PHP2Shell: How to Update PHP Version Fast and Prove It Is Done

On 21 October 2026 the PHP project shipped emergency releases for two critical flaws nicknamed PHP2Shell. For a business owner the advice fits in one line: update PHP version on every server that answers web requests, then ask for written proof. The bugs sit in the language runtime, so WordPress, WooCommerce and Magento sites are exposed even when every plugin is current.

Why you need to update PHP version today: what happened on 21 October

The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They close CVE-2026-109618 and CVE-2026-109619, two remote code execution flaws that both score 9.2 on CVSS v4.0 and need no login. Per the project’s advisory, every installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php and LiteSpeed.

A security plugin or a firewall rule inside your CMS cannot help. BleepingComputer reports that attacks began before the fixes were out and that the UK’s NCSC urged organisations to patch at once or take affected systems offline.

Update the PHP version in 48 hours: five questions for your team and host

Someone must find out what is running, and your agency or hosting provider must change it. Ask precise questions, because “we are on it” is not a version number.

Five questions to send today

1. Which PHP version serves the live site? A control panel label is not enough.
2. Is it 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer? Linux vendors often backport fixes without changing the number, so the changelog should list both CVE identifiers.
3. Were all workers restarted? PHP-FPM and Apache processes keep the old code until then.
4. Where else does PHP run? Staging, old microsites, Docker images.
5. Who confirms in writing, and by what time?

A good reply names the server, the exact version, the restart time and the check.

Temporary measures and what they do not replace

The advisory lists settings that narrow the attack surface. They are a bridge for hours, not weeks, because updating the PHP version is the only real fix. Sansec’s research note covers the same list for stores that cannot patch yet.

• Set session.upload_progress.enabled to 0 in php.ini or the PHP-FPM pool and restart workers. ini_set() and .user.ini do not work.
• Force memory_limit to -1 with php_admin_value and keep post_max_size low, such as 8M without uploads.
• Where the site has no file forms, block multipart/form-data at the web server. Test a checkout first, since some payment forms use that format.

Cloudflare WAF adds a layer for traffic that passes through it, and nothing more. WordPress maintenance mode does not help, because PHP parses the request before the CMS answers. To take a site down, return HTTP 503 from the web server or CDN, then plan the update.

PHP version update checks: orders, payments and forms

A step inside one branch, such as 8.3.35 to 8.3.36, usually passes unnoticed. A jump from 7.4 to a supported branch can break old plugins and themes, and WordPress development specialists can fix that without rebuilding the site. For a WordPress PHP update, as for any other, run the same short test every time, on staging first:

• place a test order with each payment method and refund it;
• confirm that order emails and password resets arrive;
• submit the contact form with an attached file;
• check that payment and delivery webhooks arrive;
• read the PHP error log and look for new PHP files in upload folders.

Outdated PHP version as a business risk: support schedule and plan

Branch end dates are published years ahead, so PHP 8.2 end of life on 31 December 2026 is not a surprise but a task that somebody has to own. The official supported versions page shows these security windows as of 22 October 2026:

PHP branch	Security fixes until	What it means for you
8.5	31 Dec 2029	Newest; check plugin compatibility first
8.4	31 Dec 2028	A sensible default for most business sites
8.3	31 Dec 2027	Safe now; plan the next move for 2027
8.2	31 Dec 2026	Two months left; move this quarter
8.1 and older	Ended	No official fixes; migrate or buy vendor support

Updating the PHP version on a schedule, like a renewal

Treat the end date like a domain or SSL certificate expiry, add it to a shared calendar with a reminder six months ahead, and ask the host to update your PHP version once a year in a quiet week, with a test copy and a rollback.

Urgent-update regulation: who decides, how fast, how it is confirmed

PHP2Shell showed that news and first attacks can be hours apart. A one-page regulation turns a scary headline into routine work, because the emergency security patch process is agreed before anyone panics. The numbers below are examples. Agree it with the server owner and, if you outsource operations, with DevOps services for business.

• Owner: one named person on your side and one at the contractor.
• Trigger: a vendor advisory rated critical or a note that attacks are under way.
• Deadlines: decision within 4 working hours, a patch or temporary measure within 24 hours.
• Proof: server, version, restart time and test result in one message.
• Exceptions: in writing, with an expiry date.

Our website security checklist for business covers neighbouring basics: backups, access control and monitoring. Write it down once. The next advisory then takes hours, not days, and your team can update PHP version without a meeting.

What to write into the hosting or contractor agreement

Most surprises come from contracts that say nothing about versions. A PHP update service level and a few short clauses prevent arguments during an incident.

• The site runs only on a PHP branch that still gets security fixes.
• Critical PHP security updates go in within an agreed number of hours, with written confirmation.
• The provider warns you six months before a branch ends and offers to update your PHP version.

If you want one team for the audit, the regulation and the upgrade, you can order a PHP update from us as a single package, with fixed response times.