- Mistake 1: Is a WordPress or plugin update enough to protect you from PHP2Shell?
- Error 2: Is your server really running the patched version of PHP?
- Mistake 3: Do workarounds and WAFs provide complete protection?
- Mistake 4: Are there really no updates at all for PHP versions earlier than 8.2?
- Mistake 5: Is Extended Support cheaper than an upgrade?
- Mistake 6: Is a patch to PHP 8.2.35 sufficient, even though support ends on December 31, 2026?
- What can't a chatbot tell you? Here's how we handle PHP2Shell at milkycode
- FAQ
- What is PHP2Shell, and how dangerous is the current PHP vulnerability?
- Which PHP versions are affected by CVE-2026-109618 and CVE-2026-109619?
- Which version of PHP fixes this vulnerability?
- Is there a patch for PHP 7.4, 8.0, or 8.1?
- Why is my web host or agency taking my website offline?
- Where can I see which version of PHP my website is using?
- Which version of PHP should I upgrade to: 8.3, 8.4, or 8.5?
- References
PHP2Shell: 6 Issues with the PHP Security Vulnerability from October 21, 2026, and Why We May Need to Disable Older PHP Versions
Key Takeaways
- On October 21, 2026, PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 were released (The PHP Group, 2026).
- The PHP2Shell vulnerability allows code execution without authentication. In 2026, the BSI rated it 9.2 on the CVSS v4.0 scale (BSI, 2026).
- For PHP 7.4 through 8.1, only source backports or LTS fixes are available.
- There are no updates available for PHP 5.x through 7.3. We may temporarily take such websites offline.
- PHP 8.2 will reach its end of life on December 31, 2026.
Transparency Notice: Research date: October 21, 2026. This report is based on BSI Cybersecurity Alert 2026-297981-1032, the security advisory on php.net, CERT-EU Advisory 2026-018, and analyses by Sansec and Huntress. In addition, we have included pricing information from extended support providers and our own experience with the patch rollout.
The situation is evolving. We will update this article as soon as new information becomes available. An AI helped with the outline. The milkycode team has verified the facts and assessments.
In 2026, PHP will run on approximately 75 % of all websites with a known server-side language. This is shown by W3Techs data, cited by HeroDevs in „PHP End-of-Life Dates: Support Timeline for Every Version (2026)“ (HeroDevs, 2026). The PHP2Shell vulnerability affects nearly every company website. Here are the six most common mistakes made on Patch Day.
Mistake 1: Is a WordPress or plugin update enough to protect you from PHP2Shell?
No. An update to WordPress, Shopware, or a plugin does not fix PHP2Shell, because the vulnerability lies in the PHP interpreter itself. In 2026, the BSI rated both CVEs at CVSS v4.0 9.2 in its cybersecurity advisory 2026-297981-1032 (BSI, 2026). You need to update the PHP runtime.
Why does this error occur? Many people are only familiar with the CMS backend and its update button. However, the PHP version is controlled by the hosting provider or server administrator. Your WordPress installation may be up to date, but it could still be running on a vulnerable version of PHP.
According to php.net, every installation that handles web requests is affected:
- PHP-FPM
- mod_php
- php-cgi
- FrankenPHP
- LiteSpeed
The risk is highest with mod_php. In that case, the exploit takes effect before any application code even runs. In October 2026, the BSI classified the situation in the same advisory (2026-297981-1032) as Criticality 3/Orange and called for immediate action (BSI, 2026).
Then there's the timing. According to Huntress, the details had already been leaked on October 20. Sansec, citing Cloudflare, reports attacks that occurred even before the release. The PHP2Shell vulnerability is therefore not just a theoretical problem.
Your solution: Ask your hosting provider or agency if the PHP runtime has been patched. With managed hosting from milkycode, we take care of that for you. You can find more information on this at our WordPress Websites and WordPress Hosting.
Error 2: Is your server really running the patched version of PHP?
Often not, because many people check in the wrong place. According to The PHP Group in the „PHP News Archive 2026, Security Advisory“ (as of October 21, 2026), only PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 are secure (The PHP Group, 2026). Shows php -v Even if a new version is available, PHP-FPM can still serve the old one.
| Version Branch | Secure version from | Status (October 2026) |
|---|---|---|
| PHP 8.5 | 8.5.12 | official release |
| PHP 8.4 | 8.4.27 | official release |
| PHP 8.3 | 8.3.36 | official release |
| PHP 8.2 | 8.2.35 | Official release, EOL December 31, 2026 |
CLI vs. Web SAPI: What Is the Most Common Validation Error?
CLI and Web PHP are often separate binaries or packages. So the command line doesn't tell you much about your website.
[PRACTICAL EXAMPLE] Here's how to test properly: Call a phpinfo()- Go to the page or open the site status in the WordPress dashboard. After the update, restart PHP-FPM or Apache, for example, using systemctl restart php8.3-fpm. Only then will the server load the new binary. Delete the phpinfo()-file after the check.
What are the guidelines for Docker, CI, and package repositories?
You'll need to rebuild and redeploy your Docker and CI images. Simply changing the base image tag isn't enough.
Also check third-party repositories. According to php.net, there were no Remi packages available on the release date. For this reason, check the backports for your distribution (Debian, Ubuntu, RHEL). For Plesk and cPanel, the packages come from the vendor. Check each PHP handler version there individually.
Mistake 3: Do workarounds and WAFs provide complete protection?
Workarounds reduce the risk, but they are no substitute for an update. In 2026, The PHP Group recommends in the „PHP News Archive 2026, Security Advisory“ that, as a temporary measure, post_max_size to limit it to 8M without file uploads or 32M with file uploads (The PHP Group, 2026). That certainly doesn't make the installation any safer.
Why does the error occur? Workarounds are quick to implement. They give a false sense of security.
php.net lists three measures:
- Adjustment of
memory_limit - a low
post_max_size session.upload_progress.enabled=0
All three are only partially effective against the PHP2Shell security vulnerability.
A common mistake is using the wrong layer. Many people set the values using ini_set() or .user.ini. This fix comes too late—or not at all—for this vulnerability. Therefore, configure the values server-wide in the php.ini and restart the service.
Even a Web Application Firewall (WAF) has its limitations. It filters known patterns, but new exploit variants can bypass it.
The BSI warns that AI-powered tools can turn patches into exploits within hours. WAF signatures often can't keep up.
Your solution: Use the workaround and WAF only as a stopgap until the patch is available. Set a firm deadline for this—preferably in days rather than weeks.
Mistake 4: Are there really no updates at all for PHP versions earlier than 8.2?
That blanket statement isn't entirely accurate. According to the „PHP News Archive 2026, Security Advisory,“ the PHP security team provided minimal source backports for three legacy branches (7.4, 8.0, 8.1) in 2026 (The PHP Group, 2026). There are no official releases. There are no fixes for PHP 5.x and 7.0 through 7.3.
Why does this error occur? Since support for PHP 8.1 ended, anything below 8.2 is considered „obsolete.“ That’s too broad a generalization.
Why three groups instead of a rigid boundary?
| Group | Versions | What's on the Menu | What You Do |
|---|---|---|---|
| A | PHP 8.2 through 8.5 | Official Releases | import immediately |
| B | PHP 7.4 through 8.1 | Source backports, distributions, LTS providers | Continue operating only with a tested Fix |
| C | PHP 5.x through 7.3 | No fixes | Upgrade or Temporary Shutdown |
In Group B, distributions and LTS providers such as Freexian, maxcluster, and IONOS are helpful. Otherwise, the backports are intended only for self-compilation.
When is a shutdown really necessary?
In October 2026, the BSI states in Advisory 2026-297981-1032 that all PHP versions up to at least PHP 5 are vulnerable (BSI, 2026). For Group C, the BSI explicitly lists temporary disconnection from the Internet as an option.
Our approach: We review each system individually. We will only take a system offline if neither a patch nor a backport is available—and only after we have notified you. The PHP2Shell security vulnerability is not a reason for us to make blanket decisions.
Mistake 5: Is Extended Support cheaper than an upgrade?
In the short term, often yes; in the long term, rarely. According to its own price list, IONOS will charge between €7.81 (PHP 8.1) and €15.62 (PHP 7.4, 8.0) per month in October 2026. This is cited by Winning Solutions in „PHP 8.4 Update“ (Winning Solutions, 2026). That buys some time, but it doesn't solve any compatibility issues.
| Option | Ongoing Costs | Does it protect CMS/Shop? | A permanent solution? |
|---|---|---|---|
| IONOS Extended Support | €7.81 to €15.62 per month | no | no |
| Extended Support from Other Hosting Providers | depending on the provider | no | no |
| Upgrade to PHP 8.4 | one-time project | In some cases, depending on the store version | yes |
Why does this error occur? The monthly fee seems small compared to an upgrade project.
However, there are hidden costs. With some extended-support providers, backports are released later. It is precisely this time lag that is critical for PHP2Shell.
In addition, outdated versions of e-commerce platforms and CMSs will no longer receive security updates. Extended Support only protects the PHP layer.
Our rule of thumb: Extended Support is a temporary measure lasting just a few months. It requires a fixed upgrade date and is not a permanent solution.
Results may vary depending on the codebase. It’s therefore a good idea to get a cost estimate before making a decision. To learn how we approach such projects, read Web Development and PHP Upgrades.
Mistake 6: Is a patch to PHP 8.2.35 sufficient, even though support ends on December 31, 2026?
No, otherwise you'll have another problem in ten weeks. In 2026, The PHP Group states in „PHP: Supported Versions“ that December 31, 2026, is the end of support for PHP 8.2 (The PHP Group, 2026). PHP 8.4 will receive updates through the end of 2028, and PHP 8.5 through the end of 2029. Plan your upgrade now.
Why does this error occur? After applying the emergency patch, the issue seems to be resolved. However, PHP 8.2 is about to reach its end of life. The PHP2Shell security vulnerability demonstrates what happens without updates.
Why is PHP 8.4 the pragmatic choice for most people?
PHP 8.4 has been running stably for quite some time. Many e-commerce platforms and plugins have been tested with it. PHP 8.5 offers an additional year of support, but some extensions are still lagging behind.
How do you check for shop and CMS compatibility before making the switch?
The store sets the limit. Based on the manufacturer's specifications and our project experience, the following picture emerges. Be sure to check the current requirements for your version with the manufacturer before making any changes.
| System | Highest supported PHP version |
|---|---|
| Shopware 5.7 | PHP 8.2 |
| Magento 2.4.6 | PHP 8.1/8.2 |
| WooCommerce | Tested up to PHP 8.4 |
It follows that some customers need a store or CMS upgrade, not just a PHP upgrade.
Our recommended route:
- Create a staging copy.
- Test on PHP 8.4.
- Check plugins and themes.
- The transition will take place well before December 31, 2026.
We are planning a separate roadmap for legacy custom software. For more information, see Modernizing Legacy Applications with Zend Framework.
What can't a chatbot tell you? Here's how we handle PHP2Shell at milkycode
A chatbot with outdated information is not aware of October 21, 2026. In 2026, according to Sansec („PHP2Shell: Critical PHP RCE“), Cloudflare reported the first attacks at 07:43 UTC—that is, before the release (Sansec, 2026). Here, we'll show you how we, as a Cologne-based agency and web hosting provider, responded.
The Patch Tag Timeline
- 20.10.2026: Details about the vulnerability are trickling out (Huntress, 2026).
- October 21, 2026, 7:43 a.m. UTC: First attacks, according to Cloudflare data cited by Sansec.
- October 21, 2026, 1:30 p.m. UTC: Release of the fixes according to CERT-EU’s „Security Advisory 2026-018,“ i.e., before the announced time of 2:00 p.m. UTC (CERT-EU, 2026).
- After that: our rollout to all systems under our management, to the extent possible.
Our Priorities
[PRACTICAL EXAMPLE] We proceeded based on risk, not by customer number:
- Systems using mod_php, because the exploit affects them before the application code is executed.
- PHP-FPM systems.
- Online stores that collect customer data, as opposed to websites that provide information only.
We will provide the exact number of patched systems and the duration once the rollout is complete. We deliberately do not publish estimates.
How We Keep You Informed
You'll receive a message from us with your PHP version and status. For Group C, we'll give you a deadline before we disable the service.
We'll discuss the options with you: upgrade, extended support, or temporary suspension. After the upgrade, we'll work with you to restore the website and test its features.
What are your obligations in Germany?
The BSI explicitly lists temporary network disconnection as an option. If an online store containing customer data has been compromised, a GDPR reporting obligation may arise. The deadline for reporting is 72 hours after becoming aware of the incident.
Responsibility is often shared among three parties: the agency, the hosting provider, and the online store operator. Who is liable for what depends on your contracts. Please seek individual legal advice on this matter.
Post-patch compromise testing
According to the BSI, there are no binding Indicators of Compromise yet. A patch closes the door, but it doesn't kick an intruder out. That's why our monitoring system pays attention to:
- Webshells in Upload and Cache Folders
- New admin accounts in the CMS or online store
- Files that have been modified since October 20.
- Unusual crashes of PHP workers
Our Decision Matrix
[UNIQUE INSIGHT] The version group alone isn't enough to make a decision. Only when combined with the store type does it become clear what to do.
| Version Group | Information Website | Store with customer data |
|---|---|---|
| A (8.2 to 8.5) | Apply patches, plan an upgrade to 8.4 | Apply the patch immediately; check the logs |
| B (7.4 to 8.1) | Backport or LTS, upgrade by the end of the year | Backport immediately; otherwise, consider shutting it down |
| C (5.x through 7.3) | Disconnection After the Deadline, Upgrade | Shut down promptly; conduct a forensic analysis |
The PHP2Shell vulnerability does not affect everyone equally. In our Magento SaaS Project: Promotional Web Store and others References and Case Studies You can see how different PHP stacks can be.
Limits, Alternatives, and Professional Advice
The situation is constantly changing. New exploit variants or updates to the patch are possible. Our matrix is intended as a guide, and results may vary depending on the system.
There are alternatives to discontinuation. These include Extended Support, a WAF as a bridge, and backports for your distribution. All three buy you time, but they are no substitute for an upgrade.
Do you suspect that your system has been compromised? If so, consult with forensic experts. When customer data is involved, you should also bring your data protection officer on board early in the process. We provide technical support, but we do not substitute for legal advice.
Want to know how your system is doing? Schedule an Free Initial Consultation on the PHP Upgrade or Just get in touch with us. You can find the latest developments in our More security news from milkycode.
FAQ
What is PHP2Shell, and how dangerous is the current PHP vulnerability?
The PHP2Shell vulnerability includes CVE-2026-109618 and CVE-2026-109619. Attackers can use it to execute code on your server without logging in. In its 2026 advisory, the BSI rates both vulnerabilities at a CVSS v4.0 score of 9.2 and a severity level of 3/Orange. According to Cloudflare data, the first attacks occurred even before the advisory was released. So take action immediately and don’t wait for the next maintenance window.
Which PHP versions are affected by CVE-2026-109618 and CVE-2026-109619?
According to the BSI warning, all PHP versions up to and including PHP 5 are vulnerable. Any installation that handles web requests is affected: PHP-FPM, mod_php, php-cgi, FrankenPHP, and LiteSpeed. The risk is highest with mod_php. Only the patched releases from October 21, 2026, or verified backports are secure.
Which version of PHP fixes this vulnerability?
According to php.net, PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 patch these vulnerabilities. These releases were published on October 21, 2026. Important: The Web SAPI must use this version, not just the command line. Restart PHP-FPM or Apache after the update. Rebuild Docker images from scratch.
Is there a patch for PHP 7.4, 8.0, or 8.1?
Partially. The PHP security team has provided minimal source backports for these three branches. However, there are no official releases. You can compile it yourself or use fixes from distributions and LTS providers such as Freexian, maxcluster, or IONOS. Continuing to run the current version makes sense only if you use a verified fix. Plan to upgrade anyway.
Why is my web host or agency taking my website offline?
There are no fixes available for PHP 5.x and 7.0 through 7.3. A website running these versions remains vulnerable to attacks. The BSI explicitly mentions temporarily disconnecting from the Internet as an option. At milkycode, we only take a site offline if neither a patch nor a backport is available. We’ll notify you in advance and give you a deadline.
Where can I see which version of PHP my website is using?
In WordPress, you can find the version under "Tools" and "Site Status." In Shopware and Magento, the version is displayed in the "System Info" section of the backend. Alternatively, you can use a phpinfo()-a page that you'll delete afterward. Don't rely on php -v. The command line often uses a different binary than your website.
Which version of PHP should I upgrade to: 8.3, 8.4, or 8.5?
For most people, PHP 8.4 is the pragmatic choice. According to the „Supported Versions“ page on php.net (as of 2026), it will receive security updates through the end of 2028. PHP 8.5 will be supported through the end of 2029, but not every plugin is ready yet. PHP 8.3 is an option, but it offers less leeway. Test your system on a staging environment first.
References
- Federal Office for Information Security (BSI): „PHP: Critical Vulnerabilities Threaten Web Applications Worldwide (BITS-H 2026-297981-1032),“ 2026. Official cybersecurity alert, accessed on October 21, 2026. https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2026/2026-297981-1032.pdf?__blob=publicationFile&v=3
- The PHP Group (php.net): „PHP News Archive 2026, Security Advisory: Critical RCE Vulnerabilities,“ 2026. Official vendor advisory, accessed October 21, 2026. https://www.php.net/archive/2026.php
- The PHP Group (php.net): „PHP: Supported Versions,“ 2026. Official support timeline, as of October 2026. https://www.php.net/supported-versions.php
- CERT-EU: „Security Advisory 2026-018: Critical Vulnerabilities in PHP,“ 2026. Security advisory from the EU institutions, accessed October 21, 2026. https://cert.europa.eu/publications/security-advisories/2026-018
- Sansec: „PHP2Shell: Critical PHP RCE (CVE-2026-109618, CVE-2026-109619),“ 2026. Commercial Security Research Using Cloudflare Telemetry, accessed October 21, 2026. https://sansec.io/research/php2shell
- Huntress: „Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities,“ 2026. Analysis of the leak’s history, accessed October 21, 2026. https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities
- Winning Solutions: „PHP 8.4 Update (IONOS Prices for Extended Support),“ 2026. Secondary source on the IONOS price list, accessed in October 2026. https://www.winning-solutions.de/php-update/
- HeroDevs: „PHP End-of-Life Dates: Support Timeline for Every Version (2026),“ 2026. Commercial blog featuring W3Techs data; note the author’s vested interest; accessed in October 2026. https://www.herodevs.com/blog-posts/php-end-of-life-dates-support-timeline-for-every-version-2026
- University of Reading, Department of Languages and Cultures: „Research in German Studies,“ 2026. Academic reference source on specialized communication in German; does not provide evidence for technical figures; accessed in October 2026. https://www.reading.ac.uk/languages-cultures/research/german-studies
You can find out more about our work with PHP at PHP Development and Projects by milkycode and on our website about us.
Leave a Reply