--- title: "PHP2Shell Free Website Security Check | HMMBiz" url: "https://hmmbiz.com/php-security" description: "PHP2Shell (CVE-2026-109618) lets attackers take over PHP websites without a password. Get a free check of your WordPress or PHP site and a fixed-price fix within 48 hours." word_count: 3589 reading_time: "18 min read" generated: "2026-10-24T06:26:29+05:30" source: "HMMBiz — hmmbiz.com" --- PHP2Shell Free Website Security Check | HMMBiz Great things take time to load... CRITICAL PHP VULNERABILITY · ATTACKS ALREADY ACTIVE # Is Your Website Safe from PHP2Shell? A critical flaw in PHP lets attackers take over a website without a password. It affects most PHP sites, including WordPress, WooCommerce and Magento. We'll check yours for free and tell you plainly whether it needs fixing. [Get My Free Site Check](#php-check) [Check My PHP Version](#php-version) CVE-2026-109618 · CVE-2026-109619 · fixed in PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 ### 9.2 SEVERITY SCORE (CRITICAL) ### 17 Oct FIRST ATTACK ATTEMPT SEEN ### 48 Hrs FIX AFTER YOUR APPROVAL ### 650+ GLOBAL CLIENTS FREE SITE CHECK ## Find Out If Your Website Is Affected Send us your website address. Within one working day, our team replies with one of three answers: - **Not affected.** Your server already has the fix. Nothing to do. - **Needs a closer look.** We explain what we need to confirm it. - **Affected.** You get a flat-fee quote, with the fix done within 48 hours of approval. No obligation. We only look at what your website shows publicly until you ask us to go further. Your name Website address Business email Mobile number How many websites? 1 website 2–5 websites 6–9 websites 10+ websites (agency / partner) Check My Website CHECK IT YOURSELF IN 2 MINUTES ## Which PHP Version Is Your Website On? Each PHP line got its own fixed release on 21 October 2026. Anything older than these numbers, or on a version that no longer gets security fixes, needs attention. PHP 8.58.5.12 or newer PHP 8.48.4.27 or newer PHP 8.38.3.36 or newer PHP 8.28.2.35+ · support ends 31 Dec PHP 8.1 & olderNo official fix ### Type your PHP version Check Type a version like **8.3.35** or **7.4** and press Check. **Where to find it:** WordPress → Tools → Site Health → Info → Server. In cPanel → Select PHP Version or MultiPHP Manager. WHO MAY BE AFFECTED ## The Flaw Is in PHP Itself, So Clean Website Code Doesn't Protect You ### WordPress Sites Blogs, business websites and portfolios. Updating WordPress or plugins does not fix PHP2Shell. ### Online Stores WooCommerce, Magento and Shopware stores are exposed even when their own code is clean. ### Custom PHP Apps Laravel, CodeIgniter and bespoke PHP web apps, portals and dashboards. ### Older PHP Versions PHP 8.1, 7.4 and older get no official fix and need an upgrade with testing. WHY IT NEEDS CARE ## Why Fixing It Isn't Just a Server Update ### Old Versions Get No Fix Moving from PHP 7.4 or 8.1 to 8.3 or 8.4 is a big step. Old themes, plugins and custom code can break, often on the checkout or contact form, unless they are tested first. ### A Patch Doesn't Clean Up Attack attempts were seen before the fix was released. Updating PHP closes the door, but it won't remove a hidden file or an extra admin account left behind. ### Your Host May Not Do It Some hosts update PHP for you, others leave it to you. On a VPS or cloud server, it is usually your responsibility or your developer's. HOW WE FIX IT ## Free Check First. Then the Same Seven Steps, Every Time. ### Free Site Check We tell you if your website is affected. No obligation. 1### Full Backup Files and database, before anything changes. 2### Compatibility Check Theme, plugins and custom code tested on the new PHP version. 3### Patched PHP Version The newest fixed release your website can safely run. 4### Tighter Settings PHP features your website doesn't use are switched off. 5### Testing Forms, checkout, logins, search and key landing pages. 6### Compromise Check Unknown files, new admin accounts and changed code. 7### 48-Hour Monitoring Then a plain-language completion report. Flat fee per website, quoted after your free check. Most fixes are completed within **48 hours** of approval. We patched the servers we manage within 24 hours of the official fix. THE NEXT DEADLINE ## PHP 8.2 Stops Getting Security Fixes on 31 December 2026 If your website is being upgraded now, go straight to PHP 8.3 or 8.4 where it is compatible. You test once, instead of again in ten weeks. 31 Dec END OF PHP 8.2 SECURITY SUPPORT FOR AGENCIES ## Look After Many Client Websites? We Patch Them for You, White-Label. The same seven steps, delivered under your brand, with a ready-to-send note for your clients and partner rates from 10 websites. [Ask About Partner Rates](#php-check) FAQ ## Frequently Asked Questions What is PHP2Shell? PHP2Shell is the name for two critical flaws in PHP, CVE-2026-109618 and CVE-2026-109619. They can let an attacker run their own code on a web server without logging in. PHP released fixed versions (8.2.35, 8.3.36, 8.4.27 and 8.5.12) on 21 October 2026. Will updating WordPress or my plugins fix it? No. The flaw is in PHP, the software underneath WordPress and other platforms, so it is fixed by updating PHP on the server. Updating WordPress, themes or plugins does not close it. My PHP version number looks old. Am I definitely affected? Not always. Some hosting companies apply the fix without changing the version number shown. Our free site check confirms whether your server already has the fix. How long does the fix take? Most fixes are completed within 48 hours of your approval, followed by 48 hours of monitoring and a short completion report. What does it cost? The site check is free. The fix is a flat fee per website, which we quote after the check, so you know the price before any work starts. Agencies with 10 or more websites get partner rates. Do you need access to my website? Not for the free check, which only looks at what your website shows publicly. For the fix, we need hosting (cPanel or FTP) or admin access, which you share after approving the quote. Sources: [PHP security advisory](https://www.php.net/archive/2026.php#2026-10-21-5) · [Sansec](https://sansec.io/research/php2shell) · [Tenable](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote) · [Help Net Security](https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/) · [Malwarebytes](https://www.malwarebytes.com/blog/bugs/2026/10/php2shell-why-websites-are-going-offline-for-emergency-security-updates) ## Find Out Today Whether Your Website Is Exposed Free check, plain answer within one working day, and a fixed-price fix if you need one. [Get My Free Site Check](#php-check) [ ![HMMBiz Logo Footer](https://hmmbiz.com/public/assets/images/logo-footer.svg) ](https://hmmbiz.com)Follow us on: [ ](https://www.facebook.com/HMMBiz/) [](< https://www.linkedin.com/company/hmmbiz-web-solutions/>) [](https://www.instagram.com/hmmbiz) ### Company - [About Us](https://hmmbiz.com/about-us/) - [Clients](https://hmmbiz.com/clients/) - [Careers](https://hmmbiz.com/careers/) We are Hiring - [Contact Us](https://hmmbiz.com/contact-us/) - [Case Studies](https://hmmbiz.com/case-studies/) - [Industry](https://hmmbiz.com/industries/) - [Blogs](https://hmmbiz.com/resources/blogs/) ### Services - [Web Development](https://hmmbiz.com/services/web-design-and-development-company/) - [Marketing](https://hmmbiz.com/services/digital-marketing-agency/) - [Mobile Apps](https://hmmbiz.com/services/mobile-app-development-company/) - [UI/UX Design](https://hmmbiz.com/services/ui-ux-graphic-design-agency/) - [DevOps](https://hmmbiz.com/services/dev-ops-services/) - [E-Commerce](https://hmmbiz.com/services/ecommerce-website-development-services/) - [Web Hosting](https://hmmbiz.com/services/website-hosting-and-maintenance/) ### Solutions - [Google Workspace](https://hmmbiz.com/buy-google-workspace/) - [Search Engine SEO](https://hmmbiz.com/services/search-engine-optimization-seo/) - [Pay-Per-Click PPC](https://hmmbiz.com/services/pay-per-click-ppc-agency/) - [Cloud Platform](https://hmmbiz.com/services/google-cloud-platform/) - [Google Ads ROI](https://hmmbiz.com/resources/growth-tools/google-ads-roi-calculator/) ###### GLOBAL PRESENCE India USA UK AUS UAE [ ![](https://hmmbiz.com/public/assets/images/new-icons/footer-icon/footer-mobile.svg) +1 (862)246-6249 ](tel:+18622466249) [ ![](https://hmmbiz.com/public/assets/images/new-icons/footer-icon/footer-mail.svg) sales@hmmbiz.com ](mailto:sales@hmmbiz.com) ![](https://hmmbiz.com/public/assets/images/new-icons/footer-icon/footer-hmmbiz-logo.svg) © Copyright 2026 HMMBiz Web Solutions. All rights reserved. [Privacy Policy ](https://hmmbiz.com/privacy-policy/) &nbsp | &nbsp [Terms & Conditions](https://hmmbiz.com/terms-and-conditions/) &nbsp | &nbsp [Refund Policy](https://hmmbiz.com/refund-policy/) [](javascript:void(0)) --- _Markdown version generated by HMMBiz AI Analytics._ _Original page: https://hmmbiz.com/php-security_