PHP had two critical flaws called php2shell. Static sites do not run PHP.
On 21 October 2026, PHP shipped emergency fixes for two flaws that can let an anonymous attacker run code on a server through an ordinary web request. Every website that runs on PHP needs the update, WordPress included. A Keep or Dettogni site runs no PHP, so there is nothing here for it to fix.
01 - What Happened
Two flaws in PHP itself, fixed on 21 October.
PHP is the language underneath WordPress and most of the content management systems on the web. On 21 October 2026, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Security firms have named the pair php2shell; the PHP project does not use that name.
In PHP's own words, the flaws "can allow unauthenticated remote code execution". One concerns how PHP handles running out of memory part-way through a request; the other lets data from one request survive into the next request handled by the same worker. PHP says they affect "all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed", with the highest risk on mod_php, where a demonstrated exploit works with a single anonymous request before any application code runs.
PHP rates both flaws 9.2 out of 10, Critical. Its scoring also marks the attack as high complexity, needing specific conditions to be met. Early posts on social media quoted 10.0; that figure did not come from PHP.
Every PHP version before the fixed releases is affected. PHP 8.1 and older no longer receive official updates: the PHP security team published only minimal source patches for 7.4, 8.0 and 8.1, and nothing for anything older.
02 - How It Unfolded
Out a day early, and already targeted.
On 20 October, the CVE numbers and a claim of two critical PHP flaws circulated on Hacker News and social media, ahead of a disclosure security firms understood was planned for 22 October. The same day, PHP gave advance notice of a security release for Wednesday 21 October at 14:00 UTC, and reserved the right to release earlier if details became public.
On 21 October, before the release, Cloudflare's CTO reported early attacks and Cloudflare added firewall rules for the attack patterns it knew about, describing them as a stopgap. Patchstack reported multiple confirmed exploitation incidents. The fixes were released that afternoon.
PHP's advisory lists configuration changes that reduce exposure to specific attack paths, and is clear that they "do not make an installation safe". Only the update does.
03 - If Your Site Runs PHP
Not a WordPress problem. A PHP problem.
Unlike wp2shell in July, this is not a WordPress bug. It sits underneath WordPress, Drupal, Magento, Joomla, Laravel and every custom PHP site, so updating WordPress or its plugins changes nothing. What matters is the version of PHP your server runs.
What to do today: find out which PHP version your site runs; if it is older than the fixed releases above, update it, or ask your host to confirm in writing that they have; and if your site is on PHP 8.1 or older, ask your host or vendor about a backported fix, or move to a supported version. The UK's National Cyber Security Centre has urged organisations to consider taking offline any system that cannot be fixed straight away.
A firewall rule helps while you wait. It is not the fix.
04 - Why Keep And Dettogni Sites Are Not Exposed
No PHP version to update. Nothing for it to reach.
Every site Keep and Dettogni build is hand-coded and served as static files. That single decision removes what php2shell depends on.
05 - Common Questions
php2shell, plainly answered.
Is my WordPress site affected by php2shell?
If it runs on a PHP version older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35, yes. The flaws are in PHP itself, not in WordPress or any plugin, so every WordPress site is exposed until the PHP underneath it is updated. The same applies to Drupal, Magento, Joomla, Laravel and any custom PHP site.
How do I find out which PHP version my site runs?
On WordPress, Tools, then Site Health, then Info, then Server shows the PHP version. Most hosting control panels show it too. If you are on shared or managed hosting, ask your host directly which version you are on today and whether the 21 October fix is installed.
Does a firewall like Cloudflare protect me from php2shell?
Partly, for now. Cloudflare has added firewall rules for the attack patterns it knows about and describes them as a stopgap. PHP's own advisory says only an update is a complete solution. A firewall buys time; it does not fix the server.
My host says it has updated PHP. Am I safe?
Safe from these two flaws, if the update reached every server your site runs on and the PHP workers were restarted. Ask which version you are now on and check it against the fixed versions. Sites on PHP 8.1 or older get no official update; they need a vendor backport or an upgrade to a supported version.
Are Keep and Dettogni websites affected by php2shell?
No. Keep and Dettogni sites are static files served from Cloudflare's network. No PHP runs on them, and contact forms are handled by a small JavaScript function, not PHP. There is no PHP version to update, so these two flaws have nothing to reach.
06 - Sources
Where these facts come from.
PHP project: security advisory and releases, 20 and 21 October 2026; GitHub advisories CVE-2026-109618 and CVE-2026-109619.
Reporting: Tenable, BleepingComputer, Help Net Security and Patchstack.
This note reflects what was published by 21 October 2026. Exploitation reports are still developing; check the PHP advisory for the latest.
Still running PHP?
If your site's PHP version has not been confirmed updated, check it today, not this weekend. And if you would rather stop having this conversation every time PHP or WordPress has a bad week, a static rebuild removes the question. For a business-critical site, request a discovery call instead.