PHP2Shell vulnerability: how to tell if your website is exposed and what to do

On 20 October 2026 a critical PHP vulnerability known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619) was made public. It lets an attacker run code on the server without any password, just by sending requests to the website. It affects every PHP version from 5.4 to 8.5.11, and it was already being exploited before it was disclosed.

PHP is the language behind WordPress, Joomla, Drupal, PrestaShop and most custom-built websites. So if you have a website, it is very likely affected.

If your website is hosted at Intergrid, it is protected

If your website is hosted with us, it has not been affected in any way and you do not need to do anything. We explained this to our customers by email on 25 October.

On Wednesday 21 October, when the vulnerability was disclosed, our team got to work straight away:

• Within minutes we applied a first protective measure to every PHP installation on all our servers.
• Right after that we updated and fixed every vulnerable PHP across our entire server fleet.
• That includes the old PHP versions that vendors no longer update: we rebuilt them ourselves with the security fixes, so the websites that still depend on them kept working and are protected.

In addition, websites with the WebSentinel service are scanned for malicious code every night. When something like this happens, there is a team on watch that acts immediately.

If your website is hosted elsewhere, here is what you need to know.

How to tell if your website is affected

The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or later. The 7.4, 8.0 and 8.1 branches are only fixed if your provider has patched them on its own. Versions 5.x, 7.2 and 7.3 will never get an official fix.

To find out which version your website runs:

• In WordPress: Tools → Site Health → Info → Server.
• In your hosting control panel, under the PHP settings.
• By asking your hosting provider, who should also be able to tell you whether the fix has been applied.

Websites running an old version of WordPress or PHP are the most at risk: they are the ones that cannot be upgraded overnight.

What you should do

• Upgrade PHP to a fixed version. It is the only complete solution.
• If the website does not work on a modern PHP, update WordPress, the theme and the plugins, or replace the ones that are no longer maintained.
• In the meantime, your provider can reduce the risk by disabling session.upload_progress in the server's php.ini. Setting it in the website's .user.ini does not work.
• Check the website for unfamiliar files: if someone already got in, the fix will not lock them out.

Is your website hosted elsewhere and you don't know where to start?

We can take care of it. We move your website to Intergrid free of charge, along with your email and domain if needed, and leave it running on a fixed, maintained PHP version. If the website is old, we tell you what needs updating so it works on a modern PHP without losing content or search rankings, and we do it for you.

Before we start we send you a no-obligation quote, and the migration only begins once you approve it.