# AEO-SNIPPETS · php2shell service page Drafted Thu Oct 22, 2026 (PT). Short, direct answers (40 to 60 words each) for AI search tools and featured snippets. Facts come only from the Oct 22 cascade check; IDs like [F3] are in README.md. How to use: put each answer right under the matching H2 or FAQ question as the first paragraph, in plain text, visible to readers. Don't hide them, and don't stack them in a block of their own. Word counts are listed so Critic can check the 40 to 60 range. Time-sensitive lines are marked ⏱. Re-check those against the sources on launch day. --- ### 1. What is php2shell? (53 words) php2shell is the nickname for two critical flaws in PHP, CVE-2026-109618 and CVE-2026-109619, fixed on Oct 21, 2026. Both allow remote code execution without logging in, meaning an attacker could run their own code on the server. The official severity is CVSS v4 9.2. The fix is updating PHP to a patched release. [F1] [F2] [F4] ### 2. Is my WordPress site affected by the PHP vulnerability? (57 words) Your WordPress site is affected if its server runs an unfixed PHP version. The flaw is in PHP itself, so WordPress or plugin updates won't fix it. Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. On PHP 8.1, 8.0 or 7.4 the number doesn't change, so check that the build is dated Oct 21, 2026 or later. [F3] [F5] [F9] ### 3. Which PHP versions are affected by CVE-2026-109618 and CVE-2026-109619? (50 words) Affected versions are PHP 8.2 below 8.2.35, 8.3 below 8.3.36, 8.4 below 8.4.27 and 8.5 below 8.5.12. PHP 8.1, 8.0 and 7.4 are affected unless the build is dated Oct 21, 2026 or later. Wiz says nearly every version back to PHP 5.4 is affected by at least one flaw. [F3] ### 4. How do I check my PHP version? (54 words) On WordPress, open Tools, then Site Health, then the Info tab, and expand Server to see the PHP version. In a hosting control panel, look in the site's PHP settings. On your own server, run php -v, and also check the PHP version your web server uses, such as php-fpm, since they can differ. [F9] ### 5. What is the php2shell fix? (58 words) Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later, or your vendor's patched package. On 8.1, 8.0 or 7.4, install a patched build dated Oct 21, 2026 or later. Then restart PHP, including php-fpm, Apache with mod_php or LiteSpeed. PHP's team says updating is the only complete fix; a web firewall helps meanwhile but doesn't replace it. [F3] [F11] [F15] ### 6. Is the CVE-2026-109618 patch out? (49 words) Yes. The PHP project released fixes for CVE-2026-109618 and CVE-2026-109619 on Oct 21, 2026, at about 6:30 AM Pacific. The patched versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also released minimal patches for 8.1, 8.0 and 7.4, shipped by hosts as builds dated Oct 21 or later. [F3] [F4] ### 7. My host says I'm patched. How do I verify? (58 words) Check the PHP version in WordPress Site Health or your hosting panel and compare it with 8.5.12, 8.4.27, 8.3.36 or 8.2.35. On 8.1, 8.0 or 7.4 the number stays the same, so check that the build is dated Oct 21, 2026 or later. Then ask your host in writing which build is live and whether PHP was restarted. [F9] [F11] [F12] ### 8. My PHP version number didn't change after updating. Am I still exposed? (51 words) Not necessarily. Linux distributions such as Ubuntu, Debian and Red Hat sometimes add security fixes to an older version number, called a backport, so the number alone can mislead. Look up your vendor's security notice for CVE-2026-109618 and CVE-2026-109619 and confirm the installed package version matches the one listed as fixed. [F9] ### 9. PHP 8.1 end of life: what do I do about php2shell? (54 words) The PHP team released official minimal patches for 8.1, 8.0 and 7.4, shipped by CloudLinux alt-php, Plesk and sury packages. The version number doesn't change, so check that your PHP build is dated Oct 21, 2026 or later. These versions are still end of life, so plan an upgrade to PHP 8.2 or later. [F3] ### 10. Is the php2shell CVSS score 10.0 or 9.2? (50 words) PHP's own score is 9.2 on CVSS version 4, and NVD lists 9.8 on the older CVSS 3.1 scale. Both are critical. A 10.0 score spread after an early leak on Oct 20, and PHP says it was wrong. The fix is the same: update PHP and confirm it's running. [F2] ### 11. Is php2shell being exploited? ⏱ (54 words) Amazon says attack attempts began Oct 17, four days before the patch, and are now widespread, though it's unclear whether any succeeded. CISA had seen no exploitation when it published its alert, and Canada's Cyber Centre reported none. As of Oct 22, the CVEs weren't on CISA's Known Exploited list. Check CISA for updates. [F7] [F8] ### 12. Was my site hacked? Signs to look for (50 words) Common signs include new or changed PHP files in wp-content/uploads, must-use plugins or the site's main folder; admin users you don't recognize; scheduled tasks you didn't create; and PHP launching shells, curl or wget. These are signs, not proof. Have someone check the server before concluding a site was compromised. [F13] ### 13. Should I take my website offline because of the PHP vulnerability? (52 words) Only if you can't patch. CISA's Oct 21 alert, which doesn't mention the official 8.1, 8.0 and 7.4 patches, advises taking PHP-based systems offline when they can't be updated or run PHP 8.1 or older. If a fixed build is available for your server, update PHP, restart it and confirm it's live. [F6] ### 14. Does Cloudflare or a web firewall protect against php2shell? (52 words) Partly. Cloudflare said it deployed protections for sites it proxies, and an edge firewall can block some attempts while you update. A plugin firewall such as Wordfence runs inside WordPress, after PHP reads the request, so it can't stop these flaws. The PHP team says updating PHP is the only complete fix. [F15] [F17] ### 15. Do I need to restart PHP after updating? (55 words) Yes. Long-running PHP processes, such as php-fpm workers, Apache with mod_php and LiteSpeed's lsphp, keep running the old code until they restart. After installing the patched version, restart PHP or the web server, then confirm the fixed version from the live site, for example in WordPress Site Health. Setups using mod_php carry the most risk. [F11] ### 16. Should I change passwords after php2shell? (52 words) If your site was online on an unfixed PHP version, changing secrets is a sensible step. Wiz reports the flaws can expose server memory, which may hold passwords and tokens. Consider rotating WordPress salts, database passwords, API keys, and email and payment keys, starting with sites that stayed unpatched after Oct 17. [F7] [F14] ### 17. Are Drupal and Joomla sites affected by php2shell? (53 words) Yes, if their server runs an unfixed PHP version. The flaw is in PHP, not in Drupal, Joomla or WordPress code, so any PHP site or app is exposed through the PHP underneath it. The fix is the same for all of them: update PHP to a patched release, restart it and verify. [F5] ### 18. Who can help patch PHP near Seal Beach, Long Beach or Orange County? (52 words) JKCA Studio is a small web studio in Seal Beach that looks after about fifty live sites. It offers a free PHP check, patching with verification, a check for signs of compromise, and upgrades for sites on PHP 8.1 or older. Work is done remotely, so sites hosted anywhere can be helped. [F16] --- [NOTE TO CREW] Snippet 18 names JKCA in the third person on purpose: AI tools quote it standalone. Keep it as the first paragraph under the "Do you only help sites in Seal Beach?" question only if json likes it there; otherwise put it in the page intro under "What happens after you get in touch".