Sandbanks DigitalPHP2Shell: how many WordPress sites run unpatched PHP?
On 21 October 2026 the PHP team fixed two critical flaws that let an attacker run commands on a web server without logging in, and the UK's National Cyber Security Centre told organisations to act the same day. PHP sits underneath WordPress and most of the small-business web. Here is what happened, how many sites are on versions that got no fix, and what to do about yours.
By Elliot · Published 21 October 2026 · 9 min read
The short answer
- Every site served by PHP is affected until its server is updated. That includes every WordPress site.
- Updating WordPress or plugins does not fix it. The fix is PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12.
- PHP 8.1 and older got no new release. That is 36.4% of WordPress installs, by WordPress's own figures.
- Check your version under Tools, Site Health, Info, Server, then ask your host the question in step 3 below.
Two critical PHP flaws, leaked a day early
PHP is the programming language that runs on the server behind most content-managed websites. When someone loads a WordPress page, PHP is what builds it. On 20 October the PHP team gave advance notice of an emergency security release, after details of the bugs had already leaked online. The release landed at 14:00 UTC on 21 October.
The PHP team's advisory says the flaws can be reached by an ordinary web request and, on servers using Apache's mod_php, before any of the site's own code runs. That is why the usual defences of a WordPress site (strong passwords, a security plugin, two-factor login) do not come into it. The request never gets as far as WordPress.
The NCSC's alert asks organisations to find every system running PHP, update it, and, where that is not possible, consider taking it offline until it can be fixed. On the morning of the release Cloudflare said it was already seeing early attacks. The Dutch NCSC reported several public proof-of-concept exploits and, at that point, no confirmed active exploitation, but considered large-scale exploitation likely in the short term. Several Dutch sites, the House of Representatives' among them, went offline as a precaution.
| Names | CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell |
|---|---|
| Rating | Critical. The PHP team scores both 9.2 out of 10 (CVSS v4.0) |
| What an attacker gets | Commands run on the web server, with no login needed |
| Where the bug lives | PHP itself, the language the server runs. Not WordPress, not a plugin |
| Server set-ups hit | PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. mod_php is the highest risk |
| Fixed in | PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released 21 October 2026 |
| No new release for | PHP 8.1 and older. Your host or Linux vendor may backport a fix |
How many sites are on a PHP version with no fix?
Two independent counts, read on 21 October 2026, the day of the release.
69.3%
of websites with a detectable server language run PHP
Source: W3Techs
39.6%
of all websites run on WordPress, which needs PHP
Source: W3Techs
36.4%
of WordPress installs report PHP 8.1 or older, which got no release
Source: WordPress.org
WordPress publishes the PHP versions its installs report when they check for updates. The table below is that feed, grouped by what the 21 October release did for each branch. PHP 7.4 stands out: it went out of support in November 2022, yet one WordPress install in six still runs it.
| PHP version | Share of installs | Status after 21 October |
|---|---|---|
| PHP 5.x and older | 2.0% | No fix. Out of support since 2018 or earlier |
| PHP 7.0 to 7.3 | 3.7% | No fix. Out of support |
| PHP 7.4 | 16.1% | No release. Source patch only, for those who build PHP themselves |
| PHP 8.0 | 3.8% | No release. Source patch only |
| PHP 8.1 | 10.7% | No release. Source patch only |
| PHP 8.2 | 23.8% | Fixed in 8.2.35. Support ends 31 December 2026 |
| PHP 8.3 | 26.6% | Fixed in 8.3.36. Supported to end of 2027 |
| PHP 8.4 | 9.3% | Fixed in 8.4.27. Supported to end of 2028 |
| PHP 8.5 | 3.9% | Fixed in 8.5.12. Supported to end of 2029 |
W3Techs' survey of the wider web tells the same story from a different angle. Of the PHP sites that reveal their version, 65.2% are on PHP 8, 27.0% on PHP 7 and 7.7% still on PHP 5. Combining those with its split of PHP 8 (8.0 at 5.8%, 8.1 at 15.2%), about 48.5% of PHP sites with a visible version are on a branch the PHP project did not release a fix for. That figure is our arithmetic from W3Techs' published breakdown, not a number W3Techs states.
And the cliff edge moves again soon. PHP 8.2 stops receiving security fixes on 31 December 2026. Unless they move, the WordPress installs on 8.2 join the unsupported group on 1 January 2027, which would take it from 36.4% to about 60% of all installs overnight. WordPress itself now recommends PHP 8.3 or newer.
It is not only a WordPress problem
Anything PHP serves to the internet is in scope. These are the places it hides in a typical small business.
WordPress and WooCommerce
WordPress runs on PHP, so every WordPress site sits on top of this bug. A fully updated WordPress install with tidy plugins is still exposed if the PHP underneath it is not patched, and WordPress's own maintenance mode does nothing to stop it.
Joomla, Drupal and other PHP CMSs
Joomla, Drupal, Craft, Concrete and the older PHP content systems are in exactly the same position. The CMS version is irrelevant here. What matters is the PHP build the server is running.
PHP online shops
Magento (Adobe Commerce), PrestaShop and OpenCart are PHP. Shops are the sites attackers most want, because a server they control can skim card details at checkout. Sansec, who specialise in shop security, expected mass attacks within minutes of the patch.
Bespoke PHP and Laravel apps
A booking system or client portal written in PHP, or built on Laravel or Symfony, needs the same PHP update. If a developer built it years ago and nobody looks after it now, it is probably the least patched thing you own.
Shared hosting accounts
On cPanel, Plesk and similar shared hosting the host controls the PHP build, often through a version picker in your control panel. Plesk listed every PHP version it ships as affected. Picking a newer branch only helps once the host has rebuilt it.
Things that bundle PHP quietly
Some routers, firewalls, NAS boxes, phone systems and intranet tools ship PHP inside them. The NCSC specifically tells organisations to watch vendors that bundle PHP, because you will not see it in a hosting panel.
How to check your site, in six steps
None of this needs a developer to start. Steps one to three take a few minutes and an email.
Find out which PHP version your site runs
In WordPress, go to Tools, Site Health, Info, then open Server. The PHP version is listed there. On cPanel look for MultiPHP Manager, on Plesk for PHP Settings. No login? Your hosting company can tell you in one email, and so can we.
Check the full number, not just the branch
PHP 8.3 is not enough on its own. You need 8.3.36 or later, and likewise 8.2.35, 8.4.27 or 8.5.12. Anything earlier on those branches is unpatched, unless your host has backported the fix without changing the number (step 3).
On PHP 8.1 or older, ask your host one direct question
Email them today: “Has the fix for CVE-2026-109618 and CVE-2026-109619 been applied to the PHP version my site runs?” Some hosts and long-term-support vendors backport fixes into old branches. If the answer is no, or vague, ask to be moved to PHP 8.3 or newer.
Test before you switch branches
Moving from PHP 7.4 to 8.3 can break old themes and plugins. Take a backup, update WordPress and every plugin first, then switch, then click through the pages that make you money: contact form, booking, checkout. Switch back straight away if something breaks, and get it fixed properly.
If you cannot patch yet, reduce the exposure
Cloudflare put rules in front of every customer, free plan included, but its CTO called them a stopgap, and they only cover traffic that actually goes through Cloudflare. The PHP team lists partial settings changes and says plainly that they do not make an installation safe. The NCSC's advice for systems that cannot be fixed is to consider taking them offline.
Ask whether anything already got in
If your site sat unpatched after 21 October, ask your host or developer to check for new admin users, unfamiliar files in the uploads folder and odd outbound connections. Patching closes the door. It does not remove anyone already inside.
Why a version number cannot tell you that you are safe
Many servers announce their PHP version in a response header called X-Powered-By, and that is how surveys like W3Techs see it. It cuts both ways. Plenty of hosts hide the header, so a site that says nothing is not necessarily up to date. And Linux distributions such as Debian, Ubuntu and Red Hat often patch an old version without changing its number, so a server reporting PHP 8.1 may have the fix while one reporting 8.3.30 does not.
The two datasets above measure different things. W3Techs counts websites, and only those whose language and version it can detect. The WordPress figures count installs that check in for updates, which includes staging copies and abandoned sites nobody visits. Neither is a count of hacked or even provably vulnerable sites. What both show, consistently, is that a very large share of the PHP web runs on branches the PHP project has stopped looking after.
That is also why we never tell anyone “your site is vulnerable” from the outside. If you ask us to look, we read only what your server already tells every visitor, and we never send a request that tries the flaw: doing that to a site you do not own is unauthorised access under the Computer Misuse Act, whatever the intent. The only people who can confirm a fix is in place are whoever runs your server.
PHP2Shell questions, answered
What is PHP2Shell?
PHP2Shell is the nickname for two critical flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and fixed on 21 October 2026. The PHP team says both can allow unauthenticated remote code execution, meaning an attacker can run commands on a web server without logging in. The UK's National Cyber Security Centre issued an alert the same day telling organisations to update immediately.
Is my WordPress site affected by the PHP vulnerability?
If it is served by PHP, which every WordPress site is, then it is affected until the PHP on its server is updated. The PHP team says the risk covers all PHP installations serving web requests. The WordPress version and your plugins make no difference to this particular bug.
Will updating WordPress or my plugins fix it?
No. The flaws are in PHP itself, the software WordPress runs on. The fix is a new PHP release (8.2.35, 8.3.36, 8.4.27 or 8.5.12), which on most small-business sites your hosting company installs. Keep WordPress updated anyway, because a move to a newer PHP branch goes more smoothly when everything else is current.
Which PHP versions are patched?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 contain the fix. PHP 8.1 and older no longer receive releases from the PHP project. Its security team published minimal source patches for PHP 7.4, 8.0 and 8.1, for people who build PHP themselves, and some Linux distributions and long-term-support vendors backport fixes into older packages.
My host says my site is on PHP 7.4. Is it vulnerable?
Very possibly. PHP 7.4 got no official release. Whether your site is exposed depends on whether your host applied a backported fix to its own 7.4 build, and only the host can tell you that. Ask them directly, and plan a move to PHP 8.3 or newer either way, because 7.4 has been out of support since November 2022.
Does Cloudflare protect my site from PHP2Shell?
Partly, and only for a while. Cloudflare deployed rules for all customers, including the free plan, but its CTO described them as a stopgap, and they only filter traffic that passes through Cloudflare. An attacker who reaches your server directly by its IP address bypasses them. Patching PHP is the only fix.
How many websites run an out-of-date version of PHP?
A lot. W3Techs found PHP behind 69.3% of websites whose server language it could detect on 21 October 2026. Of the PHP sites that reveal their version, about 48.5% are on PHP 8.1 or older by our arithmetic from W3Techs' breakdown. Among WordPress installs, the figures WordPress publishes show 36.4% on PHP 8.1 or older.
Is a Next.js or static website affected?
Not by this bug, as long as no PHP runs on the server that serves it. Next.js sites run on Node.js and static sites are plain files. That is one reason every site we build is on Next.js: there is no PHP layer, no plugin stack and nothing to patch on the night a PHP flaw is announced.
Sources & further reading
The guidance on this page is grounded in primary sources. Follow the links to read them in full.
- NCSC: Critical security issue affecting PHP
The UK National Cyber Security Centre's alert of 21 October 2026: identify PHP systems, update, and consider taking unfixable ones offline.
- PHP: 2026 news archive, security advisory
The PHP team's advisory: fixed versions, affected server set-ups, the source patches for 7.4 to 8.1 and the partial mitigations.
- PHP: Supported versions
Which PHP branches still receive fixes, and the date each one stops, including 8.2 on 31 December 2026.
- W3Techs: Usage statistics of PHP
PHP's share of websites and the split of PHP 8, 7, 5 and 4, read on 21 October 2026. Sub-version pages give the 8.x and 7.x splits.
- W3Techs: Usage statistics of WordPress
WordPress at 39.6% of all websites, read on 21 October 2026.
- WordPress.org: PHP version statistics
The live feed of PHP versions WordPress installs report, behind wordpress.org/about/stats. Read on 21 October 2026.
- WordPress.org: Requirements
WordPress recommends PHP 8.3 or newer, and warns that older versions have reached end of life.
- Tenable: PHP2Shell frequently asked questions
Background, the leak timeline, Cloudflare's statement on early attacks and its stopgap rules.
- NCSC-NL: php2shell operational information
The Dutch NCSC's tracker: exploitation status and an inventory of affected products and vendors.
- Sansec: PHP2Shell research
An e-commerce security firm's timeline, its warning about online shops and its interim server rules.