{"id":4945,"date":"2026-10-28T00:28:00","date_gmt":"2026-10-28T00:28:00","guid":{"rendered":"https:\/\/itsolutions.ee\/?p=4945"},"modified":"2026-10-28T00:38:22","modified_gmt":"2026-10-28T00:38:22","slug":"php2shell-php-vulnerability","status":"publish","type":"post","link":"https:\/\/itsolutions.ee\/en\/blog\/php2shell-php-vulnerability\/","title":{"rendered":"PHP2Shell: the PHP Flaw That Went Unfixed for 14 Years"},"content":{"rendered":"<p>On 21 October 2026 the PHP team released fixes for two critical vulnerabilities known as <strong>PHP2Shell<\/strong> (CVE-2026-109618 and CVE-2026-109619). They let an attacker run their own code on a server without any login or password. A huge share of the web runs on PHP, including WordPress, WooCommerce, Drupal and Joomla.<\/p>\n<h2>Why 14 years?<\/h2>\n<p>The affected code arrived with PHP 5.4 in 2012. One of the bugs was found in a PHP audit back in 2024, but it was considered unexploitable and never fixed. In 2026 security researchers used AI to find a way to exploit it. Attack attempts were seen even before the official disclosure.<\/p>\n<h2>Who is affected?<\/h2>\n<ul>\n<li>Any site running PHP 5.4 to 8.5 that has not been updated yet.<\/li>\n<li>Especially sites on old PHP versions (7.4, 8.0, 8.1) that no longer receive official updates.<\/li>\n<\/ul>\n<h2>What to do right now<\/h2>\n<ol>\n<li><strong>Check your PHP version.<\/strong> The fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. You can see the version in your hosting panel or in WordPress under Tools \u2192 Site Health.<\/li>\n<li><strong>Contact your host.<\/strong> Ask whether the server has been patched. Most large hosts have already installed the fixes.<\/li>\n<li><strong>On old PHP, plan an upgrade.<\/strong> A site on PHP 7.x is now a serious risk. Moving to a newer version means checking your theme and plugins.<\/li>\n<li><strong>Review your logs.<\/strong> Researchers advise looking for suspicious activity from 17 October onwards.<\/li>\n<\/ol>\n<h2>The lesson for business owners<\/h2>\n<p>A website is not a one-off purchase. The software it runs on needs ongoing maintenance, and someone has to be responsible for applying updates on time. AI now speeds up both finding bugs and attacking them, so the window between disclosure and attacks keeps getting shorter.<\/p>\n<p>We checked and patched the servers of all clients on our maintenance plan as soon as the fixes were out. If you don&#8217;t know which PHP version your site runs on, <a href=\"https:\/\/itsolutions.ee\/en\/services\/\">see our maintenance services<\/a> or ask for a free check.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>PHP2Shell, disclosed in October, lets attackers take over PHP websites without a password. Here is what happened and what every WordPress and online store owner should check right now.<\/p>\n","protected":false},"author":0,"featured_media":3419,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[161],"tags":[164,173,170,188],"class_list":["post-4945","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-blog-news-en","tag-blog-security-en","tag-blog-web-news-en","tag-blog-wordpress-en"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.2 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>PHP2Shell: What Website Owners Must Do | IT Solutions<\/title>\n<meta name=\"description\" content=\"PHP2Shell (CVE-2026-109618, CVE-2026-109619) affects PHP 5.4\u20138.5. What it means for WordPress sites and online stores, and the steps to take now.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/itsolutions.ee\/en\/blog\/php2shell-php-vulnerability\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"PHP2Shell: What Website Owners Must Do | IT Solutions\" \/>\n<meta property=\"og:description\" content=\"PHP2Shell (CVE-2026-109618, CVE-2026-109619) affects PHP 5.4\u20138.5. What it means for WordPress sites and online stores, and the steps to take now.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/itsolutions.ee\/en\/blog\/php2shell-php-vulnerability\/\" \/>\n<meta property=\"og:site_name\" content=\"IT Solutions Group\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/itsolutions.ee\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-28T00:28:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-28T00:38:22+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/itsolutions.ee\/wp-content\/uploads\/2025\/10\/stephen-dawson-qwtCeJ5cLYs-unsplash.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1920\" \/>\n\t<meta property=\"og:image:height\" content=\"1382\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Pavel Zahharov\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Pavel Zahharov\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/itsolutions.ee\\\/en\\\/blog\\\/php2shell-php-vulnerability\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/itsolutions.ee\\\/en\\\/blog\\\/php2shell-php-vulnerability\\\/\"},\"author\":{\"name\":\"Pavel Zahharov\",\"@id\":\"https:\\\/\\\/itsolutions.ee\\\/en\\\/#\\\/schema\\\/person\\\/bfc0a2c78e4c5c77ea61142161f15b72\"},\"headline\":\"PHP2Shell: the PHP Flaw That Went Unfixed for 14 Years\",\"datePublished\":\"2026-10-28T00:28:00+00:00\",\"dateModified\":\"2026-10-28T00:38:22+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/itsolutions.ee\\\/en\\\/blog\\\/php2shell-php-vulnerability\\\/\"},\"wordCount\":317,\"publisher\":{\"@id\":\"https:\\\/\\\/itsolutions.ee\\\/en\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/itsolutions.ee\\\/en\\\/blog\\\/php2shell-php-vulnerability\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/itsolutions.ee\\\/wp-content\\\/uploads\\\/2025\\\/10\\\/stephen-dawson-qwtCeJ5cLYs-unsplash.jpg\",\"keywords\":[\"News\",\"Security\",\"Web news\",\"WordPress\"],\"articleSection\":[\"Blog\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/itsolutions.ee\\\/en\\\/blog\\\/php2shell-php-vulnerability\\\/\",\"url\":\"https:\\\/\\\/itsolutions.ee\\\/en\\\/blog\\\/php2shell-php-vulnerability\\\/\",\"name\":\"PHP2Shell: What Website Owners Must Do | IT Solutions\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/itsolutions.ee\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/itsolutions.ee\\\/en\\\/blog\\\/php2shell-php-vulnerability\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/itsolutions.ee\\\/en\\\/blog\\\/php2shell-php-vulnerability\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/itsolutions.ee\\\/wp-content\\\/uploads\\\/2025\\\/10\\\/stephen-dawson-qwtCeJ5cLYs-unsplash.jpg\",\"datePublished\":\"2026-10-28T00:28:00+00:00\",\"dateModified\":\"2026-10-28T00:38:22+00:00\",\"description\":\"PHP2Shell (CVE-2026-109618, CVE-2026-109619) affects PHP 5.4\u20138.5. What it means for WordPress sites and online stores, and the steps to take now.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/itsolutions.ee\\\/en\\\/blog\\\/php2shell-php-vulnerability\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/itsolutions.ee\\\/en\\\/blog\\\/php2shell-php-vulnerability\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/itsolutions.ee\\\/en\\\/blog\\\/php2shell-php-vulnerability\\\/#primaryimage\",\"url\":\"https:\\\/\\\/itsolutions.ee\\\/wp-content\\\/uploads\\\/2025\\\/10\\\/stephen-dawson-qwtCeJ5cLYs-unsplash.jpg\",\"contentUrl\":\"https:\\\/\\\/itsolutions.ee\\\/wp-content\\\/uploads\\\/2025\\\/10\\\/stephen-dawson-qwtCeJ5cLYs-unsplash.jpg\",\"width\":1920,\"height\":1382,\"caption\":\"stephen dawson qwtCeJ5cLYs unsplash\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/itsolutions.ee\\\/en\\\/blog\\\/php2shell-php-vulnerability\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/itsolutions.ee\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"PHP2Shell: the PHP Flaw That Went Unfixed for 14 Years\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/itsolutions.ee\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/itsolutions.ee\\\/en\\\/\",\"name\":\"IT Solutions Group\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/itsolutions.ee\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/itsolutions.ee\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/itsolutions.ee\\\/en\\\/#organization\",\"name\":\"IT Solutions Group\",\"alternateName\":\"IT Solutions\",\"url\":\"https:\\\/\\\/itsolutions.ee\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/itsolutions.ee\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/itsolutions.ee\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/itsolutions-logo.png\",\"contentUrl\":\"https:\\\/\\\/itsolutions.ee\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/itsolutions-logo.png\",\"width\":201,\"height\":45,\"caption\":\"IT Solutions Group\"},\"image\":{\"@id\":\"https:\\\/\\\/itsolutions.ee\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/itsolutions.ee\",\"https:\\\/\\\/www.instagram.com\\\/itsolutionsee\\\/\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/53392980\\\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/itsolutions.ee\\\/en\\\/#\\\/schema\\\/person\\\/bfc0a2c78e4c5c77ea61142161f15b72\",\"name\":\"Pavel Zahharov\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/7f0d634ec16c23fb8078076f8aeb132aee194220503703353e3d3fb16631687d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/7f0d634ec16c23fb8078076f8aeb132aee194220503703353e3d3fb16631687d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/7f0d634ec16c23fb8078076f8aeb132aee194220503703353e3d3fb16631687d?s=96&d=mm&r=g\",\"caption\":\"Pavel Zahharov\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"PHP2Shell: What Website Owners Must Do | IT Solutions","description":"PHP2Shell (CVE-2026-109618, CVE-2026-109619) affects PHP 5.4\u20138.5. What it means for WordPress sites and online stores, and the steps to take now.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/itsolutions.ee\/en\/blog\/php2shell-php-vulnerability\/","og_locale":"en_US","og_type":"article","og_title":"PHP2Shell: What Website Owners Must Do | IT Solutions","og_description":"PHP2Shell (CVE-2026-109618, CVE-2026-109619) affects PHP 5.4\u20138.5. What it means for WordPress sites and online stores, and the steps to take now.","og_url":"https:\/\/itsolutions.ee\/en\/blog\/php2shell-php-vulnerability\/","og_site_name":"IT Solutions Group","article_publisher":"https:\/\/www.facebook.com\/itsolutions.ee","article_published_time":"2026-10-28T00:28:00+00:00","article_modified_time":"2026-10-28T00:38:22+00:00","og_image":[{"width":1920,"height":1382,"url":"https:\/\/itsolutions.ee\/wp-content\/uploads\/2025\/10\/stephen-dawson-qwtCeJ5cLYs-unsplash.jpg","type":"image\/jpeg"}],"author":"Pavel Zahharov","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Pavel Zahharov","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/itsolutions.ee\/en\/blog\/php2shell-php-vulnerability\/#article","isPartOf":{"@id":"https:\/\/itsolutions.ee\/en\/blog\/php2shell-php-vulnerability\/"},"author":{"name":"Pavel Zahharov","@id":"https:\/\/itsolutions.ee\/en\/#\/schema\/person\/bfc0a2c78e4c5c77ea61142161f15b72"},"headline":"PHP2Shell: the PHP Flaw That Went Unfixed for 14 Years","datePublished":"2026-10-28T00:28:00+00:00","dateModified":"2026-10-28T00:38:22+00:00","mainEntityOfPage":{"@id":"https:\/\/itsolutions.ee\/en\/blog\/php2shell-php-vulnerability\/"},"wordCount":317,"publisher":{"@id":"https:\/\/itsolutions.ee\/en\/#organization"},"image":{"@id":"https:\/\/itsolutions.ee\/en\/blog\/php2shell-php-vulnerability\/#primaryimage"},"thumbnailUrl":"https:\/\/itsolutions.ee\/wp-content\/uploads\/2025\/10\/stephen-dawson-qwtCeJ5cLYs-unsplash.jpg","keywords":["News","Security","Web news","WordPress"],"articleSection":["Blog"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/itsolutions.ee\/en\/blog\/php2shell-php-vulnerability\/","url":"https:\/\/itsolutions.ee\/en\/blog\/php2shell-php-vulnerability\/","name":"PHP2Shell: What Website Owners Must Do | IT Solutions","isPartOf":{"@id":"https:\/\/itsolutions.ee\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/itsolutions.ee\/en\/blog\/php2shell-php-vulnerability\/#primaryimage"},"image":{"@id":"https:\/\/itsolutions.ee\/en\/blog\/php2shell-php-vulnerability\/#primaryimage"},"thumbnailUrl":"https:\/\/itsolutions.ee\/wp-content\/uploads\/2025\/10\/stephen-dawson-qwtCeJ5cLYs-unsplash.jpg","datePublished":"2026-10-28T00:28:00+00:00","dateModified":"2026-10-28T00:38:22+00:00","description":"PHP2Shell (CVE-2026-109618, CVE-2026-109619) affects PHP 5.4\u20138.5. What it means for WordPress sites and online stores, and the steps to take now.","breadcrumb":{"@id":"https:\/\/itsolutions.ee\/en\/blog\/php2shell-php-vulnerability\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/itsolutions.ee\/en\/blog\/php2shell-php-vulnerability\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/itsolutions.ee\/en\/blog\/php2shell-php-vulnerability\/#primaryimage","url":"https:\/\/itsolutions.ee\/wp-content\/uploads\/2025\/10\/stephen-dawson-qwtCeJ5cLYs-unsplash.jpg","contentUrl":"https:\/\/itsolutions.ee\/wp-content\/uploads\/2025\/10\/stephen-dawson-qwtCeJ5cLYs-unsplash.jpg","width":1920,"height":1382,"caption":"stephen dawson qwtCeJ5cLYs unsplash"},{"@type":"BreadcrumbList","@id":"https:\/\/itsolutions.ee\/en\/blog\/php2shell-php-vulnerability\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/itsolutions.ee\/en\/"},{"@type":"ListItem","position":2,"name":"PHP2Shell: the PHP Flaw That Went Unfixed for 14 Years"}]},{"@type":"WebSite","@id":"https:\/\/itsolutions.ee\/en\/#website","url":"https:\/\/itsolutions.ee\/en\/","name":"IT Solutions Group","description":"","publisher":{"@id":"https:\/\/itsolutions.ee\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/itsolutions.ee\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/itsolutions.ee\/en\/#organization","name":"IT Solutions Group","alternateName":"IT Solutions","url":"https:\/\/itsolutions.ee\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/itsolutions.ee\/en\/#\/schema\/logo\/image\/","url":"https:\/\/itsolutions.ee\/wp-content\/uploads\/2025\/02\/itsolutions-logo.png","contentUrl":"https:\/\/itsolutions.ee\/wp-content\/uploads\/2025\/02\/itsolutions-logo.png","width":201,"height":45,"caption":"IT Solutions Group"},"image":{"@id":"https:\/\/itsolutions.ee\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/itsolutions.ee","https:\/\/www.instagram.com\/itsolutionsee\/","https:\/\/www.linkedin.com\/company\/53392980\/"]},{"@type":"Person","@id":"https:\/\/itsolutions.ee\/en\/#\/schema\/person\/bfc0a2c78e4c5c77ea61142161f15b72","name":"Pavel Zahharov","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/7f0d634ec16c23fb8078076f8aeb132aee194220503703353e3d3fb16631687d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/7f0d634ec16c23fb8078076f8aeb132aee194220503703353e3d3fb16631687d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/7f0d634ec16c23fb8078076f8aeb132aee194220503703353e3d3fb16631687d?s=96&d=mm&r=g","caption":"Pavel Zahharov"}}]}},"_links":{"self":[{"href":"https:\/\/itsolutions.ee\/en\/wp-json\/wp\/v2\/posts\/4945","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/itsolutions.ee\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/itsolutions.ee\/en\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/itsolutions.ee\/en\/wp-json\/wp\/v2\/comments?post=4945"}],"version-history":[{"count":1,"href":"https:\/\/itsolutions.ee\/en\/wp-json\/wp\/v2\/posts\/4945\/revisions"}],"predecessor-version":[{"id":4975,"href":"https:\/\/itsolutions.ee\/en\/wp-json\/wp\/v2\/posts\/4945\/revisions\/4975"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/itsolutions.ee\/en\/wp-json\/wp\/v2\/media\/3419"}],"wp:attachment":[{"href":"https:\/\/itsolutions.ee\/en\/wp-json\/wp\/v2\/media?parent=4945"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/itsolutions.ee\/en\/wp-json\/wp\/v2\/categories?post=4945"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/itsolutions.ee\/en\/wp-json\/wp\/v2\/tags?post=4945"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}