← All articles

PHP2Shell (CVSS 9.2): what this critical PHP flaw means for your website

Two critical flaws affect the PHP engine itself, and therefore most WordPress, PrestaShop and custom websites. Who is affected, what the risks are, and what we did for the sites hosted by OVS Corp.

The OVS Corp team · · 2 min read
  • Security
  • PHP
  • WordPress
  • Hosting

On 22 October 2026, two critical flaws were disclosed in PHP, the language that runs the vast majority of websites: WordPress, PrestaShop, Joomla, Drupal and many custom-built sites. Grouped under the name PHP2Shell (CVE-2026-109618 and CVE-2026-109619), they are rated 9.2 out of 10 on the CVSS scale, the “critical” level.

Here is what matters, without the jargon.

Evolving situation. New information about these flaws is being published every day. We are following the situation closely and will update this article as announcements are made.

Why it is serious

For once, the problem does not come from a badly written plugin or a hacked theme, but from the PHP engine itself. Both flaws relate to how the engine manages memory.

Exploiting them allows an attacker, with no account and no password, to run their own code on the server. In practice, a vulnerable website can end up:

  • with its customer data or database stolen;
  • infected with malware or redirected to fraudulent sites;
  • used to send spam, wrecking the reputation of your emails;
  • defaced or taken offline.

Several security vendors already report the first exploitation attempts. Speed matters.

Who is affected?

According to published analyses, every PHP version from 5.4 up to the 8.x releases is affected. In practice, almost every PHP website online today.

The PHP project has released fixed versions for the maintained branches: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. For older versions (7.4, 8.0, 8.1), which are no longer officially maintained, only source-level fixes exist. One more reason not to stay on an end-of-life PHP version.

Your site does not need to be “badly built” to be exposed: a fully up-to-date WordPress site remains vulnerable if the server’s PHP is not.

What we did for the sites hosted by OVS Corp

As soon as the flaws were announced, our team deployed protective measures across our entire hosting platform:

  • the entry point used by these attacks was neutralised;
  • the limits applied to each site were tightened;
  • an additional protection module was added, which also blocks two other PHP vulnerabilities that have not yet been officially fixed.

These protections have been active on every site we host since 22 October 2026. Our clients do not need to apply any patch or PHP upgrade. We keep monitoring releases from the PHP project and apply each official fix as soon as it becomes available for our infrastructure.

That is exactly what managed hosting is for: watching, reacting the same day, and protecting your sites before you have to worry about it.

What you can do on your side

Website security remains a shared responsibility. A few simple habits greatly reduce the risk:

  • update WordPress, PrestaShop, your themes and plugins as soon as an update is offered;
  • remove unused plugins, even deactivated ones;
  • use strong passwords and turn on two-factor authentication for administrator accounts;
  • keep your own backups, in addition to your host’s.

Not hosted with us?

Ask your hosting provider whether they have applied the official fix or protective measures against PHP2Shell, and since when. If they cannot give you a clear answer, contact us: we can check your site’s exposure and offer a move to our secure web hosting.

Sources: advisories published by the PHP project and by security agencies and vendors, including Tenable and the Cyber Security Agency of Singapore.

Read next