Quick answer
Your website is patched against PHP2Shell only if it runs PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later, or a version your host confirms has the fix. In WordPress, check under Tools, Site Health, Info, Server. If it is older, ask your host or developer to update today.
This guide is for Singapore business owners who have seen the news about PHP2Shell and want to know one thing: is my website safe? You do not need to be technical. In about ten minutes you can find out which PHP version your site runs, whether it is patched, and exactly what to ask your hosting provider or developer if it is not.
It is written by Adssential Marketing, a Singapore digital growth agency that builds and maintains websites, mostly on WordPress. We offer website maintenance, so we have an interest here; every check below works whether you hire anyone or not.
What is PHP2Shell, and why is CSA urging businesses to update?
PHP2Shell is the name given to two critical flaws in PHP, CVE-2026-109618 and CVE-2026-109619, that let an attacker run their own code on a web server without logging in. PHP is the programming language behind WordPress, Drupal, Joomla and a large share of business websites, so the exposure is wide.
The PHP project released fixed versions on 21 October 2026. The next day the Cyber Security Agency of Singapore (CSA) issued an alert telling organisations to patch immediately, and its chief executive warned that many SMEs relying on external IT vendors and hosting providers may not realise their systems are affected.
📊 Field data and verified research
CSA’s alert AL-2026-151 rates both vulnerabilities 9.2 out of 10 (CVSS v4.0), says they affect all versions of PHP, and reports widespread exploitation attempts and multiple public proof-of-concept exploits. In practical terms: attackers already have working tools, and they scan the internet for unpatched sites automatically. A small business site is not too small to be found.
The two flaws work differently, but the outcome for a website owner is the same:
- CVE-2026-109618 is an out-of-memory handling bug. A crafted request can leave PHP’s internal data half-built, and PHP may then treat it as valid.
- CVE-2026-109619 is a use-after-free bug. Data from one visitor’s request can survive in memory and be misused by a later request handled by the same server process.
Either one can give an attacker control of the server: the ability to change your pages, add spam or malware, read your database (including enquiry form submissions), or use your server to attack others. AsiaOne’s report notes that some government websites in Europe were taken offline as a precaution.
Which PHP versions are safe from PHP2Shell?
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything older on those branches is vulnerable, and PHP 8.1 or older is no longer updated by the PHP project at all.
For very old versions, the PHP security team made an exception and published minimal source fixes for PHP 7.4, 8.0 and 8.1, according to the official PHP security advisory. Those are for server administrators who build PHP themselves. If you are on shared hosting, you cannot apply them; your host has to.
How do I check my PHP version?
Use whichever of these four methods you have access to. Most business owners will need only the first or second.
1. In WordPress: Site Health
- Log in to your WordPress dashboard as an administrator.
- Go to Tools, then Site Health, then the Info tab.
- Open the Server section and read the line PHP version, for example “8.3.36 (Supports 64bit values)”.
- Compare the number with the table above.
If you do not see Site Health, your account may not be an administrator, or a security plugin may have hidden it. Ask whoever manages the site.
2. In cPanel: Select PHP Version or MultiPHP Manager
Log in to cPanel and search for Select PHP Version or MultiPHP Manager, depending on your host. This shows which PHP branch each domain uses. It usually does not show the exact patch number, so it tells you whether you are on an unsupported branch (8.1 or older) but not whether 8.3 is already 8.3.36. For that, use Site Health or ask your host.
3. Ask your hosting provider
This is the most reliable route, especially on shared or managed hosting. Send a short message such as:
“Please confirm the PHP version running for [your domain], and whether it includes the fixes for PHP2Shell (CVE-2026-109618 and CVE-2026-109619). If it does not, when will it be updated?”
4. For developers: the command line
With SSH access, php -v shows the command-line version, but the website may run a different PHP build through PHP-FPM or the web server. Check the version the web server actually uses (for example with Site Health, or a temporary phpinfo() page that you delete immediately afterwards, because it exposes server details).
Why the version number alone may not tell the whole story
Some hosts patch PHP without changing the version number you see. Linux distributions and long-term support vendors received the fixes in advance and often backport them into their own builds, so a server showing an older-looking number can still be safe, and only the vendor can confirm it. The reverse also matters: a patched PHP only protects you once the server processes have been restarted to load it. If in doubt, ask your host to confirm both.
My PHP version is not patched. What should I do today?
Contact whoever manages your hosting today, ask for the update, then check the site still works. In order:
- Find out who is responsible. Your hosting provider, your web developer or your own IT team (see the table further down).
- Back up first. Ask for, or make, a full backup of files and database before anything changes.
- Update PHP to the patched release on your current branch. If you are on 8.1 or older, the safe answer is an upgrade to a supported branch, which needs testing because old themes and plugins can break.
- Make sure PHP has restarted so the fixed version is actually in use, then re-check the version in Site Health.
- Test what earns you money: enquiry forms, WhatsApp and call buttons, checkout and booking, and that emails still arrive.
- Look for signs of compromise (next sections), because some sites were attacked before the patch existed.
💡 From our experience at Adssential
Most updates like this cause no downtime at all; occasionally a site is unavailable for a few minutes, so we schedule the work outside busy hours. The part that needs care is not the update itself but the checks afterwards, especially on older sites where a theme or plugin has not been touched in years. Most requests like this are handled within a few business days, often within 24 hours on weekdays; with PHP2Shell, sooner is better.
What if I cannot update PHP immediately?
Only an update fully fixes PHP2Shell, but the PHP project lists temporary settings that reduce exposure while you wait. These are for your developer or host, because they change server configuration and can affect how the site behaves:
- For CVE-2026-109618: remove the controllable memory limit failure (
memory_limit=-1, set where applications cannot override it) and set a lowpost_max_size(8M if the site needs no uploads, 32M if it does), ideally with request limits at the web server or proxy too. - For CVE-2026-109619: set
session.upload_progress.enabled=0and restart every PHP worker.
The PHP advisory is explicit that these measures “do not make an installation safe”. Treat them as a bridge of hours or days, not a fix. A web application firewall from your host or a service such as Cloudflare may also block known attack patterns, but it is not a substitute for patching either.
How do I know if my website has already been hacked?
Look for changes nobody on your team made. Attackers usually want to use your site quietly for as long as possible, so the signs can be subtle:
- New administrator accounts in WordPress (Users) that you do not recognise.
- Visitors, especially on mobile or from Google, being redirected to gambling, pharmacy or scam sites.
- Google showing “This site may be hacked” in results, or warnings under Security issues in Search Console.
- Pages or files you did not create, such as hundreds of new spam pages appearing in Google for your domain.
- Your host suspending the account or warning about unusual load or outgoing spam email.
If you see any of these, do not just delete the obvious spam. Ask your host or developer to investigate, clean the site, change every password (WordPress, hosting, database, FTP) and patch PHP at the same time. A hack also damages search rankings: Google demotes or flags compromised sites, and spam pages dilute your real content. Recovering visibility afterwards is part of proper SEO work, but it is far cheaper to prevent.
Compliance note: if attackers could have accessed personal data, such as enquiry form submissions or customer accounts, you may have obligations under the PDPA. Organisations must assess suspected data breaches and notify the PDPC and affected individuals when a breach is notifiable. The PDPC sets out the data protection obligations that apply; take advice early if you think data was exposed.
Who is responsible for patching: my host, my developer or me?
It depends on how your website is hosted, and many SMEs only find out during an incident. This is the gap CSA highlighted: businesses assume a vendor is handling it, while the vendor assumes the owner will ask.
CSA also asks organisations to check whether PHP is installed on servers even where the main website does not use it, for example in an old microsite, a booking tool or a forgotten staging copy. Those are often the least maintained, and attackers find them just as easily.
If your developer has moved on and nobody can answer these questions, that is worth fixing beyond this one incident. Our guide on how long website maintenance takes explains what regular upkeep involves, and our article on building websites that are scalable and secure covers the foundations that make updates like this routine.
Frequently asked questions
Does updating WordPress also update PHP?
No. WordPress, its themes and plugins run on top of PHP, which is installed on the web server. Updating WordPress does not change the PHP version; your host or whoever manages the server has to update PHP separately.
Will updating PHP break my website?
A patch update within the same branch, such as 8.3 to 8.3.36, rarely breaks a site. Moving from an old branch such as 7.4 or 8.1 to a supported one can break outdated themes or plugins, so take a backup and test forms, payments and key pages afterwards.
Is PHP 7.4 or 8.1 still safe to use?
Not without a confirmed backported fix. The PHP project no longer issues releases for 8.1 or older; it published minimal source fixes for 7.4, 8.0 and 8.1 for administrators who build PHP themselves. Unless your host confirms it has applied a fix, plan an upgrade now.
How quickly do I need to act?
Today. CSA advises organisations to patch immediately and to prioritise internet-facing systems, and it reports widespread exploitation attempts. Automated scans do not choose targets by size, so a small business website is as likely to be probed as a large one.
My site uses Wix or Shopify. Am I affected?
Fully hosted platforms run and patch their own servers, so there is nothing for you to update on the website itself. Do check any other systems you run on your own hosting, such as a separate blog, booking tool or old microsite, since CSA asks organisations to find every place PHP is installed.
What is the next step?
Check your PHP version now, send the message above to your host if you are not sure, and keep the reply. If the site is on an old PHP branch, treat the upgrade as urgent rather than something for next quarter.
If you would rather have someone handle it, our website maintenance service handles updates like this, either as part of ongoing maintenance or as a one-off fix. For sites that are too old to update safely, a web developer who can rebuild on a current platform is often the cheaper long-term answer. Either way, act this week: PHP2Shell is a case where waiting is the expensive option.