PHP2Shell Explained: How Freelancers Can Check and Fix Client Websites

This week, the PHP project shipped an emergency security release for two critical vulnerabilities — CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Both are rated CVSS v4.0 9.2 (critical), meaning remote code execution is in play. Since PHP powers roughly 70% of websites whose server-side language is known — WordPress, Drupal, Joomla, Magento and countless Laravel apps among them — there is a real chance that one or more of the client sites you maintain are exposed right now.

The short answer: check which PHP version every site you manage is actually running, and move it to one of the fixed releases — PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Below is the full walkthrough: what PHP2Shell is, how to check exposure, how to patch, what to tell clients, and how to turn it into paid work.

What is PHP2Shell?

PHP2Shell is the collective name for two critical vulnerabilities in the PHP runtime itself, disclosed the week of October 21, 2026. After the vulnerability identifiers and a proof-of-concept video leaked online on October 20, the PHP project released its security update a day early.

The two CVEs and the 9.2 score

• CVE-2026-109618 — one of the two critical PHP flaws in the October 21 release.
• CVE-2026-109619 — the second flaw, disclosed alongside it.
• CVSS v4.0 9.2 (critical) — the highest-tier rating, reflecting remote code execution and the potential for complete system compromise, as India's CERT-In warned in its critical alert on October 21.

Why a runtime bug beats even clean code

Here is the detail that matters most for developers: the vulnerable code has been present in PHP since version 5.4.0 (2012), and the flaw fires before your application code runs. That means a perfectly written WordPress theme or Laravel application on a vulnerable PHP version is exposed anyway. Updating plugins and hardening WordPress will not save you here — the PHP binary itself must be updated.

This explains the fallout's speed and scale: Cloudflare reported exploit attempts climbing from thousands to millions within hours of disclosure, and Amazon's Threat Intelligence saw honeypot attempts as early as October 17 — four days before the public announcement. Some government and hospital websites were taken offline as a precaution. More on the response at Medianama.

Why PHP2Shell matters for freelancers and web developers

If you build or maintain client websites, you are effectively the IT department for clients who have no idea what a PHP runtime is. In a crisis like this, two things land on your desk:

• Client trust is on the line. Clients hire you because you handle the technical side. A proactive message saying you have already checked and patched their site builds enormous trust; a hacked checkout does the opposite.
• Paid maintenance work. A security event like this is the clearest possible justification for ongoing maintenance retainers and one-off security audits — services clients actually say yes to this week.

Worth noting: these flaws were found with AI-assisted security research, which is partly why the term "php2shell" is spiking in search this week — and why publishing a fast, accurate explainer is worth your time.

How to check if a client website is vulnerable

Work through these checks for every site you manage. The whole process takes minutes per site once you know the drill.

1. Find the actual PHP version the server runs

Do not guess from what the host's marketing page claims. Get the ground truth:

• SSH into the server and run php -v. Compare against the fixed releases: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Anything below the fixed build on its branch is vulnerable.
• WordPress sites: go to Tools → Site Health → Info → Server to see the reported PHP version.
• cPanel: check "MultiPHP Manager" or "Select PHP Version" — but note this shows the selected version, which is usually what is running.

2. mod_php vs PHP-FPM — check the right one

On some servers the web handler (what actually serves the site) can differ from the command-line binary. A temporarily created phpinfo page (deleted afterwards) shows exactly which PHP version is serving the site.

3. Ask the host — patched or not?

Many major hosts rolled out patched builds on October 21–22, including cPanel EasyApache 4, CloudLinux, Hostinger (hosting servers, excluding VPS) and AWS Elastic Beanstalk. On managed shared hosting the fix may already be applied — verify rather than assume. A WordPress-focused patching walkthrough is available at managingwp.io's PHP2Shell guide.

How to fix PHP2Shell on client websites — step by step

Step 1: Update to a fixed PHP version

Move each site to the fixed build on its current branch:

Branch	Fixed version	Notes
PHP 8.5	8.5.12	Current branch — update to this release
PHP 8.4	8.4.27	Update to this release
PHP 8.3	8.3.36	Update to this release
PHP 8.2	8.2.35	Update, but plan an upgrade — PHP 8.2 reaches end of life on December 31, 2026
PHP 8.1 and older	None	No official fixes; only minimal source backports exist — migrate these sites up

On managed hosting, switching the PHP version is usually a dropdown in the control panel (cPanel, hPanel, Plesk). On VPS or dedicated servers, update through your package manager or EasyApache profile, then continue to Step 2.

Step 2: Restart workers and verify

Restart the web server and PHP-FPM workers so no old processes keep running vulnerable code. Then re-run php -v, reload the site's key pages and the admin area — a version jump can occasionally break old plugins, so test before closing the ticket.

Step 3: If you cannot patch immediately

• Put a web application firewall (WAF) in front of the site — a bandage, not a fix, but it buys time.
• Take a full backup before changing anything, so you can roll back.
• Schedule the upgrade with the client this week — do not let "not today" become "never."

Step 4: Check for signs of compromise

Because exploit attempts were seen in the wild before disclosure — CERT-In issued an exploitation-in-wild alert on October 22 — patching alone may not be enough. Look for unknown files, recently modified core files, unexpected admin accounts or cron jobs, and strange outbound traffic.

If you find evidence of compromise, assume the worst: restore from a clean backup taken before the exposure window, rotate all credentials (database, admin, hosting, API keys), and then patch. CVE details and fixed versions are documented at cambridgecybersecurity.com.

What to tell your clients (copy-paste message)

Clients do not need CVE numbers — they need to know you are on it:

Hi [Name] — a quick heads-up. This week, two serious security flaws were found in PHP, the technology behind your website. Attackers are already scanning the internet for unpatched sites. I've checked your site and updated it to the fixed version, and verified everything is working. Your site is safe. I'll keep monitoring it — no action needed from you.

Turn this into a paid service: website security checkups

Moments like PHP2Shell make the value of maintenance visible. A website security checkup is a service clients understand and buy: a one-time audit where you verify the PHP version, update core/plugins/themes, check for compromise signs, confirm backups work, and deliver a short plain-language report.

• One-off audit: quote a fixed price for checking and hardening one site — this week is the easiest sales pitch you will ever have.
• Monthly maintenance retainer: version updates, monitoring, working backups. Frame it as insurance against the next PHP2Shell — because there will be one.
• Keep it honest: never promise a site cannot be hacked or guarantee rankings and traffic. Sell the audit and the monitoring, not guarantees.

Protect yourself while you patch

Emergency maintenance often happens from cafés or co-working spaces — on networks you do not control. When you SSH into servers over public Wi-Fi, a VPN encrypts your connection so your credentials stay private. NordVPN is a straightforward fit for securing your remote admin work this week.

And for clients whose hosting makes patching painful — clunky control panels, no one-click PHP switching — consider moving them to managed hosting that patched fast. Hostinger shipped patched PHP builds for this incident on October 21–22 (its hosting servers, excluding VPS). The Hostinger 3-in-1 Bundle gives you a managed environment where version switching and security updates are simple, so the next emergency is a dropdown change instead of a weekend project.

FAQ

Is WordPress affected by PHP2Shell?

Yes. WordPress runs on PHP, so any WordPress site on a vulnerable PHP version is exposed — even with fully updated plugins and themes, because the flaw is in the PHP runtime itself, not in WordPress code.

Do I need to do anything if the site is on shared hosting?

Probably not much — but verify. Check the PHP version in your control panel and confirm with the host's support or status page that the fix for CVE-2026-109618 / CVE-2026-109619 is deployed. If the host is slow, escalate or migrate.

What about sites on PHP 8.1 or older?

There are no official fixed releases for PHP 8.1 and below — only minimal source backports. Plan an upgrade to a supported branch now, and treat it as a paid project. For the CERT-In warnings and what major companies advised, see Digit.in's roundup.

Can a WAF alone protect a site?

A WAF is a reasonable stopgap when you cannot patch the same day, but it is not a substitute for updating PHP. Patch as soon as possible.

How do I know if a site was already compromised?

Look for unknown files, modified core files, rogue admin accounts, unexpected cron jobs and odd outbound traffic. When in doubt, restore from a clean backup predating the exposure window and rotate all credentials.

Conclusion

PHP2Shell is a reminder of how the freelance web economy works: when a critical flaw lands in the runtime that powers 70% of websites, the people clients call are you. This week's playbook:

1. Audit every site you manage. List them all, check the PHP version each one actually runs, and patch to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
2. Verify and test — restart workers, confirm the new version, click through the site.
3. Message your clients with the template above, in plain language.
4. Offer security checkups as a paid service while the topic is top of mind.

The next vulnerability will not wait for a quiet week. Set up the maintenance retainers, the backups and the monitoring now — and make PHP2Shell the incident that made your freelance business more resilient, not the one that caught you off guard.