Updated 23 October 2026 · Turing Websites
PHP2Shell: PHP Security Update Help UK
Get hands-on PHP2Shell update help for WordPress, AWS and custom PHP websites. Fix compatibility and check forms, bookings and checkout after the update.
Request urgent PHP update helpIn short
PHP2Shell is the name for two critical PHP runtime flaws fixed on 21 October 2026. Apply a fixed PHP release or confirmed vendor patch to the runtime serving the website. Then verify compatibility, forms, bookings and checkout. Turing Websites helps with supported PHP updates, website repairs and customer-action checks.
Keep customers enquiring, booking and buying while PHP is updated. Turing Websites helps apply supported PHP changes, repair website compatibility faults and verify the customer actions after deployment. For managed hosting, we work alongside the provider responsible for the runtime.
Get PHP security update help with your URL, host and current symptoms. Our PHP security update service covers hands-on fixes for WordPress, AWS-hosted and custom PHP websites.
Guidance checked: 23 October 2026. Choose the guide matching your site: WordPress and WooCommerce PHP update help or AWS Lightsail, EC2 and Beanstalk PHP update help.
What changed on 21 October 2026?
PHP released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, commonly called PHP2Shell. They can allow unauthenticated remote code execution under the relevant conditions. PHP's warning covers installations handling web requests, including FPM, Apache mod_php, CGI, FrankenPHP and LiteSpeed. See the official PHP security release and advisory.
| PHP branch | Fixed upstream release |
|---|---|
| 8.2 | 8.2.35 |
| 8.3 | 8.3.36 |
| 8.4 | 8.4.27 |
| 8.5 | 8.5.12 |
Use these releases or a later maintained release on the same branch. Distribution and LTS packages can include vendor-backported fixes behind an older-looking version number. Obtain the vendor's confirmation covering both CVEs and the installed package. PHP 8.1 and older receive no routine upstream security releases; exceptional source backports do not restore that support.
Match the update to your website's hosting
| Your website | Start here |
|---|---|
| WordPress or WooCommerce | Confirm the host's PHP patch, then check themes, plugins, forms and orders in the WordPress guide |
| AWS-hosted PHP | Identify the service and runtime in the AWS guide; Bitnami, packages, platforms and containers have different update routes |
| A custom PHP application | Check its PHP runtime, extensions and application dependencies, then verify the customer actions after the supported update |
| A managed platform | Read the provider's current notice and obtain site-specific confirmation before making competing changes |
A PHP security patch and a compatibility repair can be parts of the same job. We can update supported hosting you control, fix PHP/application faults and check the site after deployment. Where a managed host controls PHP, it applies that runtime change while we handle the website work.
Confirm the PHP runtime serving the website
Record the host, runtime or container, package and current deployment. Ask the operator whether both fixes are installed and whether a restart or replacement remains outstanding. Command-line PHP can differ from the installation serving web requests.
For WordPress, Tools → Site Health → Info → Server shows the reported version and server API. The WordPress announcement explains why core, theme and plugin updates do not apply the PHP fix. Automattic says its listed hosted services are already protected; follow the provider's current guidance.
Download the editable PHP host and website checklist (TXT)
. Record the runtime evidence and the customer actions your site supports. It is free to use with your existing host or developer.
Update PHP and verify forms, bookings and checkout
Preserve recoverable copies of the code, database, uploaded files and configuration. Use an isolated staging environment where available, with customer email and live payments disconnected. Check the intended PHP branch, required extensions and application compatibility before moving traffic.
For an enquiry site, verify a permitted dummy enquiry, its saved record and its notification destination. For booking, check availability, the booking record and confirmation. For ecommerce, use the payment provider's supported test mode to check the payment result, order and receipt.
Record the tested URL, time, expected result and observed result. Preserve new orders and bookings during a change or recovery. A page loading does not establish that its form or checkout works. The website recovery guide covers code and customer-data recovery separately.
Act on the current security guidance
Follow the current official PHP advisory with the hosting owner. PHP describes temporary measures as incomplete; a WAF or one configuration change does not establish that the runtime is fixed. If an affected host cannot update and cannot apply temporary mitigations promptly, the UK NCSC advises considering taking the system offline until fully mitigated.
Suspected compromise needs your hosting security team or an appropriate incident-response specialist. Preserve evidence and use a secure support channel. Keep credentials, raw logs and customer records out of an enquiry form.
Get help with your PHP website
Send your PHP update and repair enquiry. Tell us which website needs the change and what customers must be able to do afterwards. Include the host, patch status, current symptoms and business deadline.
If the website also runs business processes, use the PHP webhook and automation checks. For a PHP-backed reporting endpoint, use the Power BI data-feed checks.
PHP security · website repair · WordPress