Every way to protect your site from the leaked PHP bug, ranked

Check which PHP version you're on

• On a server: run php -v. If your site uses PHP-FPM, check that too (php-fpm -v), since it can be a different version.
• On WordPress: go to Tools, then Site Health, then the Info tab, and open Server. It shows your PHP version.
• On shared hosting: your host's control panel usually shows it. If you can't find it, skip to B tier and just ask them.

If you'd rather have Claude walk you through it, paste this in:

My website runs on PHP. Help me check if I'm exposed to the leaked PHP2Shell bugs (CVE-2026-109618 and CVE-2026-109619). Figure out which PHP version I'm on, tell me if it's patched (8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer), walk me through updating and restarting PHP step by step, and if I'm on shared hosting, write a short message I can send my host. My setup: [your host, or your server and OS].

Update PHP and restart it

PHP says updating is the only complete fix. These are the patched versions:

• PHP 8.5: 8.5.12
• PHP 8.4: 8.4.27
• PHP 8.3: 8.3.36
• PHP 8.2: 8.2.35

If you installed PHP through your system's package manager, install your vendor's updated packages. Then restart every PHP process, because the old version keeps running until you do. If you didn't restart it, you didn't patch it.

# Debian or Ubuntu with PHP-FPM (swap 8.3 for your version)
sudo systemctl restart php8.3-fpm

# RHEL, Fedora or similar
sudo systemctl restart php-fpm

# Apache with mod_php
sudo systemctl restart apache2

Find every old site still running PHP

Old side projects, test sites, and even tools that bundle PHP inside them count. Check all of them, starting with anything people can reach from the internet.

• PHP 8.2 to 8.5: patched, update with S tier.
• PHP 7.4 to 8.1: no official release. The PHP security team only published minimal source backports, so plan to move to a supported version.
• PHP 5.4 to 7.3: no fix coming at all. Move it to a supported version, or take it offline until you can.

Message your host

Most people on shared or managed hosting don't control PHP themselves, and some hosts, like SiteGround, moved early to protect customers. But you won't know yours did unless you ask. Send this:

Hi, I saw PHP released an emergency security update on October 21 for CVE-2026-109618 and CVE-2026-109619 (PHP2Shell). Has my account been moved to a patched PHP version (8.5.12, 8.4.27, 8.3.36 or 8.2.35), and have the PHP processes been restarted? Thanks.

Turn off one setting

Turning off session upload progress in php.ini blocks the attacks people confirmed, but not other versions of the bug:

session.upload_progress.enabled = Off

It's a stopgap while you update, not a fix. Restart PHP after changing it.

Thinking your site is too small to matter

Attackers don't pick sites by size, they scan everything. Exploit attempts showed up within a day of the fix going public. If your site runs PHP, start at S tier.