PHP2Shell · CVE-2026-109618 · CVE-2026-109619

Is your website actually patched against PHP2Shell?

Two critical PHP vulnerabilities can allow unauthenticated remote code execution. PHP released fixes on October 21, 2026. Updating WordPress alone does not patch the PHP runtime, and a vendor backport may retain an older version label. DoodleWeb checks the evidence, host by host, and explains what it means in plain English.

Book a free check Read the verified advisory

For website owners and authorized teams. Host access or written host confirmation may be needed.

What we check

Every server behind your domain
PHP branch, installed package or build evidence, and host confirmation for every origin and worker pool we can verify—not just the version shown in your dashboard.
How PHP handles requests
PHP-FPM, Apache with mod_php, or another PHP deployment. PHP identifies mod_php as the highest demonstrated risk; other web-serving configurations are also affected.
The patch versus the stopgap
Whether the runtime is patched, whether workers have been restarted as required, and which firewall protections or temporary mitigations are active. A firewall is not evidence of a patched runtime.
Older branches and vendor backports
For PHP 8.1 and older, documented vendor fixes rather than a generic “mitigations applied” message. A backported patch can keep an older upstream version number.
The separate upload-progress issue
Review session.upload_progress configuration and the current advisory for CVE-2026-115560. The October 21 PHP2Shell releases do not, by themselves, resolve this related issue.
Available logs and suspicious activity
Review available logs for signs of compromise, including retained records from October 20 onward. A clean log review cannot rule out compromise; missing evidence is recorded as unverified.

What you get

A one-page report: patched, not patched, or unverified; the evidence behind that conclusion; and the exact steps or questions for your host. If a PHP upgrade is needed, we can scope a compatible supported version with staging, testing and rollback.

The check is not a penetration test or a guarantee that a website has never been compromised. Remediation and incident response are separate scopes.

Why DoodleWeb?

PHP patching belongs alongside application updates, backups, monitoring and a clear response plan—not in a vague “protected” status message. We separate the host’s responsibilities from your website’s maintenance scope, with evidence and next steps you can share with your team.

WordPress maintenance · Drupal support · Maintenance plans and coverage

Source review · October 26, 2026

The facts, briefly

PHP’s official advisory identifies CVE-2026-109618 and CVE-2026-109619 as critical vulnerabilities that can allow unauthenticated remote code execution.
PHP lists 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as the October 21 fixes. Later security releases or documented vendor backports may also include those fixes.
PHP 8.1 and older no longer receive PHP-project updates. PHP supplied minimal source backports for 7.4, 8.0 and 8.1; check your distribution or LTS vendor, or plan an upgrade to a supported branch.
Cloudflare reports attack traffic and WAF protections. Its October 23 update separately describes CVE-2026-115560 in session upload progress, affecting patched releases. WAF coverage for known attempts depends on the configuration described in that update.

Advisories and hosting packages can change. Confirm the current fix with PHP and your host; a version label or build date alone is not sufficient evidence.

Q&A

Frequently asked questions

Does updating WordPress fix PHP2Shell?

Not by itself. These vulnerabilities are in the PHP runtime, not WordPress core. Ask your host to verify the installed PHP security update or vendor backport; a WordPress update or security plugin is not proof of that patch.

My host says we’re protected. What should I ask?

Ask which PHP package or build is installed, which advisory it fixes, whether all origin servers received it, and whether the relevant workers were restarted. Ask whether “protected” means a runtime patch or only a firewall mitigation. An older version label may still contain a vendor backport; request its package changelog or advisory.

Can you help if I’m on a shared host?

Yes. Your host controls the PHP runtime. We help you ask specific questions and interpret the evidence they supply. Any server or package state we cannot independently verify is marked unverified rather than assumed safe.

How long does the check take?

Timing depends on access, the number of servers and how quickly your host supplies evidence. We confirm scope and timing when you book the free check. Remediation, a PHP upgrade or incident response is scoped separately.

Do the October 21 releases fix CVE-2026-115560 too?

No. Cloudflare’s October 23 update describes this as a related session upload-progress issue affecting patched releases, including PHP 8.5.12. Check the latest PHP and hosting advisories for its mitigation and subsequent fix rather than treating a PHP2Shell update as complete protection.