after the memory that the request refers to has been released; a subsequent request may then come across this outdated state, leading to a use-after-free vulnerability.

You have no need to understand how memory management works if you want to coordinate an update, but it is necessary to know which company or individual is in charge of the PHP installation behind your website.

For instance, if your developer looks after WordPress plugins while your hosting provider is in charge of PHP, then the runtime will not be verified because each party assumes that the other has taken care of it.

The first step is to send one person to gather the evidence and keep track of the work until it is completed.

Step 1: Find Every Website That Uses PHP

Do not only review your main homepage.

Prepare a small selection of websites and services that could use PHP, making sure to include some older ones that are still accessible even though no one is actively updating their content.

Check:

• Your main website.
• Subdomains and customer portals.
• Websites for staging and development.
• Blogs that are old or websites that have been abandoned.
• Administrative applications.
• Container-based deployments.

For every service, you should note the domain, the hosting provider, the person responsible, the PHP deployment, and the current patch status.

A simple table is enough:

Leave 'unknown' visible until it has been resolved. A partial inventory remains useful since it clearly shows what is still uncertain.

If you have no further need of an old website, you should follow your usual procedure for retiring it. Make sure to save any business records that are required before you remove the service.

Step 2: Check Which PHP Version Serves Your Website

Several hosting control panels include a section named PHP Settings, PHP Manager, or Select PHP Version. The specific name will vary according to the provider.

For each relevant domain, access the settings and note the PHP version that has been selected. Do not assume that all the domains within one hosting account use the same runtime.

If you administer a server directly, this command can help identify its command-line PHP installation:

php -v

Nevertheless, that result makes up only one part of the check.

The administrator should confirm that the PHP installation is actually serving web requests. The server might have several versions, separate worker pools, or containers which differ from the command-line environment.

For example, simply updating the default terminal installation doesn't prove that an older application pool has been changed.

Check the web runtime using authenticated administrative tools and do not keep a public diagnostic page live merely in order to display server details.

The outcome is a clear record that shows each website linked to the PHP package that is running it.

Step 3: Confirm the Relevant Fixed Release

The October 21 fixes for the two original PHP2Shell vulnerabilities are included in the following releases.

Take them as reference points specific to each incident and adhere to the update procedure recommended by your provider, checking for any later applicable releases.

PHP also mentions that certain distributors and those who offer long-term support provide backported fixes; as a result, a package can include security updates without taking on the same upstream version number. You should check the package's patch status against the vendor's advisory and the package revision.

Ask whoever manages the server to provide:

1. The version or package revision of PHP that is active.
2. There is evidence that it covers both CVE identifiers.
3. The date on which the update came into effect.
4. Those installations which are still not resolved.

As a result, a maintenance record that can be reviewed is obtained rather than depending on a general statement that all the items have been updated.

Step 4: Prepare for the Update

A short preparatory process is able to cut down on disruption without turning an urgent update into a long project.

Make sure you have access to the hosting account, the deployment system, the application files, the database, and the relevant configuration.

The most important functions for your business should be identified. A small blog will only need a few checks, while an online store should give closer attention to orders, payments, account access, and notifications.

Make sure you have a plan in place to deal with any compatibility issues that may arise. Also, find out who is responsible for restoring service and locate where the necessary files and configuration settings are kept.

If you are already suspecting that there has been an intrusion, you should get in touch with your hosting or security team before carrying out any extensive changes. At the same time, talk about the need to preserve relevant evidence as you deal with the situation urgently and carry out remediation.

A backup of a server which may have been compromised can be of some use to an investigation, but it should not simply be taken as your reliable source for recovery.

Step 5: Update PHP Through the Supported Hosting Process

The method for carrying out the update will vary depending on who is in charge of your infrastructure.

Shared Hosting

Begin by using the provider's PHP management interface and looking at the security notices.

Find out if choosing a branch has the effect of selecting a patched build; for example, a dashboard label like “PHP 8.4” might not show the complete package revision.

If you are unable to verify the installed fix, then you should contact support and make your request as specific as possible.

Could you please confirm that the PHP runtime which is serving my domains has the patches for CVE-2026-109618 and CVE-2026-109619? It would be helpful if you could give us the current version or the patched package revision and also the date when the update took effect.

Also find out if each domain in your account has been looked at.

Managed WordPress Hosting

Request that the provider verify the PHP protection separately from the WordPress updates.

The fact that WordPress has been updated can be taken as evidence of maintenance, but it does not indicate the state of the runtime underneath it.

Make it clear whether the provider carries out the entire PHP update process, checks application compatibility, and investigates any suspicious activity.

Self-Managed Servers

Follow the update procedure as documented by the operating system or by the approved package vendor.

Before making any changes, check whether the relevant PHP packages and services have actually been deployed and coordinate with the administrator in charge of the environment for any necessary service restarts.

Do not copy a general upgrade command without first checking the operating system, the repository, the PHP branch, and the required extensions.

Containers

Alter the image or the configuration used in creating the deployment.

Substitute the running instances that are affected and make sure that future deployments make use of the corrected image; it is possible to leave the original deployment source unchanged when updating one live container and thus fail to complete the task.

Keep a record of the image or release that is currently running.

Step 6: Verify That the Running Services Use the Update

A package installation represents a major achievement; the work is not considered complete until the desired services are using it.

Request that the operator check each and every relevant worker, application pool, container, and server instance.

When traffic is spread over a number of systems, you should obtain confirmation for the entire deployment; verifying a single instance does not indicate the status of the other ones.

Note the time when the verification is carried out together with the package or image that has been checked. If a system is not capable of being checked right away, leave the entry open in the maintenance record.

This documentation can be short:

The production website was verified on the patched package at 15:30, and both application instances were checked. The staging review is still assigned to the development team.

A ticket that just says "done" lacks usefulness compared to one that includes supporting details.

Step 7: Test Your Important Website Functions

Once the update has been carried out, check the application from the point of view of both a visitor and an administrator.

Suggested checks include:

• Opening important pages.
• Signing in and signing out.
• Submitting contact forms.
• Searching the website.
• Uploading permitted files.
• Where appropriate, complete the test order.
• Receiving application notifications.
• Confirming that the scheduled work runs have been arranged.

Select checks that match your real website.

For an online store it is necessary to use a safe testing procedure which will prevent any unintended charges to customers, and for a business portal the workflows that employees rely on should be included.

Check the application with the person in charge of maintenance and record any behaviour that is not expected.

If compatibility problems occur, arrange for a supported correction. Do not quietly bring an exposed system back to an older vulnerable deployment just in order to restore a feature.

Step 8: Review Temporary Protection Carefully

The PHP authorities state that updating is the only solution to the original vulnerabilities, whereas their configuration measures deal with specific attack paths and do not offer full protection.

If action is postponed, then talk to the hosting or security team about imposing temporary restrictions. The advisory from Canada suggests that it may be worth isolating internet-facing applications when immediate remediation is not possible.

Ensure that the restriction really stops untrusted requests from getting to the vulnerable service.

A maintenance page on its own isn't sufficient as evidence; you should ask the operator about how the backend is restricted and also how that restriction was verified.

With regard to each temporary measure, note the name of the owner, the scope of it, and when the relevant update will be completed.

Step 9: Check the Separate Session Upload Progress Advisory

With regard to CVE-2026-115560, PHP issued another notice on October 23.

The situation involves a special combination of configuration and application behaviour that requires a change to the session serialization handler at runtime. PHP advises that session.upload_progress.enabled=0 should be set until the next regular bugfix release as a safeguard against this kind of vulnerability. Applications which never modify the handler at runtime fall outside of this particular scenario.

Let your administrator look at this separately from the two original fixes.

If the setting applies to your environment, then you should use the relevant administrative procedure to set it up and check that the configuration has been applied effectively. It is not acceptable to assume that putting a setting in the application code will make it take effect early enough.

The advisory issued by PHP concerning its stale-state issue makes it clear that its session-related mitigation has to be carried out administratively and involves restarting the workers; it also stresses that this action does not apply to every lifecycle path linked to the original vulnerability.

Step 10: Investigate Credible Signs of Compromise

A security update for PHP deals with the issue that will affect the future; it does not provide answers to all the questions regarding earlier activity.

The following are general investigation leads, rather than proof of PHP2Shell exploitation:

• There are instances of files being changed without a duly approved deployment.
• Unfamiliar administrator accounts.
• Unexpected scheduled tasks.
• Unexplained outbound connections.
• Programs unusual in nature, introduced by web services.
• There are suspicious requests linked to abnormal server behavior.

Make the findings comparable with genuine changes and with normal application activity.

The fact that one error message has occurred does not prove that an attack has been successful; similarly, a homepage that appears normal does not settle the investigation.

When you are using managed hosting, find out which records the provider looked at and check whether its evaluation takes into account the underlying server environment.

If there is evidence of a compromise, appoint an incident coordinator and get the necessary technical support. Agreement should be reached beforehand on matters relating to containment, the preservation of evidence, the review of credentials, and recovery before carrying out any disconnected changes.

Common PHP2Shell Update Mistakes

Checking Only the Homepage

The homepage represents one of the ways of accessing the application, and it does not indicate the patch status of the runtime, the other domains, or the background services.

Updating Only Application Dependencies

Keep the plugins and libraries up to date, but check the PHP separately. Every task carried out as part of the maintenance should clarify the component it is actually dealing with.

Trusting an Incomplete Version Label

The branch label by itself might not indicate the installed security revision; you should ask for the evidence required to prove patch coverage.

Forgetting Staging and Older Websites

You should include all relevant public installations in your review, and even if a website is not being used it still needs to have maintenance carried out while it remains accessible.

Closing the Ticket Without Verification

Make a record of the active deployments and the checks carried out; continue to keep the systems which have not been resolved until they have been verified by someone.

PHP2Shell Protection Checklist

Use this checklist to track completion:

• Look into the PHP websites and services that are relevant.
• Appoint someone responsible for each deployment.
• Determine the PHP runtime that is handling the web requests.
• Make sure that the coverage of both of the original CVEs is confirmed.
• Set up the steps for validating the application and recovering it.
• Apply the updates using the recommended procedure.
• Check all related running instances.
• Test the important functions of the website.
• Look over the session advisory separately.
• Look into reliable indications of previous compromise.
• Record the results as well as any further work that remains.

Frequently Asked Questions

Can I repair PHP2Shell by updating WordPress?

The fact that a WordPress update has been carried out does not mean that PHP has been patched; you should check the runtime with the hosting provider or the server administrator.

Do I need to switch to a different PHP branch?

For your environment, stick to the update path that is supported. A patch specific to an incident and a longer-term migration could constitute separate tasks. Make sure to check with your vendor before making a decision.

What if your provider states that the server is using a backported fix?

Request the advisory and package revision that confirms coverage of both CVEs and keep that evidence as part of your maintenance record.

Should I change all my passwords after updating?

Set about replacing the credentials according to the exposure assessment and the results of the incident investigation. In the case where a compromise is suspected, then coordinate the changes from a trusted environment after having dealt with the attacker's access paths.

Can I resolve the issue after I have installed the package?

Make sure that the current deployment is using the fix and then check that the important functions of the application are working properly. Record any investigation or follow-up action that is still open.

Keep a Clear Record of Protection

What is most useful to a website owner is concrete evidence showing which services have been reviewed, which fixes are in operation, and which points remain uncertain.

Hold on to that record alongside your regular maintenance documentation and make sure that responsibility for future PHP advisories is assigned so that the next urgent update can start with a clear inventory and a known point of contact.

It is a practical maintenance job to guard your website against PHP2Shell, and this involves a full handover from detecting the runtime to checking the running service and dealing with any plausible indications of previous compromise.

Sources

1. CISA, October 26, 2026: CISA Adds Two Known Exploited Vulnerabilities to Catalog.
2. Canadian Centre for Cyber Security: AL26-026 — Critical vulnerabilities impacting PHP.
3. PHP security advisory: CVE-2026-109618 — RCE via OOM corruption.
4. PHP security advisory: CVE-2026-109619 — RCE via stale global state.
5. PHP official announcements: Critical RCE advisory and session upload progress notice.