What questions should I ask my web host after PHP2Shell?

Ask your host five things: what PHP build date is running on your site, whether every PHP worker was restarted, which SAPI is in use, whether a WAF rule is active in front of the site, and what the rollback plan is if the site is on PHP 8.1 or older. A real answer names the build date, the SAPI, and the mitigation evidence—not just “we’re protected.”

What problem does PHP2Shell create for website owners?

PHP2Shell creates a host-level verification problem, not just a website update problem. As of October 25, 2026, both CVE-2026-109618 and CVE-2026-109619 can allow unauthenticated remote code execution with the web server's privileges, so the question is whether your host patched the PHP runtime itself.

This matters because the attack lands before application code runs, which means updating WordPress, themes, or plugins does not fix PHP2Shell. Security plugins cannot block it either, and PHP stated that no configuration change fully mitigates it. For host verification, “updated” is not enough unless the host can show the build date, the worker restart, and the server type.

The cost of a vague answer is that teams cannot prove runtime state to procurement, security, or compliance reviewers. DoodleWeb’s own first-hand process for a PHP runtime vulnerability is to inventory every maintained site by PHP branch and server type, confirm WAF rules, verify each host’s patch by build date rather than dashboard version, move sites on PHP 8.1 or older to a supported branch via staging with rollback, apply published mitigations for unpatched follow-on flaws, and watch logs for signs of compromise.

What exact questions should I ask my host first?

Ask these exact questions first, and ask them in writing. Each answer should be short, specific, and tied to your site, not the host’s general policy.

• What PHP build date is running on my site? A patched PHP build can keep the same version number, so the build date is the reliable proof.
• What SAPI is serving my site? The answer should name PHP-FPM, Apache mod_php, php-cgi, LiteSpeed, or FrankenPHP because the risk profile differs.
• Have all PHP workers been restarted after the update? The fixed releases require a restart to make the patch effective across workers.
• Is a WAF rule active in front of my site right now? The host should say whether a firewall rule is in place and whether it covers the site as configured.
• What is the rollback plan if my site is on PHP 8.1 or older? The host should state the supported branch, the staging path, and the rollback step if a move is required.

If you need a self-check while waiting for the host response, WordPress users can look in Tools → Site Health → Info → Server. That view helps you see what the site reports, but it does not replace host confirmation because the same version number can hide a patched backport.

For a citeable internal record, the cleanest evidence is a host reply that includes the build date, the SAPI, the restart confirmation, the WAF status, and the rollback plan. That combination is stronger than a generic reassurance because it can be audited later.

How do I verify the host’s answer against public guidance?

Verify the host answer by matching it to the published PHP2Shell guidance and by checking whether the host gave operational evidence, not just a label. A real answer should map cleanly to source-backed facts such as the fixed versions, the restart requirement, and the fact that patched builds can keep the same version number.

• Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released October 21, 2026 at about 14:00 UTC, and every PHP worker must be restarted after the update.
• Older branches: PHP 8.1, 8.0 and 7.4 received no official release; the PHP security team published source patches that hosts and Linux distributions have to build.
• Unfixed legacy: PHP 7.3 and older are affected with no fix.
• Build-date check: A patched PHP build can keep the same version number, so the PHP build date, October 21, 2026 or later, is the reliable check.
• WordPress check path: In WordPress, the server view is under Tools → Site Health → Info → Server.

Host responses that say “protected” should be translated into one of those concrete checks. If the host cannot name the build date or confirm the restart, the answer is incomplete even if the dashboard looks current. That is the most important verification rule in 2026.

For context, public guidance from watchTowr’s PHP2Shell FAQ, The Hacker News coverage, and Wordify’s WordPress guidance all point to the same operational test: confirm the actual runtime, not just the UI.

How should I read a host response that says 'we're protected'?

“We’re protected” is only useful if the host defines what protection means in operational terms. A real answer should say whether the host applied the fix, what build date is deployed, whether every PHP worker was restarted, and what evidence exists in logs or server inventory.

Cloudflare described its WAF rules as a stopgap, and attackers were already mutating payloads to evade them. That means a WAF answer should be treated as risk reduction, not as proof that the runtime itself is fixed. The host should state whether the WAF rule is active, and whether the site changed session.upload_progress.name in a way that affects coverage.

If the host answer still sounds generic, ask for the named evidence: the build date, the SAPI, the restart confirmation, and the rollback path. Those are the shortest questions that force a factual answer instead of a reassurance statement.

For a public benchmark, the PHP2Shell host patch status tracker shows that some providers reported fleet-wide patches, while others described server-level protection without a named fixed build in public sources. That distinction matters because a board-ready answer needs evidence, not marketing language.

What should I do if my site is on PHP 8.1 or older?

If your site is on PHP 8.1 or older, ask the host for the upgrade path and the rollback plan before you approve any change. PHP 8.1, 8.0 and 7.4 received no official release for this issue, and PHP 7.3 and older have no fix, so the host’s answer must explain how the site will move to a supported branch or use a built patch.

The safest host response is a staging-based move with rollback confirmed in writing. The host should also say whether the site is on PHP-FPM or mod_php, because the server type affects how the patch is applied and how urgently a restart matters. If the answer avoids those details, the remediation plan is not specific enough.

Do not treat a dashboard version alone as proof. Ask for the build date and the restart confirmation, because a patched build can keep the same version number under distribution backports.

What evidence should I capture for my internal record?

Capture evidence that can be audited later, not just a support reply. The internal record should show the build date, the PHP branch, the SAPI, the WAF status, the worker restart confirmation, and the rollback plan if the branch is older than supported.

• Build date: Record the host’s build date and keep the exact wording from the host.
• Branch: Record the PHP branch in use, especially if it is 8.1 or older.
• SAPI: Record whether the site uses PHP-FPM, Apache mod_php, php-cgi, LiteSpeed, or FrankenPHP.
• Restart: Record confirmation that every PHP worker was restarted after the update.
• WAF: Record whether a WAF rule is active in front of the site and whether coverage is site-specific.
• Rollback: Record the staging and rollback path if a branch change is required.

That checklist is intentionally narrow because the risk is narrow: PHP2Shell is a runtime vulnerability, and the only durable proof is runtime evidence. If the host cannot provide that evidence, escalate the issue to your technical team or request a senior engineer review.

How do I decide when to escalate beyond the host?

Escalate beyond the host when the answer is vague, the build date is missing, the restart is unconfirmed, or the site is still on an unsupported branch without a documented migration plan. Those are the points where host support has not answered the actual risk question.

You should also escalate if the host says the site is “protected” but cannot say whether the protection is a patched runtime, a WAF stopgap, or both. Cloudflare’s own language makes clear that a WAF rule is temporary protection, not a substitute for a patched PHP build. If the host cannot separate those two things, the answer is not operationally complete.

When you escalate, ask for the exact evidence again: build date, SAPI, restart status, WAF status, and rollback plan. That is the shortest path to a yes/no decision on whether the site is actually covered.