PHP2Shell on Shared Hosting: Now Exploited, and Only Your Host Can Patch It

Attackers have achieved confirmed remote code execution through PHP2Shell, two critical PHP flaws tracked as CVE-2026-109618 and CVE-2026-109619. PHP shipped fixes on October 21. The catch for PHP2Shell shared hosting customers: the bug sits beneath WordPress and Joomla, so only your host can install the fix.

What is PHP2Shell, and is it being exploited?

PHP2Shell names two critical remote code execution flaws in the PHP runtime, patched by the PHP security team on October 21. Disclosures so far include no CVSS scores and no breakdown of which flaw does what.

Proof-of-concept exploits leaked before the patches, but the PHP team said none worked. Cloudflare, Hadrian, watchTowr, Previdian, Patchstack and Amazon Threat Intelligence saw early attempts; Dataminr’s TRACE team described scanning, fingerprinting and broken exploits.

Then Adel Karimi, detection and response lead at Perplexity, caught a working attack in honeypot data against Apache mod_php on PHP 8.4.26. It leaked about 800 KiB of memory, reused an address from that dump and ran a shell command about 1.6 ms later. Expel’s Marcus Hutchins called it the highest-quality confirmation he had seen.

Why won't a WordPress or Joomla update fix PHP2Shell?

The flaws live in the language runtime. WordPress, Joomla, WooCommerce and custom apps all run on the server’s PHP build, so updating core, themes and plugins changes nothing. Compare that with a WordPress comment bug that can become server control, where the fix is yours to install. PHP runs roughly 70% of websites, and VirusTotal estimates count more than 5.1 million exposed PHP hosts, about 3.8 million with an open port.

To see your build, check WordPress (Tools → Site Health → Info → Server), Joomla (System → System Information) or the per-domain PHP setting in cPanel or Plesk. The only confirmed hit was on mod_php, but nothing public suggests PHP-FPM or PHP-CGI is safer.

A version string proves little: Debian, Ubuntu and RHEL often backport fixes without changing the upstream version. The package revision tells you, and on shared hosting only your host sees it.

What should you ask your host about PHP2Shell shared hosting?

Ask your host:

1. Which PHP build and package revision serves my domain?
2. Does it include the fixes for CVE-2026-109618 and CVE-2026-109619?
3. If not, when will my account run a fixed build?

“We keep PHP updated” does not answer question two. If the host won’t name a date, escalate in writing with both CVE IDs and start moving to a provider that will state your package revision.

Meanwhile, restrict wp-admin or /administrator to known IPs, enforce two-factor login, and put a firewall such as our website protection in front of the site. Public reporting does not say whether WAF rules stop the working exploit, so treat it as a delay.

Also ask for session.upload_progress.enabled=0. The PHP team recommends it as the workaround for CVE-2026-115560, a separate unpatched RCE flaw that needs “an unusual combination of configuration and application code.”

What if the site was online before the fix?

Patching stops new abuse but removes nothing already written. Code run through PHP can plant a web shell, read wp-config.php or configuration.php for the database password, and reach other sites in the same account.

Look for PHP files nobody uploaded (especially in uploads or cache folders), admin users nobody created, redirects shown only to search or mobile visitors, and unfamiliar cron jobs. A clean malware scan does not settle it; compare files against a known-good backup or fresh core and plugin copies.

Keep host logs and suspicious files before deleting anything. Once the fix is confirmed, rotate database, admin, SFTP and API credentials; our antivirus website protection can then watch for new or changed files.

FAQ

Does updating WordPress or Joomla fix PHP2Shell?

No. The flaws are in PHP itself, so the server's PHP build has to be fixed.

Am I safe if my host uses PHP-FPM instead of mod_php?

Not necessarily. The only confirmed attack hit mod_php, but nothing public suggests other setups are safer.

After my host upgrades PHP, do I still need a malware scan?

Yes, if the site was online before the fix. Patching leaves earlier changes in place, so compare files against known-good copies too.

If your site ran on an unfixed PHP build and something looks off, our team can check it and clean it up. See our website protection packages.