PHP2Shell Check and PHP Update UK.

What PHP2Shell is

PHP2Shell is the nickname for two flaws in the PHP interpreter, the software underneath WordPress, WooCommerce, Joomla, Drupal, Magento and most small business websites. They are tracked as CVE-2026-109618 and CVE-2026-109619, and the PHP security team rates both Critical, CVSS v4.0 9.2. Wiz Research, via Patchstack, found that every PHP version from 5.4 onwards is affected, and the NCSC's alert says: "Organisations using any version of PHP are affected."

An attacker does not need to log in. An unauthenticated web request can lead to remote code execution, meaning the attacker's own code running on your server. Wiz demonstrated this against the latest WordPress, Drupal and Joomla, and showed that server memory holding passwords, tokens and API keys could be read even without it.

This is not a WordPress or plugin bug. As Cloudflare puts it, "updating website code or a plugin(s) alone does not fix these vulnerabilities". Only updating PHP does.

What we do

1. Check your exact PHP version. We confirm the full version number (for example 8.4.27, not just 8.4) for every site on your hosting account, plus the command-line version your scheduled tasks use.
2. Update or protect PHP. On 8.2 or later, we get you onto the fixed release for your branch: 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or later. On 8.1 or older, we check for a vendor-patched build or a mitigation such as Hosted Power's open-source php_uploadprogress_guard, with Cloudflare in front, or upgrade PHP if you would like to. Where your host controls PHP, we tell them exactly what is needed and follow it up.
3. Check the site works on the new version. We take a backup first, then check key pages, contact forms, checkout, the admin area and the error log. If you choose to move up from 8.1 or older, old plugins or custom code can break, and we fix what breaks.
4. Look for signs of tampering and backdoors. Unusual multipart requests followed by memory-limit errors or repeated 500 errors, oversized PHPSESSID cookies, unexplained PHP worker restarts, recently changed files, PHP files in upload folders, unknown admin users and scheduled tasks nobody set up.
5. Rotate credentials if needed. If anything looks wrong, or the site sat on an unfixed version while attacks were under way, we change the passwords, keys and tokens the server holds: database, admin and hosting logins, API keys, payment and email (SMTP) credentials, and WordPress salts.

We tell you what we checked and what we found. No check can prove a server was never touched, so we will not promise that, but we will tell you plainly if something looks wrong.

Staying on PHP 8.1 or older

You do not have to move off older PHP to deal with PHP2Shell, but you should be clear about what protects you. PHP 8.1, 8.0, 7.x and 5.6 are end of life, so there is no official fixed release for them. What is available instead:

• A vendor-patched build. Some Linux distributions and long-term support vendors ship backported fixes, and the PHP team published minimal backports for 7.4, 8.0 and 8.1 for people who build PHP from source.
• Hosted Power's php_uploadprogress_guard. An open-source (MIT) PHP extension that closes the multipart upload path of both flaws on unpatched PHP 5.6 through 8.5. It detaches the session upload-progress callback, uses the patched multipart parser from the official fix, and stops oversized requests with a 413 error before PHP runs out of memory.
• Cloudflare in front, so its emergency firewall rules see the traffic first.

These are mitigations, not an official fix. The guard's own README says the patched release is the only complete mitigation, and it does not cover application-level out-of-memory errors or per-site PHP overrides set in .htaccess or PHP_VALUE.

Upgrading to 8.2 or later is still the best long-term option if you want it. It can be a quick switch or a real upgrade depending on your plugins, theme and custom code, and we test it on a copy first. See PHP version upgrades and our guide to PHP end of life.

When your host cannot help

If your host manages PHP for you, ask them in writing when the fixed release will be applied or, on older PHP, which patched build or mitigation they use. Not every hosting account can be sorted quickly: old servers, unmanaged VPSs, resold hosting and accounts where a former developer holds the logins are the usual sticking points.

If your host cannot give you either, there are two routes. We can upgrade the site to a supported PHP version, or move it to dijihost, dijitul's managed UK hosting, which still offers older PHP versions (5.6, 7.x, 8.0 and 8.1) so old sites keep running. dijihost protects them in layers: Cloudflare's WAF in front, a security extension that closes the known attack path on old PHP, hardened PHP settings, each site isolated, and monitoring for signs of attack, with a vendor-patched build where one exists. On end-of-life PHP those layers are mitigations, not an official fix. We copy the site, test it on the new server and only switch DNS once it works. See website migration support.

Cloudflare and firewalls are a stopgap

Cloudflare deployed emergency firewall (WAF) rules at 03:02 UTC on 21 October, on every plan with the WAF, including Free. Cloudflare's CTO called them "a stopgap only", and the rules only cover traffic that passes through Cloudflare's proxy (the orange cloud). A site whose DNS is on Cloudflare but not proxied, or that can be reached directly at its server IP address, is not shielded. We check this as part of the job, but the fix is still updating PHP.

How to get started

Call 01623 650333 or send us a message with your website address, who hosts it, and a hosting or control panel login if you have one. If you do not know who hosts the site, we can find out from public DNS records. The work is £45 an hour + VAT (30-minute minimum, then 15-minute blocks), and we tell you the likely time before we start. On our Business (£50 a month + VAT) or Complete (£99 a month + VAT) plan, it can come out of your included monthly hours.

Prefer to do it yourself? Follow our step-by-step PHP2Shell checklist, which includes an email you can send to your host.

What it costs

Support plans from £25 a month + VAT, or £45 an hour + VAT for one-off fixes. Pick a plan if you want it looked after every month, or pay by the hour for a one-off job.

Related