# PHP security vulnerability 2026: Is your website affected? Source: https://formellavision.de/en/knowledge/php-sicherheitsluecke-2026-php2shell Written on 23 October 2026. Editorial team: Formella Vision. ## What should I do about the PHP security vulnerability in 2026? Ask your hosting provider to confirm the active PHP patch level. Updating WordPress alone does not fix PHP2Shell. Then test your contact form and booking flow. Suspected compromise also requires investigation. Formella Vision helps you understand the situation and plan suitable website care. Your website loads. The booking calendar opens. One important answer may still be missing: has your hosting provider actually applied the PHP security fix? PHP released updates for two vulnerabilities on 21 October 2026. The name **PHP2Shell** is often used for these issues. Node.js published security updates on the same day; the Brotli issue is often called **Node2Shell**. This guide explains what you can check and what evidence your provider should supply. Manufacturers may publish further guidance. ## PHP2Shell: What happened? The vulnerabilities concern memory handling and internal state in PHP. Under particular conditions, attackers can execute code on a server without signing in. Their identifiers are **CVE-2026-109618** and **CVE-2026-109619**. The first issue can arise when memory is exhausted. The second involves worker state that still refers to freed memory. The PHP advisories explain the [out-of-memory issue](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w) and [stale worker state](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp). For a business owner, the immediate question is practical: **who operates the runtime, and which corrected version is actually running?** The appearance of your website cannot answer that question. ## Is my WordPress website affected? WordPress uses PHP. That alone does not prove that your website has an open vulnerability. The runtime, provider patches and current operating state determine the answer. A WordPress update does not replace a PHP patch. The same applies to themes and plugins. The [official WordPress notice](https://de.wordpress.org/2026/10/kritisches-php-sicherheitsupdate/) therefore identifies the hosting provider as an important contact. To find the version shown by WordPress: 1. Sign in to your WordPress administration area. 2. Open **Tools > Site Health > Info > Server**. 3. Record the complete PHP version. 4. Ask your provider to confirm the effective security patch level. “PHP 8.3” is not enough detail. A complete version number may also look older when a provider has backported the fix. Ask for the package build and its security notice. Include other domains, subdomains and old installations in the inventory. The same runtime question applies to TYPO3, Joomla, Shopware and other PHP applications. ## Five steps to take now ### 1. Contact the responsible operator Contact your hosting provider, server administrator or website agency. Supply your domain and both CVE identifiers. Request written confirmation of the active patch level. ### 2. Confirm the appropriate correction PHP published these corrected versions for the two issues announced on 21 October: - **8.2.35** in the PHP 8.2 branch - **8.3.36** in the PHP 8.3 branch - **8.4.27** in the PHP 8.4 branch - **8.5.12** in the PHP 8.5 branch These are minimum versions for that specific notice, not a general security certificate. Providers may use documented backports. For older branches, clarify ongoing support as well. See the [PHP security announcement](https://www.php.net/archive/2026.php#2026-10-21-5). ### 3. Check the running service “Update installed” and “corrected process running” are different pieces of evidence. Confirm that every affected worker or container is using the corrected build. Ask about other installations on the same hosting account. ### 4. Test contact and booking Open the site on a smartphone after the change. Test the contact form, booking flow and, where applicable, login or shop. Use your own test data and confirm actual delivery. A success message alone does not prove that an enquiry arrived. ### 5. Investigate unusual activity separately Unknown redirects, new accounts or unexplained file changes need investigation. Notify the operator and preserve logs. A patch does not remove a backdoor that has already been installed. ## The additional PHP notice from 23 October PHP published a further notice for **CVE-2026-115560**. It involves an unusual combination of session configuration and application code. The corrections from 21 October do not address this additional path. The manufacturer temporarily recommends **session.upload_progress.enabled=0**. Your administrator must check whether the path is relevant and whether the setting takes effect before request processing. This does not mean every website has another immediately exploitable vulnerability. See the [PHP notice from 23 October](https://www.php.net/archive/2026.php#2026-10-23-1). ## Node2Shell: Node.js and modern websites **CVE-2026-111497** affects the Brotli decoder in Node.js. Decompressing manipulated data can corrupt memory, potentially causing crashes, disclosure or code execution. Node.js rates this issue as high severity. The published corrected versions are **22.23.4, 24.22.1 and 26.12.1**. Check the appropriate branch. Include outbound HTTP requests, APIs, builds and background services in your assessment. See the [Node.js security release](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases). “We do not use WordPress” is not a complete security assessment. Serving a static page does not require PHP, but its forms, booking services and build environment may have separate runtimes. ## Four mistakes to avoid **Trusting a public version header alone.** It may be absent, stale or hidden behind a cache. It is a clue rather than reliable patch evidence. **Relying on a firewall alone.** A rule may limit particular attack paths. It does not replace a corrected runtime; configuration and coverage matter. **Treating an unpatched service as proof of compromise.** Exposure creates a need to investigate. It does not prove an intrusion. The Dutch NCSC reported no indications of successful exploitation on 22 October. That is a dated situation report, not clearance for your server. See the [NCSC update](https://www.ncsc.nl/alerts/update-php-kwetsbaarheden-nog-steeds-reden-om-direct-te-patchen). **Uploading an unfamiliar exploit script.** It may disrupt your service or introduce malware. Use verified manufacturer guidance and the responsible operator. ## A message you can send to your hosting provider A specific request is more useful than a vague assurance: > Please confirm the active PHP or Node.js patch level for our domain. Which version or corrected provider build is actually running? Have all affected processes been updated? Have you assessed the additional PHP notice from 23 October? Please confirm the completion time and any outstanding actions. Do not include passwords. Agree a suitable access handover process if credentials are needed. ## Update, ongoing care or a new website? A security announcement is not a reason to replace a functioning website automatically. A runtime update followed by functional checks may be sufficient. A rebuild can make sense when there are additional problems: unsupported extensions, difficult upgrades, unclear maintenance responsibilities or an unreliable enquiry flow. We separate three questions: what needs to happen now, who owns ongoing operation, and which changes make business sense? A static architecture can suit an information-focused business website and reduce certain exposed components. Accounts, forms and connected services still need protection and maintenance. ## Website support from Hamburg If you have a hosting response that is difficult to interpret, or no clear website contact, we can help assess the position and suitable care. Necessary work and a binding fixed price are agreed before you commission it. A confirmed intrusion may require specialist incident response. Our website review is not a penetration test or emergency service. Contact your hosting provider first if the site is behaving unusually or is offline. Explore [website care](/en/services) and our [web design process](/en/process) for the appropriate next step. ## Frequently asked questions ### Is every WordPress website affected by PHP2Shell? The PHP runtime at the hosting provider is decisive. Corrected PHP or a documented provider backport changes the assessment. WordPress itself does not establish the patch level. ### Where can I find my PHP version in WordPress? Open Tools, Site Health, Info and Server. Record the complete version, then ask the provider for the active package build and any backport evidence. ### Is a WordPress or plugin update enough? No. The two PHP2Shell issues are in the server runtime. The hosting provider or administrator must correct PHP. WordPress and plugins still need their own updates. ### Which PHP versions fix the issues from 21 October? The published corrected versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Documented backports are also possible. Assess the additional session notice from 23 October separately. ### Can an online checker prove that my site is affected? A public header is only a clue. Caches, proxies, hidden versions and backports limit what it can establish. Reliable evidence comes from the running service or provider. ### Does Node2Shell affect modern websites too? It concerns particular Node.js runtimes processing untrusted Brotli data. Assess builds, APIs and background services separately. Static delivery does not describe every connected service. ### Do I need a new website because of PHP2Shell? Not automatically. A corrected runtime and functional checks may be sufficient. A rebuild may be justified by unsupported extensions, missing maintenance or other documented problems. ### How does Formella Vision help? We help interpret the website situation and provider response, clarify ongoing care and agree necessary work before commissioning. Confirmed compromise may also require specialist incident response. ## Sources - [PHP security notices, 21 and 23 October 2026](https://www.php.net/archive/2026.php#2026-10-23-1) - [WordPress: Critical PHP security update](https://de.wordpress.org/2026/10/kritisches-php-sicherheitsupdate/) - [Node.js: October 2026 security releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases) - [NCSC situation update, 22 October](https://www.ncsc.nl/alerts/update-php-kwetsbaarheden-nog-steeds-reden-om-direct-te-patchen) ## Need a clear answer for your website? We help interpret your technical situation and clarify what your hosting provider needs to do. Then we discuss appropriate website care. [Request a free website review](https://formellavision.de/en/audit) Website review within 48 hours. No emergency service or automated security scan. Contact your hosting provider first if you notice suspicious activity. [Website care and hosting](https://formellavision.de/en/services)