PHP2Shell: The PHP Vulnerability Every Kenyan Website Owner Must Fix This Week
PHP2Shell is a pair of critical PHP flaws (CVE-2026-109618 and CVE-2026-109619, rated 9.2) that let attackers run code on a server without logging in. PHP patched them on 21 October 2026. Confirm your site runs PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer, or a build dated 21 October or later.
This week my phone has not stopped. Clients forwarding emails from their hosting company. "Urgent PHP security update." "Action may be required." Most of them ask me the same thing: "Victor, is my website going to be hacked?"
Short answer: if nobody has checked, you don't know. And that's the problem.
Here is what happened, in plain language, and exactly what you should do today.
What is PHP2Shell?
PHP is the language that runs most of the internet. WordPress, WooCommerce, Joomla, Drupal, Magento, Laravel and most custom business systems built in Kenya run on it. Researchers estimate it powers around 70% of all websites.
On 21 October 2026, the PHP project released an emergency fix for two critical flaws, now nicknamed PHP2Shell:
- CVE-2026-109618: when PHP runs out of memory while reading a request, it can be tricked into treating broken data as valid.
- CVE-2026-109619: data from one visitor's request can survive in memory and be reused by the next request.
Both are rated 9.2 out of 10. Combined, they let an attacker run their own code on your server. No password. No login. No plugin weakness needed. The researchers who found them showed working attacks against fresh, fully updated WordPress, Drupal and Joomla sites. They also showed the flaws can leak server memory, which can contain passwords, API keys and payment tokens.
Every PHP version from the last decade is affected, back to PHP 5.4.
Is it actually being attacked?
Yes. Details leaked a day before the official announcement. Within hours, security firms and hosting partners were reporting active exploit attempts, and Cloudflare pushed emergency firewall rules to all its customers. Several organisations, including Dutch government services, took sites offline as a precaution.
Attacks like this are automated. Bots scan the whole internet. They don't care that you're a small clinic in Thika or a hardware shop in Eldoret. If your server is unpatched, it's on the list.
Why updating WordPress won't fix it
This is the part most business owners get wrong. The flaw is in PHP itself, the engine underneath your website, not in WordPress or your plugins. WordPress.org has confirmed there is no WordPress update for this. You can have every plugin updated and still be wide open.
The fix happens on the server. Which means the question is: who manages your server?
What you need to do depends on your hosting
| Your hosting | Who patches it | What you do |
|---|---|---|
| Shared hosting (cPanel, most Kenyan hosts) | Your hosting company | Confirm in writing that they've applied the 21 October PHP security release. If you're on PHP 8.1 or older, ask to move up. |
| Managed WordPress hosting | Your hosting company | Check their status page. Most big hosts finished patching on 22 October. |
| VPS or cloud server (DigitalOcean, Contabo, AWS, CloudPanel, Plesk) | You or your developer. Nobody else. | Update PHP now and restart every PHP worker. This is the group at most risk. |
| Behind Cloudflare | Cloudflare adds a layer, not a fix | Still patch the server. Attackers can sometimes reach it directly. |
If you don't know which row you're in, that's your first answer. Find out today.
How to check if your website is patched (5 minutes)
1. Check your PHP version
In WordPress, go to Tools → Site Health → Info → Server. In cPanel, look under "Select PHP Version" or "MultiPHP Manager". You are patched if you see one of these or newer:
| PHP branch | Patched version | Security support ends |
|---|---|---|
| PHP 8.5 | 8.5.12 | Supported |
| PHP 8.4 | 8.4.27 | Supported |
| PHP 8.3 | 8.3.36 | 31 December 2027 |
| PHP 8.2 | 8.2.35 | 31 December 2026 |
| PHP 8.1 and older | No official fix | Already ended |
2. If the number looks old, check the build date
Many hosts using CloudLinux applied the fix without changing the version number. So your site might show 8.5.11 and still be safe. The real test is the build date: anything built on or after 21 October 2026 has the fix. Your host's PHP info page shows it, or your developer can run php -v and read the date after "built".
3. Get it in writing from your host
Send this message to your hosting support: "Please confirm that the PHP 21 October 2026 security release (CVE-2026-109618 and CVE-2026-109619) has been applied to the server hosting my site, and which PHP version and build date I am running." A good host answers in minutes. A host that can't answer that question is telling you something.
If you run your own server: do this now
- Back up files and database first.
- Update PHP to the patched version for your branch, using your distribution's packages, then restart PHP-FPM or Apache so every worker loads the new version.
- Check every PHP install, not just the main site: staging copies, old subdomains, Docker containers, the forgotten test site from 2021.
- Turn off upload progress tracking. Set
session.upload_progress.enabled = 0inphp.inior your FPM pool config, then restart. WordPress doesn't use it. This also covers a third, related flaw (CVE-2026-115560) disclosed on 23 October that PHP will fix in its next regular release. - Running PHP 8.1 or older? Check if your vendor has backported the fix (cPanel's EasyApache did for 7.4 to 8.1). Then plan the upgrade. You are living on borrowed time.
If you can't patch today, the safest move is to put the site in maintenance mode until you can. A few hours offline is cheaper than a breach.
And please: don't install a random "PHP2Shell fix" plugin or paste code from a forum. Those are unverified, and some will be traps.
Signs someone already tried
Patching stops new attacks. It doesn't undo one that already happened. Ask your developer or host to look at the server logs since 20 October for:
- Strange multipart (upload) requests followed by memory-limit errors
- Bursts of 500 errors you can't explain
- Unusually large or garbled
PHPSESSIDcookies - PHP workers restarting for no clear reason
- New admin users, unknown files in uploads folders, or your site redirecting visitors elsewhere
If anything looks off, treat the server as compromised. Change every password and API key the server holds: database, email, M-Pesa Daraja credentials, payment gateways, admin logins.
The Data Protection Act angle
If your website stores customer names, phone numbers, emails or payment details and it gets breached, this stops being a technical problem. Under Kenya's Data Protection Act, you must notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of a breach, and in some cases the affected customers too. "We didn't know our host hadn't patched" is not a defence. It's an admission.
The real lesson
PHP2Shell isn't the last one. There will be another next year, and the year after. The businesses that sleep fine this week are the ones where someone owns the website after launch: checks updates, watches the server, tests backups and answers the host's email the same day.
Most Kenyan business websites have nobody in that role. The developer finished the job two years ago. The login is in someone's old email. That's how sites get hacked. Not because the owner did something wrong, but because nobody was looking.
That's exactly what our website management service covers. Security patches inside 24 to 72 hours, daily backups, uptime monitoring and a monthly report in plain English. Our full website maintenance and security checklist shows what that looks like in practice.
Not sure if your site is patched? Send me the link on WhatsApp or through the contact page. I'll tell you what you're running and whether you need to act. No charge for the check.
Frequently Asked Questions
What is the PHP2Shell vulnerability?
PHP2Shell is the nickname for two critical flaws in the PHP language, CVE-2026-109618 and CVE-2026-109619, both rated 9.2. They let an attacker run code on a web server without logging in, and can leak passwords and keys from server memory. PHP released fixes on 21 October 2026.
Does updating WordPress fix the PHP vulnerability?
No. The flaw is in PHP, the server software WordPress runs on, not in WordPress itself. WordPress.org has confirmed no WordPress update is planned for it. The fix must be applied to PHP on the server, by your hosting company or whoever manages your server.
How do I know if my website is safe from PHP2Shell?
Check that your site runs PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer. If the version number is lower, check the PHP build date: 21 October 2026 or later means many hosts have backported the fix. Ask your host to confirm in writing.
Is my website affected if it's on shared hosting in Kenya?
Your host is responsible for patching PHP on shared hosting, but you should confirm they've done it. If your site still runs PHP 8.1 or older, ask your host to move you to a supported version, after testing that your theme and plugins work with it.
What should I do if my website was hacked through PHP2Shell?
Take the site offline, patch PHP, then restore from a clean backup made before 20 October if possible. Change every password and API key on the server, scan for unknown files and admin users, and notify the ODPC within 72 hours if customer data was exposed.
Sources: PHP security release of 21 October 2026, Wiz Research, Patchstack, WordPress.org, and published advisories from GoDaddy, Hostinger, SiteGround and Namecheap.
Want This Built For Your Business?
This is exactly the kind of thing we build. Book a free call and I'll tell you where to start.
