On October 21, 2026, the PHP project released fixes for a flaw now called PHP2Shell (CVE-2026-109618 and CVE-2026-109619). It sits in PHP itself, the language behind WordPress, Drupal, Joomla, Magento and many custom sites. An unpatched server can let someone run their own code on it through a file upload request, before your site's login checks ever run.

The fix is a PHP update, and for most sites it is a setting at your host, not a rebuild. This guide covers:

• •Whether your site is affected
• •How to find your PHP version on your platform
• •Which version to move to
• •What to do if you cannot update yet
• •How to check whether anyone tried it

Full disclosure: Stackra's website scan now checks for this, so we have a stake in the topic. The steps below work without us, and every one of them points to the official source.

Is your site affected?

If your site runs on PHP and your server has not been updated since October 21, assume it needs the update. Amazon's threat intelligence team saw the flaw being used from October 17, before it was public. The upload progress feature it relies on is switched on by default in PHP.

• •Likely affected: self-hosted WordPress, WooCommerce, Drupal, Joomla, Magento, PrestaShop, OpenCart, and custom PHP sites (Laravel, CodeIgniter, CakePHP).
• •Your host handles it: Wix, Squarespace, Shopify, Webflow and other website builders run the servers for you. Managed WordPress hosts (WP Engine, Kinsta, Pantheon, WordPress VIP and similar) patch PHP for their customers.
• •Not affected by this flaw: sites that do not run PHP at all.

Step 1: Find your PHP version

Most platforms show the PHP version in the admin area. If yours does not, your hosting control panel or your host's support team can tell you.

• •WordPress: Tools > Site Health > Info, then open Server.
• •Drupal: Reports > Status report.
• •Joomla: System > Information Panel > System Information.
• •Magento, Laravel and other custom builds: ask your developer.
• •cPanel hosting: MultiPHP Manager shows the version for each domain.
• •Plesk hosting: Websites & Domains, then PHP.

Step 2: Move to a fixed version

Each supported PHP line has its own fixed release. Stay on your line and update to at least its fixed version, or move up a line.

Before you change PHP, check your platform

A PHP update is usually safe, but your platform has its own limits. Back up the site first.

• •WordPress recommends PHP 8.3 or newer. Update your plugins and theme before you switch, then check the site.
• •Drupal 11 needs PHP 8.3 or newer. Drupal 10 runs on PHP 8.1 to 8.4.
• •Joomla 6 needs PHP 8.3 or newer.
• •Magento 2.4.6 supports only PHP 8.1 and 8.2. If you are on 8.1, the store needs Magento 2.4.7 or newer before PHP can move up.
• •Laravel 12 needs PHP 8.2 or newer.

Step 3: If you cannot update yet

Ask your host or developer to turn off PHP's upload progress tracking until the update is done. The setting is session.upload_progress.enabled, set to Off. Check what it affects first: it stops upload progress bars on your site, and most sites do not use them.

Step 4: Check whether anyone tried it

Amazon published what to look for: POST requests containing PHP_SESSION_UPLOAD_PROGRESS, from October 17 on. Standard web server logs often do not record request contents, so ask your host or firewall provider to check theirs. If anything turns up, also ask them to look for unexpected files or processes on the server.

Step 5: Stop announcing your version

Many servers announce their exact PHP version in a response header. Once you are updated, ask your host or developer to set expose_php to Off. It does not fix anything on its own, but it stops advertising which version you run.

How the Stackra scan checks this

Our website scan reads the PHP version your server announces in its own responses during the scan. It never sends anything that resembles an attack. If the version is from before the fix, the report says so and lists these steps. If your server hides its version, the report asks you to check with your host, and it never calls a site safe or unsafe on a guess. The check is not part of your score.