PHP2Shell: How Website Owners Can Check Exposure and Arrange Patching

Table of Contents

• Confirm whether your website uses PHP
• The two vulnerabilities and fixed versions
• Questions to copy to your host
• Choose your next step
• Arrange the update and functional checks
• Zoo AI service scope and fees
• Official sources and evidence scope

Confirm whether your website uses PHP

Send the questions below to your host or website maintainer to obtain the actual version and patch evidence. If the technology is unknown, establish that before arranging changes.

The official hosting requirements for WordPress and WooCommerce include PHP. Product names help identify what to check; they do not prove that an individual website is compromised or patched. Ask the maintainer of a Laravel or custom PHP application about its actual deployment too.

PHP is the runtime; WordPress, themes and plugins are another layer. An application or security-plugin update does not establish that PHP itself is patched. Command-line PHP may also differ from the runtime serving web requests. Request evidence for the website's runtime rather than relying on a command-line screenshot alone.

The two vulnerabilities and fixed versions

This article uses “PHP2Shell” as a search label. The PHP sources below identify the issues by their CVEs and vulnerability names, without using that nickname.

These findings come from the OOM advisory and state lifecycle advisory. Exploitability depends on deployment, configuration and reachable operations. They do not establish that every website has been compromised.

PHP published these fixes on 21 October 2026:

Earlier releases in each branch require an update or evidence that the package vendor backported both fixes. An older upstream version string alone does not rule out a vendor patch. PHP 8.1 and earlier no longer receive routine PHP-project support; ask the vendor about backports or migration.

PHP asks all installations serving web requests to review and update, with mod_php at highest risk. A complete patch is the reliable remedy. A WAF, upload restrictions or disabled features do not by themselves establish remediation.

Questions to copy to your host

Fill in your website address and send:

Website: __________
Please confirm:
1. Which PHP version, execution mode and package vendor serve this website?
2. Are CVE-2026-109618 and CVE-2026-109619 both patched?
   For backports, please provide the package version and advisory/patch reference.
3. When was the update completed, and were all relevant PHP workers restarted?
4. Can the backup be restored? What are the rollback and downtime arrangements?
5. Who will verify forms, login and shop transactions, and what results can you provide?

If the answer is only “plugins updated”, “firewall enabled” or “website working”, follow up on questions 1–3. Check that any evidence covers production, other subdomains and independently hosted services where relevant.

Choose your next step

This table provides practical recommendations, rather than test results for a particular host.

Patching a vulnerability and resolving an existing intrusion are separate tasks. A completed update does not establish that malware, stolen accounts or other consequences have been removed.

Arrange the update and functional checks

1. Agree responsibility and recovery: Confirm who updates and verifies, acceptable downtime, a usable backup and what happens if the change fails.
2. Check compatibility: Use staging where available and record differences from production. Assess alternatives first if a safe update is not possible.
3. Update PHP: An authorized administrator applies the release or vendor patch, restarts relevant workers and records the version and completion time.
4. Verify major functions: Check forms and login; for shops, also check cart, checkout, payment callbacks, orders and notifications using an agreed method that avoids unintended real charges.
5. Record results and gaps: Capture pages checked, outcomes, responsible people and remaining risks. A checklist does not prove the whole website is free of vulnerabilities.

These are suggested checks, not operations performed on a customer website for this article. Temporary measures have limits: memory_limit=-1 removes PHP's memory cap but underlying allocation failures remain possible. Disabling session upload progress or PHP 8.5 fatal backtraces blocks only specific paths. Have an administrator assess the official guidance rather than copying configuration as proof of remediation.

Zoo AI service scope and fees

PHP Website Security Updates & Emergency Patching primarily serves WordPress/WooCommerce business websites and shops. Laravel, custom systems and other PHP enquiries require a technical, hosting-access and scope assessment before we decide whether to accept the work.

Initial discussion is free; quotations depend on the system and scope. It uses the website address, system and hosting information you provide, without logging in. Logged-in investigation, backups, patching and verification are paid work. No starting price is advertised.

Paid work covers confirming exposure, backups, upgrading or applying patches, and verifying major website functions. Backup usability, rollback, downtime coordination, verification items and alternatives when an update cannot be performed safely are agreed for each case.

We notify customers of suspected intrusion. Malware removal, incident investigation and website recovery require separate assessment and quotation, or referral where appropriate. We aim to reply promptly and confirm handling time after assessment. There is no fixed response or repair deadline, or commitment to round-the-clock support.

Next: prepare your website address, system name and hosting details, and see the service page for enquiry arrangements.

Official sources and evidence scope

Sources checked: 23 October 2026. The version table records the fixes for this event; check current PHP and package-vendor notices when scheduling an update.

• PHP security advisory and releases, 21 October 2026
• CVE-2026-109618: OOM corruption
• CVE-2026-109619: stale global state
• WordPress hosting requirements
• WooCommerce server requirements

Vulnerability findings are based on official documents and were not reproduced by Zoo AI. The checklist and decision table are our recommendations, not evidence of completed host testing, customer remediation or incident forensics.