{"id":10768,"date":"2026-10-27T09:17:27","date_gmt":"2026-10-27T09:17:27","guid":{"rendered":"https:\/\/www.hostinger.com\/blog\/?p=10768"},"modified":"2026-10-27T10:40:58","modified_gmt":"2026-10-27T10:40:58","slug":"what-is-php2shell","status":"publish","type":"post","link":"https:\/\/www.hostinger.com\/blog\/what-is-php2shell\/","title":{"rendered":"php2shell: What it is and why you don\u2019t need to panic"},"content":{"rendered":"<p class=\"wp-block-paragraph\">Last updated: Oct. 27, 2026 [09:00 AM, UTC]<\/p><p class=\"wp-block-paragraph\">php2shell is the nickname for two security holes found in <a data-click-id=\"hgr-post-content-link-php\" href=\"https:\/\/www.hostinger.com\/tutorials\/what-is-php\/\">PHP<\/a>. Their official names are CVE-2026-109618 and CVE-2026-109619 (CVE is the public catalog security researchers use to track vulnerabilities).<\/p><p class=\"wp-block-paragraph\"><a data-click-id=\"hgr-post-content-link-about-69-of-websites\" href=\"https:\/\/w3techs.com\/technologies\/details\/pl-php\" target=\"_blank\" rel=\"noopener\">About 69% of websites<\/a> with a known server-side language run on PHP, the language behind logins, contact forms, and checkout carts. The scripting language also powers popular <a data-click-id=\"hgr-post-content-link-content-management-systems-cmss\" href=\"https:\/\/www.hostinger.com\/tutorials\/what-is-a-cms\/\">content management systems (CMSs)<\/a> such as WordPress, Magento, Drupal, and Joomla.<\/p><p class=\"wp-block-paragraph\">This helps explain why php2shell became big news, as PHP runs under a wide range of websites and infrastructures, from personal blogs and small-business sites to online stores, news sites, and community forums.<\/p><p class=\"wp-block-paragraph\">If you&rsquo;re an end user, you don&rsquo;t need to panic, as this bug won&rsquo;t affect you. The fix for php2shell mainly falls to website operators and hosting providers, since it runs on their servers. <\/p><p class=\"wp-block-paragraph\"><strong><div id=\"ez-toc-container\" class=\"ez-toc-v2_0_75 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<span class=\"ez-toc-title-toggle\"><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a data-click-id=\"hgr-post-content-link-how-does-php2shell-cause-damage\" class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.hostinger.com\/blog\/what-is-php2shell\/#How_does_php2shell_cause_damage\">How does php2shell cause damage?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a data-click-id=\"hgr-post-content-link-how-the-php2shell-bugs-unfolded\" class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.hostinger.com\/blog\/what-is-php2shell\/#How_the_php2shell_bugs_unfolded\">How the php2shell bugs unfolded<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a data-click-id=\"hgr-post-content-link-are-these-php2shell-attacks-actually-happening\" class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.hostinger.com\/blog\/what-is-php2shell\/#Are_these_php2shell_attacks_actually_happening\">Are these php2shell attacks actually happening?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a data-click-id=\"hgr-post-content-link-how-to-be-safe-from-the-php2shell-bugs\" class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.hostinger.com\/blog\/what-is-php2shell\/#How_to_be_safe_from_the_php2shell_bugs\">How to be safe from the php2shell bugs?<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a data-click-id=\"hgr-post-content-link-if-youre-on-a-managed-hostinger-hosting-plan\" class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.hostinger.com\/blog\/what-is-php2shell\/#If_youre_on_a_managed_Hostinger_hosting_plan\">If you&rsquo;re on a managed Hostinger hosting plan<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a data-click-id=\"hgr-post-content-link-if-youre-running-a-vps\" class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.hostinger.com\/blog\/what-is-php2shell\/#If_youre_running_a_VPS\">If you&rsquo;re running a VPS<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a data-click-id=\"hgr-post-content-link-if-you-cant-update-php-right-away-use-a-firewall-to-buy-time\" class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.hostinger.com\/blog\/what-is-php2shell\/#If_you_cant_update_PHP_right_away_use_a_firewall_to_buy_time\">If you can&rsquo;t update PHP right away, use a firewall to buy time<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a data-click-id=\"hgr-post-content-link-updating-your-cms-or-plugins-wont-fix-php2shell\" class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.hostinger.com\/blog\/what-is-php2shell\/#Updating_your_CMS_or_plugins_wont_fix_php2shell\">Updating your CMS or plugins won&rsquo;t fix php2shell<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a data-click-id=\"hgr-post-content-link-what-to-do-about-the-third-php-flaw-disclosed-on-oct-23\" class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/www.hostinger.com\/blog\/what-is-php2shell\/#What_to_do_about_the_third_PHP_flaw_disclosed_on_Oct_23\">What to do about the third PHP flaw, disclosed on Oct. 23<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a data-click-id=\"hgr-post-content-link-whats-next\" class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/www.hostinger.com\/blog\/what-is-php2shell\/#Whats_next\">What&rsquo;s next<\/a><\/li><\/ul><\/nav><\/div>\n<\/strong><\/p><h2 class=\"wp-block-heading h-t-title-2\" id=\"h-how-does-php2shell-cause-damage\"><span class=\"ez-toc-section\" id=\"How_does_php2shell_cause_damage\"><\/span>How does php2shell cause damage?<span class=\"ez-toc-section-end\"><\/span><\/h2><p class=\"wp-block-paragraph\">Every time someone visits a website, their browser sends the server a request &ndash; think of it like an order slip handed to the kitchen. Normally, PHP reads the slip and prepares the page, just like a chef cooks the meal you ordered.<\/p><p class=\"wp-block-paragraph\">An attacker exploiting php2shell sends a deliberately malicious order slip that overwhelms PHP while it&rsquo;s still reading it. In the confusion, PHP doesn&rsquo;t tidy up properly, and the attacker can use that leftover mess to slip in their own instructions. From there, they can run their own code on your server.<\/p><p class=\"wp-block-paragraph\">Once that happens, they can do anything your site can do: change your pages, create admin accounts for themselves, read your database (including customer details), or knock the site offline.<\/p><p class=\"wp-block-paragraph\">What makes this worrying is that attackers don&rsquo;t need a password, an account, or even a particular page to target. On servers that run PHP through Apache&rsquo;s <strong>mod_php<\/strong> module, one of the most common custom setups on the web, php2shell can work through almost any page on your site. Other popular setups, such as <strong>PHP-FPM<\/strong>, are also at risk, though attacks there depend more on how a site is configured.<\/p><div class=\"wp-block-image\">\n<figure data-wp-context='{\"imageId\":\"6ae0886e09125\"}' data-wp-interactive=\"core\/image\" data-wp-key=\"6ae0886e09125\" class=\"aligncenter size-large wp-lightbox-container\"><img decoding=\"async\" width=\"1920\" height=\"1080\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/imagedelivery.net\/LqiWLm-3MGbYHtFuUbcBtA\/wp-content\/uploads\/sites\/4\/2026\/10\/php2shell-possible-damages.png\/w=1024,h=1024,fit=scale-down\" alt=\"The illustration of the PHP2Shell attack\" class=\"wp-image-10770\" srcset=\"https:\/\/imagedelivery.net\/LqiWLm-3MGbYHtFuUbcBtA\/wp-content\/uploads\/sites\/4\/2026\/10\/php2shell-possible-damages.png\/w=1920,fit=scale-down 1920w, https:\/\/imagedelivery.net\/LqiWLm-3MGbYHtFuUbcBtA\/wp-content\/uploads\/sites\/4\/2026\/10\/php2shell-possible-damages.png\/w=300,fit=scale-down 300w, https:\/\/imagedelivery.net\/LqiWLm-3MGbYHtFuUbcBtA\/wp-content\/uploads\/sites\/4\/2026\/10\/php2shell-possible-damages.png\/w=768,fit=scale-down 768w, https:\/\/imagedelivery.net\/LqiWLm-3MGbYHtFuUbcBtA\/wp-content\/uploads\/sites\/4\/2026\/10\/php2shell-possible-damages.png\/w=1024,fit=scale-down 1024w, https:\/\/imagedelivery.net\/LqiWLm-3MGbYHtFuUbcBtA\/wp-content\/uploads\/sites\/4\/2026\/10\/php2shell-possible-damages.png\/w=1536,fit=scale-down 1536w\" sizes=\"(max-width: 1920px) 100vw, 1920px\" \/><button class=\"lightbox-trigger\" type=\"button\" aria-haspopup=\"dialog\" data-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\" data-wp-init=\"callbacks.initTriggerButton\" data-wp-on--click=\"actions.showLightbox\" data-wp-style--right=\"state.thisImage.buttonRight\" data-wp-style--top=\"state.thisImage.buttonTop\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\"><\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div><p class=\"wp-block-paragraph\">If it&rsquo;s all automated with <a data-click-id=\"hgr-post-content-link-ai-agents\" href=\"https:\/\/www.hostinger.com\/tutorials\/what-are-ai-agents\/\">AI agents<\/a>, attackers can send these requests to thousands of sites at once and see which ones are still unpatched.<\/p><p class=\"wp-block-paragraph\">If you&rsquo;re just visiting websites, you <strong>can&rsquo;t<\/strong> trigger this by accident, and browsing an unpatched site <strong>won&rsquo;t<\/strong> hack your computer. The risk is to the site and the data stored on it.<\/p><h2 class=\"wp-block-heading h-t-title-2\" id=\"h-how-the-php2shell-bugs-unfolded\"><span class=\"ez-toc-section\" id=\"How_the_php2shell_bugs_unfolded\"><\/span>How the php2shell bugs unfolded<span class=\"ez-toc-section-end\"><\/span><\/h2><p class=\"wp-block-paragraph\">The earliest signs of the problem date back years, but researchers found the first flaw almost three months before most people heard of it.&nbsp;<\/p><p class=\"wp-block-paragraph\">The table shows how related events unfolded in the latest update on the bug&rsquo;s development up until Oct. 23, 2026.<\/p><figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td><strong>Date<\/strong><\/td><td><strong>What happened<\/strong><\/td><\/tr><tr><td>2020&nbsp;&nbsp;<\/td><td>A related out-of-memory PHP bug was reported.&nbsp;<\/td><\/tr><tr><td>2024<\/td><td>While fixing an issue from an external security audit, a <a data-click-id=\"hgr-post-content-link-php-developer-spotted-the-first-signs-of-the-problem\" href=\"https:\/\/thenextweb.com\/news\/php-foundation-structural-failure-2024-flaw-leak\" target=\"_blank\" rel=\"noopener\">PHP developer spotted the first signs of the problem<\/a>. With no proven attack and no agreement on how to fix it, the issue was left unpatched.<\/td><\/tr><tr><td>Aug. 1, 2026<\/td><td>Researchers at the security firm Calif, working under OpenAI&rsquo;s Patch the Planet initiative, <a data-click-id=\"hgr-post-content-link-found-the-first-php-flaw\" href=\"https:\/\/calif.io\/php2shell\/\" target=\"_blank\" rel=\"noopener\">found the first PHP flaw<\/a>.<\/td><\/tr><tr><td>Aug. 11, 2026<\/td><td>Calif reported the first bug to PHP.<\/td><\/tr><tr><td>Aug. 14-15, 2026<\/td><td>Calif shared a working exploit. PHP developers confirmed the next day.<\/td><\/tr><tr><td>Aug. 19&ndash;24, 2026<\/td><td>Wiz Research independently <a data-click-id=\"hgr-post-content-link-found-both-flaws-in-ai-assisted-tools\" href=\"https:\/\/www.wiz.io\/blog\/php2shell-php-rce\" target=\"_blank\" rel=\"noopener\">found both flaws in AI-assisted tools<\/a>. Within two days, its researchers showed they could run code remotely on Drupal, WordPress, and Joomla sites. They reported the flaws to PHP on Aug. 24.<\/td><\/tr><tr><td>Aug. 21, 2026<\/td><td>Calif reported a second bug.<\/td><\/tr><tr><td>Sept. 21, 2026<\/td><td>PHP acknowledged the Wiz reports and started the coordinated fix.<\/td><\/tr><tr><td>Oct. 17, 2026<\/td><td>Amazon&rsquo;s MadPot honeypots (decoy servers) <a data-click-id=\"hgr-post-content-link-recorded-an-attempt-to-exploit-php2shell\" href=\"https:\/\/aws.amazon.com\/blogs\/security\/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot\/\" target=\"_blank\" rel=\"noopener\">recorded an attempt to exploit php2shell<\/a> before any public announcement was made.<\/td><\/tr><tr><td>Oct. 20, 2026<\/td><td>&ndash; The CVE numbers leaked online before any technical details were released. Calif accidentally published a video of its exploit and then pulled it.&nbsp;<br>&ndash; A Hacker News post claiming to disclose the vulnerability was also taken down.&nbsp;<br>&ndash; watchTowr later <a data-click-id=\"hgr-post-content-link-confirmed-the-leak\" href=\"https:\/\/watchtowr.com\/intelligence\/php-remote-code-execution-php2shell\/\" target=\"_blank\" rel=\"noopener\">confirmed the leak<\/a>.<\/td><\/tr><tr><td>Oct. 21, 2026<\/td><td>&ndash; Cloudflare <a data-click-id=\"hgr-post-content-link-turned-on-waf-protection-for-firewall-customers\" href=\"https:\/\/blog.cloudflare.com\/php-vulnerabilities-waf-protection\/\" target=\"_blank\" rel=\"noopener\">turned on WAF protection for firewall customers<\/a>.<br>&ndash; Patchstack reported exploitation from hosting partners. Cloudflare&rsquo;s CTO reported early attacks.<br>&ndash; Hostinger applied security protections to mitigate this vulnerability. After a thorough investigation, our security engineers found no viable path to exploitation in our environment at this time.<br>&ndash; Chainguard published patched builds before the official release, so people can diff the code.<br>&ndash; Government and other sites went offline as a precaution: Overheid.nl, Finnish government services, French Interior Ministry, Wikimedia Phabricator, and Dutch sites including the NCSC.<br>&ndash; watchTowr reported exploitation seen in its honeypots.<br>&ndash; Pre-announcement: a security release was <a data-click-id=\"hgr-post-content-link-scheduled-for-oct-21-at-1400-utc\" href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-20-1\" target=\"_blank\" rel=\"noopener\">scheduled for Oct 21 at 14:00 UTC<\/a>. The release moved up from Oct 22 after the CVE IDs leaked on Oct 20.<br>&ndash; GitHub advisories were published, then <a data-click-id=\"hgr-post-content-link-php-released-patched-versions\" href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-21-5\" target=\"_blank\" rel=\"noopener\">PHP released patched versions<\/a> 8.5.12, 8.4.27, 8.3.36, and 8.2.35.<\/td><\/tr><tr><td>Oct. 22, 2026<\/td><td>&ndash; Cloudflare reported <a data-click-id=\"hgr-post-content-link-millions-of-attack-attempts\" href=\"https:\/\/thedefiant.io\/news\/security\/cloudflare-ceo-reports-millions-of-php2shell-exploit-attempts\" target=\"_blank\" rel=\"noopener\">millions of attack attempts<\/a>.<br>&ndash; Hostinger rolled out patched PHP versions across the entire platform&rsquo;s infrastructure.<br>&ndash; Wordfence (WordPress security plugin) reported <a data-click-id=\"hgr-post-content-link-74000-blocked-exploit-attempts\" href=\"https:\/\/www.wordfence.com\/blog\/2026\/10\/attacks-on-php2shell-continue-but-no-known-compromises-as-a-result-yet\/\" target=\"_blank\" rel=\"noopener\">74,000+ blocked exploit attempts<\/a>.<\/td><\/tr><tr><td>Oct. 23, 2026<\/td><td>&ndash; PHP published an <a data-click-id=\"hgr-post-content-link-advisory-for-a-third-bug\" href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-23-1\" target=\"_blank\" rel=\"noopener\">advisory for a third bug<\/a>, CVE-2026-115560, in the session upload progress feature. PHP said remote code execution (RCE) through it is unlikely. No fix was available yet, so PHP recommended turning the feature off in the meantime.<br>&ndash; Hostinger confirmed that every managed hosting plan was already protected, since the feature had been switched off on Oct 21.<br>&ndash; As of Oct 26, CVE-2026-115560 was not in CISA&rsquo;s <a data-click-id=\"hgr-post-content-link-known-exploited-vulnerabilities-kev-catalog\" href=\"https:\/\/www.cisa.gov\/known-exploited-vulnerabilities-catalog\" target=\"_blank\" rel=\"noopener\">Known Exploited Vulnerabilities (KEV) catalog<\/a>, meaning there was no confirmed evidence of attacks using it.<\/td><\/tr><\/tbody><\/table><\/figure><h2 class=\"wp-block-heading h-t-title-2\" id=\"h-are-these-php2shell-attacks-actually-happening\"><span class=\"ez-toc-section\" id=\"Are_these_php2shell_attacks_actually_happening\"><\/span>Are these php2shell attacks actually happening?<span class=\"ez-toc-section-end\"><\/span><\/h2><p class=\"wp-block-paragraph\">As of Oct. 26, 2026, <strong>no successful php2shell break-in has been publicly confirmed<\/strong>. Attackers are trying, though, and the gap between attempts and confirmed compromises is wide.<\/p><p class=\"wp-block-paragraph\">Amazon&rsquo;s MadPot honeypots recorded one exploitation attempt on Oct. 17 from an anonymized IP address. AWS says it&rsquo;s unclear how the actor got exploit information before disclosure.&nbsp;<\/p><p class=\"wp-block-paragraph\">On Oct. 21, AWS identified several proof-of-concept exploits starting at about 02:00 UTC, roughly 12 hours before PHP&rsquo;s scheduled 14:00 UTC release, and further attempts on other infrastructure until 08:00 UTC.<\/p><p class=\"wp-block-paragraph\"><a data-click-id=\"hgr-post-content-link-attempts-to-exploit-cloudflares-servers\" href=\"https:\/\/www.reuters.com\/world\/asia-pacific\/cloudflare-sees-millions-exploit-attempts-after-php-disclosure-2026-10-22\/\" target=\"_blank\" rel=\"noopener\">Attempts to exploit Cloudflare&rsquo;s servers<\/a> climbed from thousands before the announcement to millions by the end of the day, and attackers began tweaking their payloads to slip past its protections.<\/p><p class=\"wp-block-paragraph\">Most of these numbers come from firewalls and honeypots, so they count attacks that were <strong>blocked or deliberately lured<\/strong>, not sites that were breached.<\/p><p class=\"wp-block-paragraph\">A reported compromise didn&rsquo;t hold up either. Unit 42 linked an attack on a European government agency to php2shell, then <a data-click-id=\"hgr-post-content-link-retracted-the-link-on-oct-25\" href=\"https:\/\/unit42.paloaltonetworks.com\/cve-2026-109618-cve-2026-109619\/\" target=\"_blank\" rel=\"noopener\">retracted the link on Oct. 25<\/a> because it couldn&rsquo;t confirm that the attackers gained access through these CVEs.<\/p><p class=\"wp-block-paragraph\">These facts gave us no reason to panic, but there&rsquo;s also <strong>no reason to postpone updating your PHP<\/strong> to the patched version. Attackers are actively probing sites, so if the update is yours to run, do it today.<\/p><h2 class=\"wp-block-heading h-t-title-2\" id=\"h-how-to-be-safe-from-the-php2shell-bugs\"><span class=\"ez-toc-section\" id=\"How_to_be_safe_from_the_php2shell_bugs\"><\/span>How to be safe from the php2shell bugs?<span class=\"ez-toc-section-end\"><\/span><\/h2><p class=\"wp-block-paragraph\">If you&rsquo;re on shared or managed hosting, protecting the server is your host&rsquo;s responsibility, so you&rsquo;re probably already covered. To be sure, check your host&rsquo;s status page or announcements, or send their support team a quick message asking whether the php2shell fix is in place.<\/p><p class=\"wp-block-paragraph\">If you manage PHP yourself, for example on a <a data-click-id=\"hgr-post-content-link-virtual-private-server-vps\" href=\"https:\/\/www.hostinger.com\/tutorials\/what-is-vps-hosting\/\">virtual private server (VPS)<\/a>, you&rsquo;ll need to update to one of the patched releases (PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35) yourself, then restart PHP to ensure the fix takes effect.<\/p><h3 class=\"wp-block-heading h-t-title-3\"><span class=\"ez-toc-section\" id=\"If_youre_on_a_managed_Hostinger_hosting_plan\"><\/span>If you&rsquo;re on a managed Hostinger hosting plan<span class=\"ez-toc-section-end\"><\/span><\/h3><p class=\"wp-block-paragraph\">If you&rsquo;re on any of our managed web hosting plans, <strong>you&rsquo;re all set<\/strong>. We already <a data-click-id=\"hgr-post-content-link-run-patched-builds-of-every-php-version-we-offer\" href=\"https:\/\/www.hostinger.com\/blog\/protecting-php2shell\/\">run patched builds of every PHP version we offer<\/a> on web, cloud, managed WordPress, and legacy cPanel hosting. Even if your site runs an older PHP version, it&rsquo;s protected.<\/p><p class=\"wp-block-paragraph\">When <a data-click-id=\"hgr-post-content-link-checking-which-php-version\" href=\"https:\/\/www.hostinger.com\/support\/5920192-how-to-check-the-php-version-in-hostinger\/\">checking which PHP version<\/a> your site uses in the Hostinger dashboard, you may still see an older PHP version listed as active. That&rsquo;s normal. What&rsquo;s important is ensuring the <strong>Build Date<\/strong> is listed as October 21, 2026, or later.&nbsp;<\/p><p class=\"wp-block-paragraph\">Watch the video below if you&rsquo;d like a visual walkthrough:<\/p><figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe title=\"How to check and update your PHP version on Hostinger (2026)\" width=\"640\" height=\"360\" src=\"https:\/\/www.youtube.com\/embed\/YJZO4DJu5jM?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><\/figure><h3 class=\"wp-block-heading h-t-title-3\"><span class=\"ez-toc-section\" id=\"If_youre_running_a_VPS\"><\/span>If you&rsquo;re running a VPS<span class=\"ez-toc-section-end\"><\/span><\/h3><p class=\"wp-block-paragraph\">On a VPS, including cPanel VPS plans, you manage PHP yourself, so the update is in your hands. That applies to anything on your server that runs on PHP &ndash; web apps, APIs, admin tools like phpMyAdmin, and webmail all count, even the ones you set up once and forgot about.&nbsp;<\/p><p class=\"wp-block-paragraph\">If you&rsquo;re on Hostinger&rsquo;s VPS, our <a data-click-id=\"hgr-post-content-link-step-by-step-guide\" href=\"https:\/\/www.hostinger.com\/support\/how-to-protect-your-vps-from-the-php2shell-php-vulnerabilities\/\">step-by-step guide<\/a> walks you through the process and includes a temporary workaround if you can&rsquo;t update right away.<\/p><p class=\"wp-block-paragraph\">There&rsquo;s no official patch for PHP 8.1 or older, so moving to a newer version is the only solution. Before you do, check that your theme, plugins, and apps support it, and test the change on a staging copy first if you can.<\/p><p class=\"wp-block-paragraph\">We highly recommend keeping PHP up to date, as older versions miss many security fixes.<\/p><h3 class=\"wp-block-heading h-t-title-3\"><span class=\"ez-toc-section\" id=\"If_you_cant_update_PHP_right_away_use_a_firewall_to_buy_time\"><\/span>If you can&rsquo;t update PHP right away, use a firewall to buy time<span class=\"ez-toc-section-end\"><\/span><\/h3><p class=\"wp-block-paragraph\">Firewall rules are part of how we protected sites on our managed hosting plans: they block requests that match the php2shell attack.&nbsp;<\/p><p class=\"wp-block-paragraph\">If you manage your own server, you can get similar protection from a service like Cloudflare, which <a data-click-id=\"hgr-post-content-link-switched-on-php2shell-protection\" href=\"https:\/\/blog.cloudflare.com\/php-vulnerabilities-waf-protection\/\" target=\"_blank\" rel=\"noopener\">switched on php2shell protection<\/a> for every site using its firewall, including on its free plan.<\/p><p class=\"wp-block-paragraph\">But a firewall only buys you time. It isn&rsquo;t the fix, for two reasons:<\/p><ul class=\"wp-block-list\">\n<li><strong>Attackers adapt.<\/strong> Firewall rules block attack patterns they recognize, and Cloudflare has seen attackers <a data-click-id=\"hgr-post-content-link-tweaking-their-requests-to-slip-past-its-rules\" href=\"https:\/\/www.theregister.com\/cyber-crime\/2026\/10\/22\/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure\/5304749\" target=\"_blank\" rel=\"noopener\">tweaking their requests to slip past its rules<\/a>. Even Cloudflare calls its protection an extra layer of defense and tells site owners to patch PHP.<\/li>\n\n\n\n<li><strong>It only protects traffic that goes through it.<\/strong> If an attacker can reach your server directly, the firewall never sees them.<\/li>\n<\/ul><p class=\"wp-block-paragraph\">PHP&rsquo;s own <a data-click-id=\"hgr-post-content-link-security-advisory\" href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-21-5\" target=\"_blank\" rel=\"noopener\">security advisory<\/a> says updating is the only safe choice. Use a firewall to stay protected while you patch, not instead of patching.<\/p><h3 class=\"wp-block-heading h-t-title-3\"><span class=\"ez-toc-section\" id=\"Updating_your_CMS_or_plugins_wont_fix_php2shell\"><\/span>Updating your CMS or plugins won&rsquo;t fix php2shell<span class=\"ez-toc-section-end\"><\/span><\/h3><p class=\"wp-block-paragraph\">If your site runs on WordPress, Joomla, Drupal, Magento, or another PHP-based CMS, your first instinct might be to hit &ldquo;update all&rdquo; on your core software, plugins, themes, or extensions.&nbsp;<\/p><p class=\"wp-block-paragraph\">That&rsquo;s a great habit, but it won&rsquo;t protect you from this attack. php2shell sits underneath your website&rsquo;s software.<\/p><p class=\"wp-block-paragraph\">All of these platforms, along with every plugin, theme, module, or extension you add to them, are written in and run by PHP. So even a fully updated site is still exposed if the PHP version underneath hasn&rsquo;t been patched. The most direct version of the attack runs before your CMS even starts, which means login pages and security plugins never get a chance to step in.<\/p><p class=\"wp-block-paragraph\">The fix has to happen wherever your PHP is sourced: on your server, with your hosting provider, or in your container image (if your site runs in <a data-click-id=\"hgr-post-content-link-docker\" href=\"https:\/\/www.hostinger.com\/tutorials\/what-is-docker\/\">Docker<\/a> or a similar setup).<\/p><h3 class=\"wp-block-heading h-t-title-3\"><span class=\"ez-toc-section\" id=\"What_to_do_about_the_third_PHP_flaw_disclosed_on_Oct_23\"><\/span>What to do about the third PHP flaw, disclosed on Oct. 23<span class=\"ez-toc-section-end\"><\/span><\/h3><p class=\"wp-block-paragraph\">If you&rsquo;re on one of our managed hosting plans, you don&rsquo;t need to do anything. We&rsquo;ve already protected our servers against this third flaw, CVE-2026-115560, along with the php2shell fixes we rolled out on Oct. 21.<\/p><p class=\"wp-block-paragraph\">If you manage PHP yourself, for example on a VPS, updating PHP won&rsquo;t protect you from this one. The Oct. 21 releases don&rsquo;t include a fix for it, and the official patch will be included in PHP&rsquo;s next regular release.&nbsp;<\/p><p class=\"wp-block-paragraph\">Until then, set <strong>session.upload_progress.enabled = Off<\/strong> in <strong>php.ini<\/strong> or your PHP-FPM pool config, then restart all PHP workers so the change takes effect. If you already did this on October 21, you&rsquo;re covered.<\/p><p class=\"wp-block-paragraph\">Turning this setting off is unlikely to break anything. It only controls a rarely used feature that tracks file upload progress, and WordPress doesn&rsquo;t use it. If you run a custom app that does show upload progress bars this way, that display will stop working until you turn the setting back on after the next PHP release.<\/p><h2 class=\"wp-block-heading h-t-title-2\" id=\"h-whats-next\"><span class=\"ez-toc-section\" id=\"Whats_next\"><\/span>What&rsquo;s next<span class=\"ez-toc-section-end\"><\/span><\/h2><p class=\"wp-block-paragraph\">The two php2shell flaws have been fixed in the Oct. 21 PHP releases. The related third flaw, CVE-2026-115560, will get its official fix in PHP&rsquo;s next regular release, and the setting described above keeps you protected until then.<\/p><p class=\"wp-block-paragraph\">This article reflects publicly available information as of Oct. 26, 2026. Security guidance can change quickly, so check <a data-click-id=\"hgr-post-content-link-phps-official-advisories\" href=\"https:\/\/www.php.net\/\" target=\"_blank\" rel=\"noopener\">PHP&rsquo;s official advisories<\/a> and your hosting provider for the latest updates.<\/p><p class=\"wp-block-paragraph\">If you&rsquo;re a Hostinger customer, keep an eye on our live <a data-click-id=\"hgr-post-content-link-status-page\" href=\"https:\/\/statuspage.hostinger.com\/incidents\/pj2zs1lx3n9d\" target=\"_blank\" rel=\"noopener\">status page<\/a> for updates. Our Customer Success team is also available 24\/7 via live chat to answer questions about your website.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Last updated: Oct. 27, 2026 [09:00 AM, UTC]<\/p>\n<p>php2shell is the nickname for two security holes found in PHP. Their official names are CVE-2026-109618 and CVE-2026-109619 (CVE is \u2026<\/p>\n","protected":false},"author":257,"featured_media":10684,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2417],"tags":[],"hashtags":[],"class_list":["post-10768","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-insights"],"hreflangs":[],"_links":{"self":[{"href":"https:\/\/www.hostinger.com\/blog\/wp-json\/wp\/v2\/posts\/10768","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hostinger.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hostinger.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hostinger.com\/blog\/wp-json\/wp\/v2\/users\/257"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hostinger.com\/blog\/wp-json\/wp\/v2\/comments?post=10768"}],"version-history":[{"count":10,"href":"https:\/\/www.hostinger.com\/blog\/wp-json\/wp\/v2\/posts\/10768\/revisions"}],"predecessor-version":[{"id":10793,"href":"https:\/\/www.hostinger.com\/blog\/wp-json\/wp\/v2\/posts\/10768\/revisions\/10793"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.hostinger.com\/blog\/wp-json\/wp\/v2\/media\/10684"}],"wp:attachment":[{"href":"https:\/\/www.hostinger.com\/blog\/wp-json\/wp\/v2\/media?parent=10768"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hostinger.com\/blog\/wp-json\/wp\/v2\/categories?post=10768"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hostinger.com\/blog\/wp-json\/wp\/v2\/tags?post=10768"},{"taxonomy":"hashtags","embeddable":true,"href":"https:\/\/www.hostinger.com\/blog\/wp-json\/wp\/v2\/hashtags?post=10768"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}