Engineering

PHP2Shell: which website software is affected, and how to check your PHP version

Updated: 23 October 2026

The PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619, published 21 October 2026) are in PHP itself, not in any one product. If your website runs on anything below, the PHP underneath it needs to be on a fixed version. Updating the product does nothing on its own.

Fixed PHP versions: 8.5.12, 8.4.27, 8.3.36, 8.2.35. PHP 8.1, 8.0 and 7.4 are out of support; the project has published source patches for them but your host has to apply them. If you are on any of those, plan an upgrade now.

One-line rule: Whoever runs the server runs the fix. If that is you, update PHP. If it is your hosting company or agency, ask them for the version number in writing.

Content management systems

WordPress and WooCommerce. Roughly two in five websites. Check: log in, go to Tools, then Site Health, then the Info tab, then Server. The PHP version is listed. Automattic has stated that WordPress.com, WordPress VIP, Pressable and WP Cloud were patched at platform level on 21 October; get that confirmed in writing for your site. Self-hosted or on another host: ask the host. Updating WordPress, themes or plugins does not fix this and WordPress.org has said no WordPress update is planned.

Drupal. Check: Reports, then Status report. PHP version is near the top. No Drupal update fixes this.

Joomla. Check: System, then System Information. No Joomla update fixes this.

Magento and Adobe Commerce. Check: admin, System, then Tools, then System Information, or ask your developer to run php -v on the server. Sansec has published a temporary mitigation that blocks multipart uploads at the web server; it is a stopgap, not a fix.

PrestaShop, OpenCart, Shopware. Same position as Magento. Ask your developer or host.

Craft CMS, Concrete CMS, TYPO3, ExpressionEngine, Grav, Statamic, OctoberCMS. All PHP. Ask your host or agency.

Frameworks (bespoke sites and portals)

Laravel, Symfony, CodeIgniter, CakePHP, Yii, Slim, Zend / Laminas. If an agency built you something custom in the last ten years and it is not .NET, Java or Node, there is a good chance it is one of these. Ask the agency: which PHP version is it on, and when was it patched. Developers: php -v on each server, including workers and cron hosts, not just the web tier.

Other PHP software commonly found in SMEs

phpMyAdmin. Database admin tool. Often installed years ago and forgotten, often reachable from the internet. Find it, patch the PHP under it, and put it behind a VPN or remove it.

Moodle. Learning platforms. Ask your Moodle host.

Nextcloud and ownCloud. Self-hosted file sharing. Both PHP. Update the server PHP.

MediaWiki. Wikis. Same.

SuiteCRM, vTiger, EspoCRM. CRM systems. Same.

Mautic. Marketing automation. Same.

Roundcube. Webmail, often bundled with cPanel and Plesk hosting. Confirmed exploitable. Your host owns this one.

WHMCS. Billing for hosting resellers. Confirmed exploitable.

Matomo, Piwik. Analytics. PHP.

osTicket, Invoice Ninja, Akaunting, Dolibarr. Helpdesk, invoicing, accounting and ERP tools. All PHP. A lot of small-business back-office software runs on PHP, and the owner usually does not know.

Hosting control panels

cPanel, Plesk, DirectAdmin, ISPConfig, Webmin / Virtualmin. These run on your server and ship their own PHP builds alongside the system one. Check both. cPanel and Plesk have both issued updates; apply them and then confirm each PHP version offered to sites is a fixed one.

Network appliances and devices

PHP also runs in things that are not websites. Palo Alto has confirmed PAN-OS is affected. Fortinet and Cisco have published advisories and are working through their product lines. Check your firewall, VPN gateway, NAS (Synology and QNAP both ship PHP), printers with web consoles, and anything else with an admin page.

Not in scope

Fully hosted website builders where you never see a server: Wix, Squarespace, Shopify, Webflow, GoDaddy Website Builder, Weebly. You do not run the PHP, they do. Webflow has published a statement that it is not affected. For Shopify, note that a Shopify store with a WordPress blog bolted on is still in scope for the blog.

Hosts that have stated they patched at platform level

As of 23 October 2026, from their own public statements. Get it in writing for your account regardless.

If you cannot work out what you have

Gordion will run a free exposure check for the first 20 UK SMEs who ask before Friday 30 October 2026: we find what you have facing the internet, confirm the PHP version on each and tell you what to fix. Request the free check.

Sources