PHP2Shell: PHP’s critical security release is scheduled for 10 AM: what site owners should check now

Update: PHP released the fix. See what to do now.

What to do this morning

If your website runs PHP, find out who manages it and ask that person to check PHP's official security notice today. PHP has scheduled a release for Wednesday, October 21, at 14:00 UTC (10:00 AM Eastern) to address two critical vulnerabilities, being called PHP2Shell. PHP says it may release earlier.

The advance notice rates both vulnerabilities CVSS v4.0 9.2. It does not yet say which PHP versions are affected, which versions will receive fixes, or whether an attacker needs a login or a particular setting. PHP says it will publish the affected and fixed versions with the release. Do not guess from version numbers circulating before then.

Who to contact

• Your web host: Check a hosting bill or sign in through the account page you already use.
• Your web person or IT provider: Contact the staff member, contractor, or volunteer who maintains the site.
• Your website platform: If you use a fully managed service, ask its support team whether the service uses affected PHP software and what it will do. The provider manages its servers; you may not have a PHP setting to change.

If you do not know who manages the site, start with the person who set it up or the organization’s hosting bill.

What this means for common sites

• WordPress on hosting you or your provider manage: WordPress runs on PHP. The PHP version is part of the server environment, separate from WordPress and plugin updates. Ask the host or site administrator who will check and apply PHP's official fix if needed.
• Other self-managed PHP software: Drupal, Joomla, Moodle, Nextcloud, CiviCRM, and similar tools may run on PHP servers. If your organization or provider manages that server, ask who will check the PHP advisory and update it if needed.
• Hosted website builders: The provider controls the underlying software. Ask through its official support channel whether this notice applies; do not try to install PHP yourself.

Do not change PHP versions on your own unless you or your web administrator have checked that the site is compatible and have a way to restore it if something breaks.

Check the PHP version and support status

Ask your host or web administrator which PHP version runs your site and whether updates are applied automatically. If you have an administrator dashboard such as cPanel or Plesk, it may show the version, but ask your host if you are unsure what the setting means.

PHP's current supported-versions page lists branches 8.2 through 8.5 as supported. Branches 8.0 and 8.1 are no longer listed as supported. That support table does not say which branches are affected by this specific issue or which will receive a fix. If your site uses an older branch, ask your provider for a supported upgrade plan; do not make a rushed change without checking compatibility and backups.

Before the release

1. Find out who hosts or manages your website.
2. Ask which PHP version the site runs and whether the host applies security updates automatically.
3. Agree who will check PHP's official advisory and confirm whether your version is affected.
4. Ask whether there is a recent backup and how the site can be restored if an update causes a problem.
5. Do not download unofficial “PHP checker” or “exploit” tools shared online. PHP's advance notice does not publish technical details.

A message you can send

Hi, PHP has announced a critical security release for October 21 at 10:00 AM Eastern. Can you tell me which PHP version our site runs, who will check PHP's official advisory, and when you will apply the official fix if our version is affected? Please also confirm that we have a recent backup and let me know when the update is complete.

Be careful with unexpected update requests

This is a general precaution, not a report of a confirmed scam involving this release. Treat an unexpected message asking you to log in, pay, install a tool, or provide remote access as unverified. Contact your host through the account dashboard, a saved bookmark, or contact details you already use—not through the message.

For your web administrator

PHP's advance notice confirms two critical vulnerabilities, both rated CVSS v4.0 9.2 by the PHP security team. The release is scheduled for October 21, 2026, at 14:00 UTC, and PHP may release it earlier. PHP says its release notice will identify affected versions and fixed versions.

When the notice appears, check PHP's official release and security advisory pages. Also check your operating-system or hosting provider's advisory: some distributions may provide a security fix under an older-looking version number. Do not assume a package is vulnerable or fixed based only on its upstream version string.

A CERT-EU advisory says PHP 5 onward could be affected, citing other reporting. PHP has not confirmed that range in its advance notice; do not treat it as PHP's official affected-version list.

Until PHP publishes the advisory, do not rely on unverified claims about affected versions, the vulnerability's cause, required settings or access, or available fixes. Do not treat a configuration change or web filter as a replacement for the official update.

Sources

• PHP.net: Upcoming Critical PHP Security Release
• PHP source security advisories
• PHP.net: Supported Versions
• CERT-EU Security Advisory 2026-018 — its broad version range is attributed to other reporting, not PHP's official list.
• WordPress.org: Requirements
• PHP logo by Colin Viebrock, reused unchanged under CC BY-SA 4.0 from PHP.net’s logo page. The thumbnail composition is shared under the same license; PHP does not endorse this article.

Source check: October 21, 2026, before PHP's scheduled release. This guide covers the advance notice only; confirm PHP's advisory before updating it after the release.