Critical PHP Vulnerability PHP2Shell: Check Now Whether Your Website’s Server Is Patched

PHP is the programming language that runs WordPress, WooCommerce, Joomla, Drupal and a large share of all websites in the world. When the flaw is in PHP itself, a huge number of sites are at risk at once – no matter how well the website itself is maintained.

What happened?

In August, security company Wiz used AI to find flaws in PHP that can be used to take over a server and reported them to the PHP security team. The fixes were due to be disclosed on 22 October, but details leaked early and PHP released the security update on 21 October.

• Severity: the PHP security team rates both flaws at 9.2, i.e. critical.
• Impact: with a single crafted request and without logging in, an attacker may be able to run code on the server – before WordPress even starts loading.
• Affected: practically all PHP versions since 5.4 and all common setups (PHP-FPM, Apache with mod_php, CGI, LiteSpeed). The risk is considered highest with Apache and mod_php.
• Attacks: Cloudflare reported the first exploit attempts on the morning of 21 October. As of 21 October no confirmed successful breaches had been reported.

Is my website at risk?

If your website or online store runs on WordPress, WooCommerce or another PHP-based system, then probably yes – until the server has been updated. Sites built with, for example, Next.js that do not use PHP on the server are not directly affected by this flaw.

How to check

• In the WordPress admin, open Tools → Site Health → Info → Server and look at the PHP version.
• The version must be at least 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (depending on the branch in use).
• Some Linux distributions and hosts install the fix without changing the visible version number. If the number is older, ask your host to confirm that the fix is installed.
• If you are on PHP 8.1 or older, it no longer receives official updates from the PHP project. In that case you need to move to version 8.2 or newer.

What to do – depending on your hosting

Shared hosting (e.g. a regular web hosting plan)

The hosting provider updates PHP for all customers. Your job is to check that it has been done and, if needed, choose a supported PHP version (8.2 or newer) in the hosting control panel.

Managed WordPress hosting

Here too the host updates PHP. Check their announcements or ask support for confirmation.

Your own server or VPS

Nobody else will do this for you. The server must be updated immediately with the fixed PHP packages and the PHP service restarted – without a restart the old version keeps running. These sites need to be updated first.

If you use Cloudflare

Cloudflare has added temporary firewall rules against known attack vectors for all customers, including the free plan. This is an extra layer, not a replacement – PHP still has to be updated.

If you cannot update right away

According to the PHP developers, updating is the only complete fix – changing settings does not fix the flaw. As a temporary measure on your own server, it is recommended to disable one attack path with the setting session.upload_progress.enabled = 0 (WordPress does not use this feature) and restart PHP. On shared hosting, do not change server settings yourself – ask your host. If the server is old and cannot be updated quickly, consider taking the site offline temporarily – some organisations did exactly that this time.

How to tell whether your site has been attacked

• The server logs show many consecutive 500 errors or memory limit errors.
• Unknown files, users or redirects have appeared on the site.
• Google or antivirus software warns against visiting the site.

If you suspect a breach, update PHP, restore a clean backup if needed and change all passwords. If personal data has leaked, you must notify the data protection authority within 72 hours.

Summary

PHP2Shell is one of the most serious PHP vulnerabilities in recent years, and it affects even well-maintained WordPress sites because the flaw is on the server, not in the website. Check your PHP version today or ask your host for confirmation. If you do not know where your website is hosted or who is responsible for it, get in touch – we will take a look. For a long-term solution, see our website maintenance service. You may also want to read our article on critical WordPress and Next.js security updates.