Security advisoryPHP2Shell: a serious flaw in the software behind most websites. Free check: is yours exposed?
Inteeka
Security advisoryUpdated 23 October 2026

PHP2Shell: a serious flaw in PHP, the software behind most websites. Is yours exposed?

On 21 October 2026 a critical flaw was found in PHP: the software behind about seven in ten of the world’s websites, including WordPress, WooCommerce, Magento, Drupal and most agency-built sites. It lets a stranger take control of the computer your website lives on, without a password. Below, in plain words and everyday pictures, is what it means, what to do today, and a free check to see where you stand.

Rated 9.2 out of 10Patched 21 October 2026WordPress, Magento, Drupal and moreAttacks seen in the wild
Run the free checkBook a 15-minute call
ISO 27001 certified (ISOQAR, UKAS accredited)ISO 9001 certified (ISOQAR, UKAS accredited)ISO 14001 certified (ISOQAR, UKAS accredited)Alcumus ISOQAR certificate 18958 · UKAS accredited

Inteeka security assistant

PHP2Shell: check your site, ask anything

Hello, I'm Inteeka's security assistant. Paste your website address and I'll run a passive check for signs of an unpatched PHP, then talk you through what to do. You can also just ask me about PHP2Shell.

Passive check only. Never share passwords or server logins here.

Free check
In plain English

What this means if you just want your website safe

No jargon here. Five everyday pictures, each showing the idea and then saying plainly what it means for you. The technical detail for your IT team or agency follows further down.

A row of ten shops; seven share the same back-door lock7 in 10 · same lock
Where it lives

It is in the foundation, not in your website

Think of your high street. Seven in ten shops were fitted with the same make of back-door lock: the greengrocer, the B&B with the online booking page, the hall that sends out the parish newsletter. PHP is that lock. It is the software that quietly runs about seven in ten of the world’s websites.

What that really meansA flaw in PHP is a flaw in the lock on all of those at once, whatever each site is for. WordPress, WooCommerce, Magento, Drupal and sites an agency built for you all sit on top of PHP, so the same flaw reaches a village hall and a national retailer the same way. Sites built on Shopify, Wix or Squarespace are not affected by this one.

A car with a recalled part; a wash does not fix itGARAGE
Why being careful is not enough

Looking after your own site does not close this

It is like a car recall. A faulty part was fitted to a whole run of cars, not just yours. Washing the car, buying new tyres or changing the radio does nothing about it. Only the garage swapping the part makes the car safe.

What that really meansUpdating WordPress, changing your passwords or adding a security plugin is washing the car. The faulty part is PHP itself, underneath all of that, and only the people who run your server can replace it.

Animation: a kitchen station left half-built by an oversized order, then trusted and handed over by the tidy-up crew.
Flaw one · CVE-2026-109618

A half-built station, trusted anyway

Picture a busy kitchen. For each order a chef sets up a little station. One customer sends in an order so enormous that the chef runs out of counter halfway and has to stop, leaving the station half-built. The tidy-up crew comes past, assumes it is finished and acts on it — and the customer worded the order so that the half-built part tells the crew what to do.

What that really meansPHP runs out of memory partway through preparing a request and leaves its own workings half-finished. Later clean-up steps trust them. No password is needed; just the right oversized request at the wrong moment.

Animation: a hotel room reused between guests while a forged note is left on the desk, never cleared away.
Flaw two · CVE-2026-109619

A room reused without being cleaned

Now picture a hotel room that is not cleaned between guests. One guest leaves a forged note on the desk: “Staff — give the bearer the master key.” The room changes hands all day, nobody clears the note away, so the next time staff come in they follow it.

What that really meansTo stay fast, the server keeps the same “worker” handling one visitor after another instead of a fresh one each time. If one visitor’s leftovers are not wiped, the next request that worker picks up can act on them.

The landlord changes the main lock and every unit is safeone job · host
The fix

The landlord changes the main lock

The good news: it is one job, and it is not yours to do. The landlord changes the main lock and the whole building is safe at once. For a website, the “landlord” is whoever hosts it.

What that really meansThey update PHP to a fixed version and restart it, and every site on that server is closed to this. Many hosts already have; some have not, and some only did the newest versions. You want a yes in writing — or run the free check below and we will tell you what we can see.

What is at stake if it is left open

A site left unpatched can be used to steal customer details, send spam from your domain, plant hidden pages or be taken offline. Owners usually find out weeks later, from a customer, a bank or Google. The fix itself takes a competent host minutes.

Run the free checkAsk the assistant a question
Free check

See whether your site shows signs of exposure

Give us the address and we fetch your home page exactly as a browser would, once, and read what the server volunteers about itself. It takes about ten seconds and changes nothing on your site.

  • What we look at

    The X-Powered-By and Server headers, session cookie names, CMS fingerprints such as WordPress, Drupal, Magento or Laravel, and any CDN or firewall in front of you.

  • What we never do

    No exploit attempts, no port scans, no login attempts, no crawling beyond the home page. One ordinary GET request and a handful of redirects.

  • What it cannot see

    A CDN such as Cloudflare can hide the origin, and Linux distributions backport fixes without changing the version number. The result is a first indication; the server-side check is the verdict, and we will help you get it.

  • What happens next

    The result appears right here. One click sends a request for assistance to our engineers with the result attached, or you can check another site straight away.

Takes about ten seconds · passive and read-only

We use your details to send you the result and follow up about the fix, nothing else. See our privacy policy.

How we help

From “are we exposed?” to fixed and verified

Inteeka is a London product-engineering studio. We run production systems for businesses every day, and we hold ISO 27001 certification for information security, so incident work like this is done to a standard, documented and handed back to you properly. We work remotely with your team, your host or your agency.

Exposure assessment

An inventory of every PHP surface across your sites, tools and hosts, the version serving each one, and a prioritised list of what to fix first. Started the same working day.

Emergency patch and verify

We update PHP ourselves or work alongside your host or agency, confirm the fix from the package changelog, restart the workers and re-test the public surface. Temporary mitigations where an update has to wait.

Compromise check and hardening

Log review for the known signals, a web-shell hunt in upload and cache folders, rotation of sessions, keys and certificates, firewall rules for oversized form posts, and monitoring so the next advisory is a routine update.

Beyond the fix

Where legacy PHP has become a liability, we plan the move to a modern, supported stack piece by piece, keeping what works and retiring what does not. No big-bang rewrite.

Step 1

A 15-minute call

You tell us what you run and who hosts it. We tell you plainly whether you have a problem and how urgent it is.

Step 2

Scope and a fixed quote

Within hours, a short written scope and a fixed price. No access to anything until you have agreed it.

Step 3

Work starts the same working day

Patch, verify, hunt, harden, and a written summary of what we found and changed at the end.

Book a 15-minute callTalk to the assistant nowor email info@inteeka.com
Independently certified

Security work to an audited standard

Inteeka Ltd is certified to ISO 27001:2022 for information security management, and to ISO 9001:2015 and ISO 14001:2015 for quality and environmental management, audited by Alcumus ISOQAR under UKAS accreditation. Your data, credentials and findings are handled under that management system from the first call to the final report.

ISO 27001 certified (ISOQAR, UKAS accredited)

ISO 27001:2022

Information security management

ISO 9001 certified (ISOQAR, UKAS accredited)

ISO 9001:2015

Quality management

ISO 14001 certified (ISOQAR, UKAS accredited)

ISO 14001:2015

Environmental management

One certificate, 18958, issued by Alcumus ISOQAR under UKAS accreditation 0026, covering the provision of digital web services and their information security.

Sources

Everything on this page is drawn from the PHP project and the security teams that analysed the flaws. Read them directly:

Page last reviewed 23 October 2026. Vulnerability details change quickly; where this page and the php.net advisory differ, the advisory wins.

Inteeka

AI-native product engineering · London, UK

© 2026 Inteeka · Built with Next.js, Payload CMS & Vercel

Privacy PolicyCookie Policy