Critical · being exploited
PHP2Shell: the critical PHP flaw
Two flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, let an attacker run commands on a server without logging in. Updating WordPress or a plugin doesn’t fix them.
Why it matters to you
If your site runs on PHP, the flaw sits underneath it. Hosting companies that patched their own platforms fixed their side, but a server you run yourself, or an older PHP version, may still be exposed. Clients and insurers increasingly ask for proof of which build is running.
Check it yourself
- 01Enter your address in the free scan to see the PHP version your site reports.
- 02Compare it with the fixed builds: 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or newer.
- 03Ask your host to confirm in writing the build running on your site, and that PHP was restarted.
- 04If the version is hidden, treat the answer as unknown until it’s confirmed.
Fix it
- 01Upgrade PHP to a fixed build on a copy of your site first.
- 02Restart PHP so the new build serves requests, then confirm the version that’s actually running.
- 03On 8.1 or older there is no fixed release: apply a vendor source patch or move to a supported version.
- 04Look for signs of an earlier break-in (new admin users, changed files, unknown scheduled tasks) and rotate secrets if anything looks wrong.
How PatchRig helps
PatchRig upgrades the PHP runtime on a copy, confirms the version that’s running, checks for an earlier break-in, and keeps watching for the next flaw.
Check your site free, in under a minute.