PHP2Shell: What to Ask Your Web Host
Use this PHP2Shell checklist to ask your web host about security fixes, understand their reply and decide what to do if your business website needs help.
If you are wondering what to ask your web host about PHP2Shell, start with this: has the copy of PHP actually running my website received both security fixes, and how have you checked? Then ask whether the host has looked for signs of earlier compromise. Installing an update and investigating what happened before it are separate jobs.
You do not need to diagnose a server yourself. You need a clear answer for your website, backed by the host's update records, and someone responsible for anything still outstanding. There is a message below you can copy into a support ticket.
Research checked: 2026-10-29
What is PHP2Shell, and could it affect my website?
PHP2Shell is the name used for two serious PHP vulnerabilities: CVE-2026-109618 and CVE-2026-109619. PHP is software used to run many websites, including WordPress sites. These flaws can allow an attacker to make an affected server run code they control.
The original security releases arrived on 21 October 2026: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Those are the initial fixed releases, rather than a complete list of today's applicable hosting updates. The PHP project's announcement and later notices are the starting point for your host's checks.
Not every website uses PHP. If you do not know what yours uses, ask the provider responsible for hosting it. If your web designer manages that relationship, ask them to obtain the host's answer for your domain.
For WordPress owners, an important distinction is that updating WordPress alone does not fix these PHP vulnerabilities. The official WordPress notice explains that the issue is in PHP, rather than WordPress core. Your hosting provider usually controls that layer.
Six questions worth asking your host
The aim is to replace “everything is up to date” with an answer you can keep and act on.
- Does this affect my website? Give the host your domain and any relevant subdomains. Ask them to identify which services use affected PHP software, rather than send a general announcement about their hosting platform.
- Have both security fixes been applied? Ask for the full PHP package or build details and the vendor's advisory confirming the fixes. Include both CVE references above so there is no ambiguity about the issue.
- Is my live website using the fixed version? An update may be installed without proving that every running service has switched to it. Ask the host to confirm the PHP serving your website, including any necessary service restarts.
- Have you checked for earlier compromise? Ask what was checked, which period the checks covered and what remains uncertain. A patch confirmation should not be presented as evidence that nothing happened beforehand.
- Is anything still outstanding? Ask about relevant later vendor updates, temporary measures and actions that need your approval. Get an owner and a completion or next-update time for each action.
- Who handles this in future? Establish who owns PHP updates, website updates, backups, restore checks and urgent support. Hosting and website maintenance may sit with different providers.
A message you can send to your web host
Copy the text below into a support ticket and add your domain after the first sentence. Keep passwords and other login details out of the ticket.
Subject: PHP2Shell — please confirm our website's patch status
Hello,
Please check the PHP2Shell position for our website and relevant subdomains.
1. Do any services running our website use PHP affected by CVE-2026-109618 or CVE-2026-109619?
2. Have both fixes been applied? Please provide the full package/build details and the vendor advisory that confirms this, including evidence of any backported fixes.
3. Have you verified that the PHP actually serving our website is using the patched build, with any necessary restarts completed?
4. Have you checked for signs of earlier compromise? Please explain the scope and limitations of those checks separately from the patch status.
5. Does anything remain outstanding, including relevant later vendor updates? Who is responsible, and when will you confirm completion or provide another update?
6. Who is responsible for PHP and website updates, backups, restore checks and urgent support under our agreement?
Please include a support reference and explain anything you need us to do.
Thank you.How to tell whether the reply answers your question
A useful reply identifies your website, its PHP software, the fixes applied and the checks completed. It also says what the host has not established. Keep that response with your support reference and any agreed follow-up date.
| If your host says… | Ask or do this next |
|---|---|
| “WordPress is up to date.” | Ask specifically about the PHP fixes. They are a separate part of the system. |
| “You are on PHP 8.” | Request the full package or build and confirmation that it includes both fixes. |
| “Our firewall protects you.” | Ask whether this is a temporary measure and whether patching is complete. |
| “Both fixes are installed and your website is running the patched build.” | Keep the evidence. Separately establish the position on checks for earlier compromise. |
| “We have not completed the update.” | Ask for urgent escalation, the interim plan and a clear completion or next-update time. |
Do not judge the answer solely by a short version number. Some vendors apply a security fix to an existing release without changing that familiar number. This is called a backport. The Plesk advisory documents examples where build details matter. That does not mean every older PHP release is safe; your host needs evidence for its particular package.
In WordPress, Tools → Site Health → Info → Server shows the reported PHP version, as described in the WordPress security notice. You can share it with the host, but it is not a substitute for their package and running-service checks.
What if the host cannot answer, or the website looks wrong?
Use your current provider's urgent support route. Ask for the team responsible for the server software and a time for the next update. If the website has unexpected redirects, unfamiliar content or new problems, record what changed and when. Report those observations without assuming PHP2Shell caused them.
The UK National Cyber Security Centre's guidance calls for updates and sets out further options when these cannot be applied promptly. Temporary mitigations may be needed; taking affected systems offline is a conditional option when mitigations are unavailable or would take too long. It also addresses checking for compromise where immediate updating or disabling was not possible.
Ask the provider to explain which action fits your situation. A general warning is not a reason to switch off an already-patched site. Equally, a normal-looking homepage does not settle the question of earlier compromise.
Before agreeing to a restore or major change, ask what evidence needs preserving, which backup would be used and what recent business data might be lost. Those decisions deserve a clear explanation from whoever is doing the work.
Make the next update less confusing
Once the immediate questions are resolved, write down who maintains each part of your website and how to reach them. Our guide to what to prepare before hiring a web designer can help with the wider handover conversation.
If this has exposed longer-term problems with the site, you can explore our web design services and recent work. Deal with any current security exposure first; a future redesign should not delay the host's response.
Let's get your website back on track
Website stopped working after an update? Something broken, or a host's reply that leaves you unsure where to turn?
Ask about Website Rescue. Tell Klikkit what's happened, what your host has said and what you need working again. We can discuss the problem and scope the next steps. Keep your host involved in urgent security checks, and leave passwords out of your initial enquiry.