php2shell
Menu

Which situation are you in?

Five common setups and the next step for each: your own server, shared hosting, managed WordPress, an old PHP version, or a fleet of client sites.

First, the version

Run php -v, or open your hosting panel's PHP settings, and paste the version into the check on the home page. Fixed releases: 8.5.12, 8.4.27, 8.3.36, 8.2.35. Anything 8.1 or older has no official release.

You run your own server

A VPS, a dedicated machine or containers you build. You can fix this today:

  1. Upgrade the PHP package: 8.3, 8.2.
  2. Restart every PHP worker.
  3. Confirm the running version.

You are on shared hosting

Your host patches PHP, not you. Send them three questions:

  1. Which PHP builds serve my sites, and do they include the fixes for CVE-2026-109618 and CVE-2026-109619?
  2. When were the PHP workers restarted after the update?
  3. If my site runs PHP 8.1 or older, will you patch it, or should I switch the version in the panel?

If a host cannot answer the first question within a few days, take that into account. Many panels let you pick a newer PHP version yourself; do that first if your site supports it.

You run WordPress

PHP2Shell is not a WordPress bug and no plugin fixes it. The fix is in the PHP version under WordPress. On managed WordPress hosting your host does it; elsewhere see the server or shared-hosting answers above. Guides: check the PHP version and change it.

You are stuck on PHP 8.1 or older

There is no official package. Your options are upgrading, a patched distribution package or paid extended support, compared on old PHP versions.

You look after many sites

Agencies and freelancers: list every server and every PHP version that serves a site, patch and restart each, then record the version reported from the web side. If you want a second pair of hands, we can help.

Last reviewed on 22 October 2026.