PHP2Shell is patched here. Is it patched on yours?

ByAlex Caldwell

On October 21, PHP released fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619, now known as PHP2Shell. Either one lets an attacker run code on a web server without logging in. Nearly every WordPress site runs on PHP, so nearly every WordPress site needed attention this week.

Ours is done

Two days after the fix shipped, blueridgecloudcover.com was running the patched PHP.

We didn’t just update and hope:

  • Checked first. Attack attempts started on October 17, before the fix was even public. So before changing anything, we looked for signs that someone had already used the flaw to get in. We found none.
  • Made a way back. We took a full snapshot of the server.
  • Patched and proved it. We moved to the fixed PHP, then confirmed every page on the site came back exactly as it was. The only interruption was a web server restart lasting a few seconds.
PHP2Shell RCE patched: patched and secured by Blue Ridge Cloud Cover

It wasn’t a one-click job for us. Our site runs on AWS Lightsail from a Bitnami image, where the usual update command doesn’t touch PHP at all. If you run WordPress the same way, we’ve written up the whole process step by step, including the checks, the fix and the rollback plan: How we patched PHP2Shell on a Bitnami Lightsail site.

Patched too? Put the badge on your site

If your site is patched, say so. Your visitors and customers can’t see your server, but they can see this. The badge is free to use. Download it, or paste the snippet below into your site’s footer or a widget.

Patched and safe: PHP2Shell, CVE-2026-109618 and CVE-2026-109619
<a href="https://blueridgecloudcover.com/php2shell-patched/" title="Patched against PHP2Shell">
  <img src="https://blueridgecloudcover.com/wp-content/uploads/2026/10/php2shell-patched-badge-300.jpg" alt="Patched against PHP2Shell (CVE-2026-109618, CVE-2026-109619)"
       width="150" height="150" loading="lazy">
</a>

Download the full-size badge (1024 × 1024).

One rule: only use it once you’ve actually patched. That means the PHP serving your website is 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or newer on its line, or your hosting company has confirmed the fix in writing. Updating WordPress itself doesn’t count, because the flaw is in PHP underneath it.

If we patched your site, use ours

Clients whose sites we patched get the Blue Ridge Cloud Cover version:

<a href="https://blueridgecloudcover.com/php2shell-patched/" title="PHP2Shell patched by Blue Ridge Cloud Cover">
  <img src="https://blueridgecloudcover.com/wp-content/uploads/2026/10/brcc-php2shell-sticker-300.jpg" alt="PHP2Shell patched by Blue Ridge Cloud Cover"
       width="150" height="186" loading="lazy">
</a>

Not sure where you stand?

Ask your hosting company one question: “Which PHP version serves my website, and does it include the October 21 PHP2Shell fix?” If the answer is vague, or you’d rather someone just handled it, get in touch. We’ll check your site, patch it if it needs it, and you’ll get the sticker.

Similar Posts